轉發 台灣電腦網路危機處理暨協調中心 資安訊息警訊 TWCERTCC-200-202610-00000025

[內容說明]
Cisco License (Smart Software Manager) On-Prem開發團隊於內部安全審查期間發現多項安全漏洞，並已完成修補。目前尚未發現有證據顯示這些漏洞遭到積極利用。為協助客戶及時部署安全更新並簡化漏洞揭露流程，Cisco已公開相關漏洞資訊及修補建議。 CVE-2026-76480，CVSS：9.8，關鍵功能缺少身分驗證。
CVE-2026-76482，CVSS：10.0，對加密簽章驗證不當。
CVE-2026-76483，CVSS：9.1，憑證保護不足。
CVE-2026-76484，CVSS：8.8，程式碼注入攻擊。

[影響平台]
Cisco License On-Prem 9-202601(含)之前版本、 Cisco License On-Prem 10-202608(含)之前版本

[建議措施]
請更新至Cisco License On-Prem 10-202609 (含)之後版本

[參考資料]
1. https://www.twcert.org.tw/tw/cp-169-11289-a6495-1.html

Forwarded from Taiwan Computer Emergency Response Team/Coordination Center Security Advisory TWCERTCC-200-202610-00000025

[Description]
The Cisco License (Smart Software Manager) On-Prem development team discovered multiple security vulnerabilities during an internal security review and has completed remediation. Currently, no evidence has been found indicating that these vulnerabilities have been actively exploited. To help customers deploy security updates in a timely manner and simplify the vulnerability disclosure process, Cisco has publicly disclosed the relevant vulnerability information and remediation recommendations. CVE-2026-76480, CVSS: 9.8, is a missing authentication vulnerability in a critical function.
CVE-2026-76482, CVSS: 10.0, involves improper cryptographic signature verification.
CVE-2026-76483, CVSS: 9.1, involves insufficient certificate protection.
CVE-2026-76484, CVSS: 8.8, is a code injection vulnerability.

[Affected Platforms]
Cisco License On-Prem versions 9-202601 and earlier, Cisco License On-Prem versions 10-202608 and earlier

[Recommendations]
Please update to Cisco License On-Prem 10-202609 or later versions

[References]
1. https://www.twcert.org.tw/tw/cp-169-11289-a6495-1.html