Cisco fixes critical authentication bypass bug in its enterprise software
Cisco urges users to upgrade their devices to the patched version
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Ciscohas patched a critical authentication bypass bug in its Enterprise Network FunctionVirtualizationInfrastructure Software (NFVIS) that could be exploited to allow a remote attacker to bypass authentication and log in as the device’s administrator.
Tracked as CVE-2021-34746 the vulnerability was discovered in NFVIS’ TACACS+ authentication, authorization and accounting (AAA) feature.
“This vulnerability is due to incomplete validation of user-supplied input that is passed to an authentication script. An attacker could exploit this vulnerability by injecting parameters into an authentication request,” Cisco shared in itsadvisory.
We’re looking at how our readers use VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey won’t take more than 60 seconds of your time, and we’d hugely appreciate if you’d share your experiences with us.
Click here to start the survey in a new window«
Cisco describes Enterprise NFVIS as aLinux-based infrastructure software that helps businesses to deploy virtualized network functions, such as a virtualrouter, or afirewallon supported Cisco devices.
Upgrade to mitigate
According to Cisco’s advisory, the vulnerability only exists in Enterprise NFVIS release v4.5.1. Even on devices running this vulnerable version, the bug can be exploited only if the TACACS external authentication method has been enabled.
That said, in addition to the vulnerability being exploitable by unauthenticated users remotely, the fact that it has a publicly available proof-of-concept exploit code makes it a major threat.
Cisco has stated that there are no workarounds to remove the attack vector exposed by this security flaw. Instead, the company urges all users to upgrade to Enterprise NFVIS release v4.6.1 or later, which ships with a fix for the vulnerability.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
The company has meanwhile assured users that it isn’t aware of any ongoing exploitation of the vulnerability in the wild.
With almost two decades of writing and reporting on Linux, Mayank Sharma would like everyone to think he’sTechRadar Pro’sexpert on the topic. Of course, he’s just as interested in other computing topics, particularly cybersecurity, cloud, containers, and coding.
Don’t search for information on cats at work — you could be at risk of being hacked
This dangerous new malware is hitting Windows devices by hiding in games
Nvidia’s GeForce Now Priority membership has upgraded to ‘Performance’ - introducing a 1440p resolution and ultrawide support
