Cisco upgraded three remote code execution (RCE) vulnerabilities impacting the web management interfaces to critical severity with a CVSS base score of 9.8 after initially rating them as high with a base score of 8.8 when the advisories were first published on May 15. Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager are network management tools used by administrators "for provisioning, monitoring, optimizing, and troubleshooting both wired and wireless devices." According to Cisco's security advisory published on May 15 and updated on May 16, the critical vulnerabilities exist "because the software improperly validates user-supplied input" and they can be remotely exploited by potential attackers to gain the ability to execute arbitrary code with "root-level privileges on the underlying operating system." The most dangerous is the issue tracked as CVE-2019-1821 which could be "exploited by an unauthenticated attacker that has network access to the affected administrative interface." The other two flaws tracked as CVE-2019-1822 and CVE-2019-1823 are less concerning given that they would "require that an attacker have valid credentials to authenticate to the impacted administrative interface." The three vulnerabilities affect the following software versions: Cisco PI Software Releases prior to 3.4.1, 3.5, and 3.6, and EPN Manager Releases prior to 3.0.1. While there are no workarounds that address these vulnerabilities, Cisco has published free software updates which can be used to patch the software flaws. The web-based management interface software is also affected by two other Improper Input Validation flaws rated as high severity and tracked as CVE-2019-1824 and CVE-2019-1825 which "could allow an authenticated, remote attacker to execute arbitrary SQL queries." More complete details are posted on OUR FORUM.

Academics have discovered a new class of vulnerabilities in Intel processors that can allow attackers to retrieve data being processed inside a CPU. The leading attack in this new vulnerability class is a security flaw named Zombieload, which is another side-channel attack in the same category as Meltdown, Spectre, and Foreshadow just like the first three, Zombieload is exploited by taking advantage of the speculative execution process, which is an optimization technique that Intel added to its CPUs to improve data processing speeds and performance. For more than a year, academics have been poking holes in various components of the speculative execution process, revealing ways to leak data from various CPU buffer zones and data processing operations. Meltdown, Spectre, and Foreshadow have shown how various CPU components leak data during the speculative execution process. Today, an international team of academics -- including some of the people involved in the original Meltdown and Spectre research -- along with security researchers from Bitdefender have disclosed a new attack impacting the speculative execution process. This one is what researchers have named a Microarchitectural Data Sampling (MDS) attack, and targets a CPU's microarchitectural data structures, such as the load, store, and line fill buffers, which the CPU uses for fast reads/writes of data being processed inside the CPU. These are smaller-sized caches that are used alongside the main CPU cache. By exploiting normal speculative execution operations that work within these microarchitectural structures, an MDS attack can infer data that is being processed in the CPU by other apps, to which an attacker shouldn't normally have access to. Complete details are posted on OUR FORUM.