Cisco has released security alerts to address several vulnerabilities in the following products:

• Cisco Identity Services Engine (ISE)
• Cisco Managed Services Accelerator (MSX)

Cable Devices

• Cisco Continuous Deployment and Automation Framework
• Cisco Prime Cable Provisioning
• Cisco Ultra Cloud Core - Network Repository Function

Collaboration and Social Media

• Cisco SocialMiner
• Cisco Webex App, formerly Cisco Webex Teams

Endpoint Clients and Client Software

• Cisco CX Cloud Agent Software

Network Application, Service, and Acceleration

• Cisco Extensible Network Controller (XNC)
• Cisco Nexus Dashboard Data Broker, formerly Cisco Nexus Data Broker
• Cisco Nexus Insights
• Cisco Wide Area Application Services (WAAS)

Network and Content Security Devices

• Cisco Adaptive Security Appliance (ASA)
• Cisco Firepower Device Manager (FDM)
• Cisco Firepower Management Center (FMC)
• Cisco Firepower System Software
• Cisco Secure Network Analytics, formerly Cisco Stealthwatch Enterprise
• Cisco Security Manager

Network Management and Provisioning

• Cisco Application Policy Infrastructure Controller (APIC)
• Cisco Automated Subsea Tuning
• Cisco CloudCenter Action Orchestrator
• Cisco CloudCenter Suite Admin
• Cisco CloudCenter Workload Manager
• Cisco Collaboration Audit and Assessments
• Cisco Common Services Platform Collector (CSPC)
• Cisco Connected Pharma
• Cisco Crosswork Change Automation
• Cisco Crosswork Data Gateway
• Cisco Crosswork Network Automation
• Cisco Crosswork Network Controller
• Cisco Crosswork Optimization Engine
• Cisco Crosswork Situation Manager
• Cisco Crosswork Zero Touch Provisioning (ZTP)
• Cisco DNA Assurance
• Cisco Data Center Network Manager (DCNM)
• Cisco Edge Intelligence
• Cisco Elastic Services Controller (ESC)
• Cisco Evolved Programmable Network Manager
• Cisco Intelligent Node (iNode) Manager
• Cisco IoT Field Network Director, formerly Cisco Connected Grid Network Management System
• Cisco Nexus Dashboard, formerly Cisco Application Services Engine
• Cisco Optical Network Planner
• Cisco Policy Suite
• Cisco Prime Network Change and Configuration Management
• Cisco Prime Performance Manager
• Cisco Smart PHY
• Cisco Smart Software Manager
• Cisco Virtual Topology System - Virtual Topology Controller (VTC) VM
• Cisco WAN Automation Engine (WAE)

Routing and Switching - Enterprise and Service Provider

• Cisco ASR 5000 Series Routers
• Cisco Application Policy Infrastructure Controller Enterprise Module (APIC-EM)
• Cisco DNA Center
• Cisco Enterprise NFV Infrastructure Software (NFVIS)
• Cisco GGSN Gateway GPRS Support Node
• Cisco IOx Fog Director
• Cisco IP Services Gateway (IPSG)
• Cisco MME Mobility Management Entity
• Cisco Mobility Unified Reporting and Analytics System
• Cisco Network Assurance Engine
• Cisco Network Convergence System 2000 Series
• Cisco ONS 15454 Series Multiservice Provisioning Platforms
• Cisco Optical Network Controller
• Cisco PDSN/HA Packet Data Serving Node and Home Agent
• Cisco PGW Packet Data Network Gateway
• Cisco SD-WAN vManage
• Cisco System Architecture Evolution Gateway (SAEGW)
• Cisco Ultra Cloud Core - Access and Mobility Management Function
• Cisco Ultra Cloud Core - Policy Control Function
• Cisco Ultra Cloud Core - Session Management Function
• Cisco Ultra Cloud Core - Subscriber Microservices Infrastructure
• Cisco Ultra Packet Core
• Cisco Ultra Services Platform

Routing and Switching - Small Business

• Cisco Business Dashboard

Unified Computing

• Cisco HyperFlex HX Data Platform

Voice and Unified Communications Devices

• Cisco BroadCloud for Carriers
• Cisco BroadWorks
• Cisco Cloud Connect
• Cisco Emergency Responder
• Cisco Unified Attendant Console Advanced
• Cisco Unified Attendant Console Business Edition
• Cisco Unified Attendant Console Department Edition
• Cisco Unified Attendant Console Enterprise Edition
• Cisco Unified Attendant Console Premium Edition
• Cisco Unified Communications Manager/Cisco Unified Communications Manager Session Management Edition
• Cisco Unified Communications Manager IM & Presence Service
• Cisco Unified Contact Center Express
• Cisco Unified Customer Voice Portal
• Cisco Unified Intelligence Center
• Cisco Unity Connection
• Cisco Virtualized Voice Browser
• Cisco Webex Board, formerly Cisco Spark Board

Video, Streaming, TelePresence, and Transcoding Devices

• Cisco Meeting Server
• Cisco Video Surveillance Operations Manager
• Cisco Vision Dynamic Signage Director

Cisco Cloud Hosted Services

• Cisco Cloud Application Policy Infrastructure Controller (Cloud APIC)
• Cisco Cloud Email Security
• Cisco Cognitive Intelligence
• Cisco DNA Center Cloud
• Cisco Intersight
• Cisco IoT Control Center
• Cisco Kinetic for Cities
• Cisco Managed Services Accelerator (MSX)
• Cisco Registered Envelope Service
• Cisco Smart Collector - Lifecycle Management
• Cisco Umbrella
• Cisco Unified Communications Manager Cloud
• Cisco Webex Centers - Meeting Center, Training Center, Event Center, Support Center
• Cisco Webex Events
• Cisco Webex Meeting Server - Multimedia Platform

Attackers could exploit these vulnerabilities by executing arbitrary code.

The CERT team encourages users to review Cisco security advisory and apply the necessary mitigations:

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-scf-rce-DQrHhJxH