Cisco has launched safety updates to comprise three vulnerabilities affecting its merchandise, together with one high-severity flaw in its Electronic mail Safety Equipment (ESA) that might end in a denial-of-service (DoS) situation on an affected machine.

The weak spot, assigned the identifier CVE-2022-20653 (CVSS rating: 7.5), stems from a case of inadequate error dealing with in DNS identify decision that might be abused by an unauthenticated, distant attacker to ship a specifically crafted e mail message and trigger a DoS.

“A profitable exploit may permit the attacker to trigger the machine to develop into unreachable from administration interfaces or to course of extra e mail messages for a time frame till the machine recovers, leading to a DoS situation,” the corporate stated in an advisory. “Continued assaults may trigger the machine to develop into utterly unavailable, leading to a persistent DoS situation.”

The flaw impacts Cisco ESA gadgets operating Cisco AsyncOS Software program operating variations 14.0, 13.5, 13.0, 12.5 and earlier and have the “DANE characteristic enabled and with the downstream mail servers configured to ship bounce messages.” DANE is brief for DNS-based Authentication of Named Entities, which is used for outbound mail validation.

Cisco credited researchers from ICT service supplier Rijksoverheid Dienst ICT Uitvoering (DICTU) for reporting the vulnerability, whereas stating that it isn’t discovered any proof of malicious exploitation.

Individually, the networking tools maker additionally addressed two different flaws in its Prime Infrastructure and Advanced Programmable Community Supervisor and Redundancy Configuration Supervisor that might allow an adversary to execute arbitrary code and trigger a DoS situation –

• CVE-2022-20659 (CVSS rating: 6.1) – Cisco Prime Infrastructure and Advanced Programmable Community Supervisor cross-site scripting (XSS) vulnerability
• CVE-2022-20750 (CVSS rating: 5.3) – Cisco Redundancy Configuration Supervisor for Cisco StarOS Software program TCP denial-of-service (DoS) vulnerability

The fixes additionally come weeks after Cisco printed patches for a number of essential safety vulnerabilities impacting its RV Collection routers, a few of which earned the very best doable CVSS severity rating rankings of 10, that might be weaponized to raise privileges and execute arbitrary code on affected methods.