Cisco Fog Director vulnerabilities

3 CVEs affecting Cisco Fog Director, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-44487, published 2023-10-10.

More from Cisco.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2021-44228: Apache Log4j2 Remote Code Execution Vulnerability, published 2021-12-10. Critical severity, CVSS 10.0. Actively exploited: in CISA KEV since 2021-12-10. EPSS: 100% chance of exploitation in the next 30 days. Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker…
• CVE-2023-44487: HTTP/2 Rapid Reset Attack Vulnerability, published 2023-10-10. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2023-10-10. EPSS: 100% chance of exploitation in the next 30 days. The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
• CVE-2016-6405, published 2016-09-18. Medium severity, CVSS 6.5. EPSS: 1.2% chance of exploitation in the next 30 days. Cisco Fog Director 1.0(0) for IOx allows remote authenticated users to bypass intended access restrictions and write to arbitrary files via the Cartridge interface, aka Bug ID CSCuz89368.