Networking
giant Cisco has published an advisory bundle for admins with Cisco switches and
firewalls under their command, as some of the equipment supplied by the company
is in dire need of patching.

The Cisco FXOS and NX-OS software security advisory collection contains 25 knowledgebase articles that describe 26 vulnerabilities in FXOS and NX-OS software.

The
flaws in Cisco NX-OS Software affect the company’s series of Nexus switches,
line cards and fabric modules. The vulnerabilities in Cisco FXOS Software apply
to Firepower firewalls and appliances, MDS switches and UCS fabric
interconnects, besides the same switches.

While
not labeled critical, all 26 of the vulnerabilities have a high security impact
rating.

“Successful
exploitation of the vulnerabilities could allow an attacker to gain
unauthorized access, gain elevated privileges, execute arbitrary commands,
escape the restricted shell, bypass the system image verification checks, or
cause a denial of service (DoS) condition on an affected device,” according to
Switchzilla.

A separate document tells users of Nexus switches to disable the PowerOn Auto Provisioning (POAP) feature, which is on by default. This potentially-exploitable feature helps automate the initial deployment and configuration of Nexus switches.

Of
the 26 flaws, three are found in both Cisco FXOS Software and Cisco NX-OS
Software. The bundled publication includes a comprehensive table that identifies
each vulnerability alongside the affected equipment. Patches are available for
all 26 flaws. Administrators with affected Cisco equipment would be wise to
install the latest updates sooner rather than later.