Cisco Patches Critical Flaw in Vision Dynamic Signage Director

Saturday, July 20, 2019

Ionut Arghire

Fa42af438e58b799189dd26386f5870f

Cisco this week released a security patch for the Vision Dynamic Signage Director, to address a Critical vulnerability that could allow attackers to execute arbitrary actions on the local system. 

Tracked as CVE-2019-1917, the vulnerability was found in the REST API interface of Vision Dynamic Signage Director and could be exploited by an unauthenticated, remote attacker to bypass authentication on an affected system.

“The vulnerability is due to insufficient validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected system,” Cisco explains.

An attacker able to exploit the vulnerability would execute arbitrary actions through the REST API with administrative privileges. 

Enabled by default, the REST API cannot be disabled. According to Cisco, there is no workaround for this issue, but a software update has been released to address the bug. 

This week, Cisco also addressed High severity vulnerabilities FindIT Network Management Software, and IOS Access Points Software 802.11r. Tracked as CVE-2019-1919 and CVE-2019-1920, these bugs could be exploited to log in with root-level privileges or cause a denial of service (DoS), respectively.

Cisco also releasedfixes for several Medium severity vulnerabilities in Industrial Network Director (IND), Small Business SPA500 Series IP Phones, Small Business 200, 300, and 500 Series Switches, and Identity Services Engine (ISE).

These vulnerabilities include information disclosure, local command execution, open redirect, Cross-Site Scripting, and blind SQL injection flaws. 

Additionally, Cisco updated the advisories published for several older vulnerabilities, including a High severity flaw in its Secure Boot implementation, which could allow an attacker to modify a device’s firmware, and which impacts a large number of Cisco products. 

The advisories for three command injection vulnerabilities in NX-OS software, namely CVE-2019-1776, CVE-2019-1783, and CVE-2019-1784, were updated as well, along with those for a Cross-Site Request Forgery bug in OS XE software Web UI and a Denial of Service in IOS software.

RelatedCertificates Issued to Huawei Subsidiary Found in Cisco Switches

RelatedCritical Flaws Found in Cisco Data Center Network Manager

62853
CVE Vulnerabilities
CVE-2019-1917
Post Rating I Like this!
The views expressed in this post are the opinions of the Infosec Island member that posted this content. Infosec Island is not responsible for the content or messaging of this post.

Unauthorized reproduction of this article (in part or in whole) is prohibited without the express written permission of Infosec Island and the Infosec Island member that posted this content--this includes using our RSS feed for any purpose other than personal use.