New Flaws Discovered in Cisco’s Network Operating System for Switches

Cisco has released software updates to address four security
vulnerabilities in its software that could be weaponized by
malicious actors to take control of affected systems.

The most critical of the flaws is CVE-2022-20650^[1]
(CVSS score: 8.8), which relates to a command injection flaw in the
NX-API feature of Cisco NX-OS Software that stems from a lack of
sufficient input validation of user-supplied data.

“An attacker could exploit this vulnerability by sending a
crafted HTTP POST request to the NX-API of an affected device,”
Cisco said. “A successful exploit could allow the attacker to
execute arbitrary commands with root privileges on the underlying
operating system.”

The flaw impacts Nexus 3000 Series Switches, Nexus 5500 Platform
Switches, Nexus 5600 Platform Switches, Nexus 6000 Series Switches,
and Nexus 9000 Series Switches in standalone NX-OS mode running
Cisco NX-OS Software that have the NX-API feature enabled.

Also patched are two high-severity denial-of-service (DoS) bugs
in NX-OS – CVE-2022-20624^[2]
and CVE-2022-20623^[3]
(CVSS scores: 8.6) – found in the Cisco Fabric Services Over IP
(CFSoIP^[4]) and Bidirectional
Forwarding Detection (BFD^[5]) traffic functions.

CVE-2022-20624, which was reported to Cisco by the U.S. National
Security Agency (NSA), impacts Nexus 3000 and 9000 Series Switches
and UCS 6400 Series Fabric Interconnects, assuming CFSoIP is
enabled. CVE-2022-20623, on the other hand, only affects Nexus 9000
Series Switches that have BFD toggled on.

Lastly, the networking equipment maker also patched a third DoS
vulnerability (CVE-2022-20625^[6], CVSS score: 4.3) in the
Cisco Discovery Protocol service of Cisco FXOS Software and Cisco
NX-OS Software, which could “allow an unauthenticated, adjacent
attacker to cause the service to restart, resulting in a denial of
service (DoS) condition.”

Cisco said that it’s not aware of “any public announcements or
malicious use” of the aforementioned vulnerabilities. That said,
it’s recommended that users move quickly to apply the necessary
updates to prevent potential real-world exploitation.