In recent days, Cisco published several security bulletins that indicate that multiple vulnerabilities have been detected in the API and management interface on Cisco Expressway and Cisco TelePresence Video Communication Server (VCS) equipment. These weaknesses allow remote attackers to have read and write permissions on application files and execute remote code on the system with root privileges, this is why Cisco is asking customers to update the operating systems of these elements promptly. In addition, a vulnerability was discovered in the Cisco Identity Service Engine (Cisco ISE) that will allow a denial of authentication service on the RADIUS system.

With a critical severity, two different issues had been detected by Cisco’s internal research team (Advanced Security Initiatives Group (ASIG)) on Cisco Expressway and Cisco VCS elements. These vulnerabilities classified with the following CVE (CVE-2022-20754 and CVE-2022-20755) are independent and do not require one to be used for the other to work. In the first case, the weakness was found in the API of these two tools and might allow the cybercriminal to perform a cross-directory attack by reaching unauthorized system spaces where he could read and write system files, all this with root permissions. For the second case, the weakness is located on the web administration system of the indicated systems and might allow an authenticated remote attacker to execute any command with root permissions.