Cisco Expressway: check the cluster before the score

Cisco says a remote attacker who can reach the device’s database service and possesses persistent cookies could invoke database-service calls that run operating-system commands as root. The advisory also describes insufficient client-certificate validation when TLS Verify Mode is enabled for clustering. It affects vulnerable virtual or appliance Expressway-C and Expressway-E deployments configured as a cluster.

Cisco rates the flaw 9.8 and lists no workaround. X15.5.20 is the first fixed release for the X15.5.3-and-earlier line; X14 and older installations must migrate to a fixed release. The vendor says it is not aware of malicious use or public exploitation at publication.

1. 1

   Identify every member. Inventory Expressway-C and Expressway-E devices, including virtual appliances, cluster membership, software release and the networks allowed to reach the database service.

2. 2

   Upgrade through the vendor path. Plan the fixed release across the cluster, confirm compatibility and maintenance order, and verify the resulting build on each member.

3. 3

   Check for unexpected access. Review available device, network and administrative records for unusual database-service connections or command execution. Cisco has not reported exploitation; this is precautionary validation, not a claim of compromise.

Communication infrastructure often has a clear service owner but a less clear appliance inventory. If one cluster member is missed, the service is not fully remediated. Record the before-and-after versions, any unreachable or unsupported nodes, and who will resolve those exceptions.