Remote Code Execution in Cisco Expressway Series

Executive Summary

This is a critical remote code execution vulnerability in Cisco Expressway Series devices, including Expressway-Core and Expressway-Edge. It exists in the database service feature due to persistent cookies and insufficient client certificate validation when TLS Verify Mode is enabled for clustering. An unauthenticated remote attacker with network access could exploit this to execute arbitrary OS commands as root.

Useful 0 Not Useful 0

Detection Guidance

Monitor network traffic for unauthorized connections to Cisco Expressway Series devices, particularly to the database service. Check for unusual RPC command invocations or root-level command execution attempts. Review logs for persistent cookies being used without proper validation.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain full control over affected Cisco Expressway devices, leading to unauthorized access, data breaches, or disruption of services. Since the vulnerability allows root-level command execution, it poses significant risks to system integrity and confidentiality.

Useful 0 Not Useful 0

Mitigation Strategies

• Upgrade affected Cisco Expressway Series devices to fixed software releases like X15.5.20 or later.
• Disable the database service feature if not required.
• Ensure TLS Verify Mode is properly configured to validate client certificates.
• Restrict network access to Cisco Expressway devices to trusted sources only.

Useful 0 Not Useful 0