Credit: Thinkstock Cisco Systems has released patches for eight of its products after the Melbourne-based Internet security company Assurance Pty’s Assurance.com.au discovered vulnerabilities in some of the vendor’s wireless products. The vulnerabilities were discovered after studying the Cisco Wireless LAN Solution Engine. The security team found vulnerabilities within the Cisco Hosting Solution Engine, the Ethernet Subscriber Solution Engine, CiscoWorks2000 Service Management Solution, the Cisco VLAN Policy Server and the ME1100 Series of the Cisco Management Engine. Cisco announced fixes for the vulnerabilities on Thursday, April 20. Assurance.com.au has been assisting Cisco since Jan. 31 to resolve the issue. Assurance.com.au director Adam Pointon discovered the vulnerability while on a customer site and said a breach will ultimately allow unauthorized software to be installed by a “rogue administrator,” which will be virtually undetectable. “The vulnerability is extremely easy to exploit, and it’s possible for a rogue administrator to access the underlying operating system by typing one specially crafted command into Cisco’s restricted, text-based management interface,” Pointon said. “These embedded appliances are actually Linux-based systems. By exploiting the vulnerability, it’s possible for a rogue administrator to install unauthorized software on these devices that would be virtually undetectable to future administrators, and that’s a problem.” Neal Wise, a director of Assurance.com.au, said if the devices in question are not correctly maintained, they could become a serious liability to the enterprise; however, he said Cisco was very responsive in releasing patches, despite the perceived three-month turnaround. “Cisco had to go through the whole Q&A process, which was a lot to ask because the vulnerability affected a number of different products, but Cisco was very responsive,” Wise said. “The main thing was to have patches available on the Cisco site prior to us jointly announcing the vulnerability.” A spokesperson for Cisco Australia said Cisco is not aware of any active exploitation of these vulnerabilities; however, it is aware of the vulnerabilities impacting the Cisco Wireless LAN Solution Engine products. The spokesperson said customers should refer to the appropriate Cisco security advisory for additional details, including instructions on obtaining software fixes.-Michael Crawford, Computerworld Today (Australia)For related news coverage, read Cisco Sets Up R&D Lab at Hanoi University.Check out our CIO News Alerts and Tech Informer pages for more updated news coverage. Related content brandpost Sponsored by Freshworks When your AI chatbots mess up AI ‘hallucinations’ present significant business risks, but new types of guardrails can keep them from doing serious damage By Paul Gillin Dec 08, 2023 4 mins Generative AI brandpost Sponsored by Dell New research: How IT leaders drive business benefits by accelerating device refresh strategies Security leaders have particular concerns that older devices are more vulnerable to increasingly sophisticated cyber attacks. By Laura McEwan Dec 08, 2023 3 mins Infrastructure Management case study Toyota transforms IT service desk with gen AI To help promote insourcing and quality control, Toyota Motor North America is leveraging generative AI for HR and IT service desk requests. By Thor Olavsrud Dec 08, 2023 7 mins Employee Experience Generative AI ICT Partners feature CSM certification: Costs, requirements, and all you need to know The Certified ScrumMaster (CSM) certification sets the standard for establishing Scrum theory, developing practical applications and rules, and leading teams and stakeholders through the development process. By Moira Alexander Dec 08, 2023 8 mins Certifications IT Skills Project Management Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe