cisco-sa-fxo-pattern-bypass-jUXgygYv: Cisco IOS and IOS XE Software FXO Interface Destination Pattern Bypass Vulnerability
First published: Wed Sep 22 2021(Updated: )
A vulnerability in the Voice Telephony Service Provider (VTSP) service of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass configured destination patterns and dial arbitrary numbers. This vulnerability is due to insufficient validation of dial strings at Foreign Exchange Office (FXO) interfaces. An attacker could exploit this vulnerability by sending a malformed dial string to an affected device via either the ISDN protocol or SIP. A successful exploit could allow the attacker to conduct toll fraud, resulting in unexpected financial impact to affected customers. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fxo-pattern-bypass-jUXgygYv This advisory is part of the September 2021 release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: September 2021 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication.
Credit: Austin Martinetti.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco IOS | ||
| Cisco IOS XE |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of cisco-sa-fxo-pattern-bypass-jUXgygYv?
The severity of cisco-sa-fxo-pattern-bypass-jUXgygYv is critical due to the potential for an unauthenticated remote attacker to manipulate dial patterns.
How do I fix cisco-sa-fxo-pattern-bypass-jUXgygYv?
To fix cisco-sa-fxo-pattern-bypass-jUXgygYv, update your Cisco IOS Software or Cisco IOS XE Software to the recommended patched version as specified in the Cisco security advisory.
What systems are affected by cisco-sa-fxo-pattern-bypass-jUXgygYv?
Cisco IOS Software and Cisco IOS XE Software are the affected systems related to cisco-sa-fxo-pattern-bypass-jUXgygYv.
Is authentication required to exploit cisco-sa-fxo-pattern-bypass-jUXgygYv?
Authentication is not required to exploit the vulnerability identified as cisco-sa-fxo-pattern-bypass-jUXgygYv, making it particularly dangerous.
What could an attacker achieve by exploiting cisco-sa-fxo-pattern-bypass-jUXgygYv?
An attacker exploiting cisco-sa-fxo-pattern-bypass-jUXgygYv could bypass configured destination patterns and dial arbitrary phone numbers.
- agent/event
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/cisco-advisory
- source/Cisco
- agent/severity
- agent/references
- agent/weakness
- agent/title
- agent/author
- agent/description
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco ios
- canonical/cisco ios xe