Cisco has issued a warning from a cross-site scripting (XSS) vulnerability in end-of-life (EoL) RV series small business routers.
Tracked as CVE-2024-20362 and remotely exploitable without authentication, the flaw impacts the small business RV016, RV042, RV042G, RV082, RV320, and RV325 routers, which have been discontinued and no longer receive security patches.
While Cisco says it is not aware of this vulnerability being exploited in the wild, there are no workarounds for the bug and users are advised to migrate to a supported product. Discontinued Cisco networking devices are known to have been exploited in attacks.
The company described the issue as insufficient validation in the web interface of the affected products allows attackers to mount XSS attacks by convincing users to visit a malicious page, which could lead to script execution or information leaks.
The cybersecurity vendor also announced patches for several other vulnerabilities across its product portfolio, including a high-severity defect in Nexus Dashboard Fabric Controller (NDFC) that could allow unauthenticated, remote attackers to read arbitrary files.
The bug, CVE-2024-20348, exists due to an unauthenticated provisioning web server that can receive direct requests from a remote attacker, allowing them to read sensitive files in the Plug and Play (PnP) container, opening the door to further attacks on the PnP infrastructure.
The flaw impacts NDFC version 12.1.3b with a default configuration. NDFC versions 12.1.2 and earlier and 12.2.1 are not affected.
Cisco also announced patches for several medium-severity bugs in TelePresence Management Suite, Nexus Dashboard, Nexus Dashboard Orchestrator, Identity Services Engine (ISE), Enterprise Chat and Email, Unified Communications Manager IM & Presence Service, and Emergency Responder.
The company says it is not aware of any of these bugs being exploited in attacks. Additional information can be found on Cisco’s security advisories page.
Related: Cisco Patches DoS Vulnerabilities in Networking Products
Related: Cisco Patches High-Severity IOS RX Vulnerabilities
Related: Cisco Patches High-Severity Vulnerabilities in VPN Product
