By 
This week, Cisco issued fixes to address numerous susceptibilities in its Small Business 220 Series Smart Switches, including two bugs regarded as critically severe.
The most significant of these problems could let an unauthenticated, remote attacker perform random code with root privileges on the fundamental operating system.
The flaw, tracked as CVE-2019-1913 and featuring a CVSS score of 9.8, comprises several flaws in the web management interface of the smart switches.
“The vulnerabilities are due to insufficient validation of user-supplied input and improper boundary checks when reading data into an internal buffer. An attacker could exploit these vulnerabilities by sending malicious requests to the web management interface of an affected device,” Cisco explains.
Relying on the configuration of the susceptible switch, the requests must be sent via HTTP or HTTPS.
Tracked as CVE-2019-1912 and featuring a CVSS score of 9.1, the second Critical vulnerability in the Small Business 220 Series Smart Switches could let an unverified, remote attacker to upload random files.
The issue is owing to incomplete authorization checks in the web management interface. An attacker seeking to exploit the bug needs to send a malicious request to certain parts of the interface. The attacker could then adjust the outline of the affected device or inject a reverse shell.
Cisco also addressed a Medium risk susceptibility in the Small Business 220 Series Smart Switches. Tracked as CVE-2019-1914 and featuring a CVSS score of 7.2, the security fault could allow an authenticated, remote attacker to achieve a command injection.
The issue is caused by the unsuitable authentication of user-supplied input. An attacker with a valid login session as a privilege level 15 user could exploit the bug by sending a malicious request to certain parts of the web management interface.
Moreover, the company issued a security patch for a cross-site scripting (XSS) vulnerability discovered in the web-based management interface of Identity Services Engine (ISE). The issue was found to affect Cisco ISE running software releases prior to 2.4.0 Patch 9.
Tracked as CVE-2019-1941 and featuring a CVSS score of 6.1, the susceptibility could be exploited by an unauthenticated, remote attacker who can convince a user to click a malicious link. If successful, the attacker could perform a random script code in the context of the impacted interface or access sensitive, browser-based information.
