【資安漏洞預警】Cisco旗下Cisco Crosswork 存在4個重大資安漏洞

【行政公告】

公告單位	圖資處網路系統組
訊息類別	行政公告行政公告	公告對象	全體
公告主題	【資安漏洞預警】Cisco旗下Cisco Crosswork 存在4個重大資安漏洞【Security Vulnerability Alert】Cisco Crosswork has 4 critical security vulnerabilities
公告內容	轉發台灣電腦網路危機處理暨協調中心資安訊息警訊 TWCERTCC-200-202608-00000016 [內容說明] Cisco Crosswork開發團隊於內部安全審查期間發現多項安全漏洞，並已完成修補。目前尚未發現有證據顯示這些漏洞遭到積極利用。為協助客戶及時部署安全更新並簡化漏洞揭露流程，Cisco已公開相關漏洞資訊及修補建議。 CVE-2026-20030(CVSS：10.0)為SQL指令所使用的特殊元素未適當處理漏洞；CVE-2026-20357(CVSS：10.0)為關鍵功能缺少身分驗證漏洞；CVE-2026-20358(CVSS：10.0)為外部控制檔案名稱或路徑漏洞；CVE-2026-20359(CVSS：9.8)為憑證保護不足漏洞。 [影響平台] Cisco Crosswork 7.2.1(含)以前版本 [建議措施] 請更新至 Cisco Crosswork 7.2.1-SP(含)之後版本 [參考資料] 1. https://www.twcert.org.tw/tw/cp-169-11114-d0482-1.html Forwarded Taiwan Computer Network Emergency Response Team/Coordination Center Information Security Alert TWCERTCC-200-202608-00000016 [Content Description] The Cisco Crosswork development team discovered multiple security vulnerabilities during an internal security review and has completed remediation. Currently, there is no evidence that these vulnerabilities have been actively exploited. To help customers deploy security updates in a timely manner and simplify the vulnerability disclosure process, Cisco has publicly disclosed the relevant vulnerability information and remediation recommendations. CVE-2026-20030(CVSS: 10.0) is an Improper Neutralization of Special Elements Used in an SQL Command vulnerability; CVE-2026-20357(CVSS: 10.0) is a Missing Authentication for Critical Function vulnerability; CVE-2026-20358(CVSS: 10.0) is an External Control of File Name or Path vulnerability; CVE-2026-20359(CVSS: 9.8) is an Insufficiently Protected Credentials vulnerability. [Impacted Platform] Cisco Crosswork version 7.2.1(inclusive) and earlier [Recommended Actions] Please update to Cisco Crosswork version 7.2.1-SP(inclusive) or later [Reference] 1. https://www.twcert.org.tw/tw/cp-169-11114-d0482-1.html
相關訊息	參考資料
公告時間	2026/8/26 至 2027/2/26	點閱次數	269