Tag: cisco

security

Fehlende API-Authentifizierung gibt Angreifern Site-Admin-Rechte

Eine kritische Schwachstelle mit CVSS 10.0 in Cisco Secure Workload erlaubt unauthentifizierten Angreifern den Zugriff auf interne REST-APIs. Über ma­ni­pu­lierte Anfragen lassen sich Site-Admin-Rechte erlangen und Kon­fi­gu­ra­ti­onen über Mandantengrenzen hinweg verändern. Patches sind verfügbar, SaaS-Installationen hat Cisco bereits serverseitig korrigiert.

Mehr lesen →
soc

CVE-2026-20245: Cisco SD-WAN Manager Zero-Day Enables Root Command Execution

Cisco has disclosed a seventh SD-WAN zero-day exploited in 2026, tracked as CVE-2026-20245. The flaw affects the command-line interface of Cisco Catalyst SD-WAN Manager and can allow an authenticated remote attacker with netadmin privileges to execute arbitrary commands as root by uploading a crafted file. Cisco says exploitation has already been observed in limited cases, […]

Mehr lesen →
soc

CVE-2026-20230: Cisco Unified CM WebDialer SSRF Can Lead to Root-Level Compromise

CVE-2026-20230: Cisco Unified CM WebDialer SSRF Can Lead to Root-Level Compromise Cisco has released fixes for CVE-2026-20230, an unauthenticated remote vulnerability affecting Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (SME). The flaw is an SSRF issue that can be chained into an arbitrary file write on the underlying operating system, […]

Mehr lesen →