Cisco has issued three security advisories rated \u201ccritical\u201d for some of its high-end software systems\u2014two aimed at its Application Services Engine (ASE) implementation and one at the NX-OS operating system.\nThe most concerning warning came for Cisco Application Centric Infrastructure (ACI) Multi-Site Orchestrator (MSO) installed with the ASE which was rated a worse-case scenario, 10 out of a possible 10 on the Common Vulnerability Scoring System (CVSS).\u00a0 The ACI Multi-Site Orchestrator lets customers control application-access policies across Cisco Application Policy Infrastructure Controller-based fabrics.\nAccording to the advisory, a vulnerability in an API endpoint of Cisco\u00a0ACI MSO installed on the ASE could let an unauthenticated, remote attacker bypass authentication on an affected device. A successful exploit could let the attacker receive a token with administrator-level privileges that could be used to authenticate to the API on affected MSO and managed Cisco\u00a0Application Policy Infrastructure Controller (APIC) devices.\nThe vulnerability is due to improper token validation on a specific API endpoint and affects Cisco ACI MSO running a 3.0 release of software only when deployed on a Cisco ASE, Cisco stated.\nThe second critical warning is about the ASE itself, where Cisco says there are multiple weaknesses \u2013 that overall rate a 9.8 out of 10 on the CVSS scale, including:\n\nA weakness that would let an attacker have privileged access to run containers or invoke host-level operations. The vulnerability is due to insufficient access controls for a service running in the Data Network. An attacker could exploit this vulnerability by sending crafted TCP requests to a specific service, Cisco stated.\nA vulnerability that could allow an unauthenticated, remote attacker access to a specific API on an affected device. A successful exploit could allow the attacker to learn device-specific information, create tech support files in an isolated volume, and make limited configuration changes. The vulnerability is due to insufficient access controls for an API running in the Data Network. An attacker could exploit this vulnerability by sending crafted HTTP requests to the affected API. A successful exploit could allow the attacker to learn device-specific information, create tech support files in an isolated volume, and make limited configuration changes, Cisco stated.\n\nThe final critical warning, rated 9.8 out of 10, is in the NS-OX operating system for Cisco\u2019s Nexus switches. Cisco says an exposure in the implementation of an internal file management service for Cisco\u00a0Nexus 3000 Series Switches and Cisco\u00a0Nexus 9000 Series Switches in standalone NX-OS mode that are running Cisco\u00a0NX-OS could let an unauthenticated, remote attacker create, delete, or overwrite arbitrary files with root privileges on the device.\u00a0\u00a0\n\u201cThis vulnerability exists because TCP port 9075 is incorrectly configured to listen and respond to external connection requests,\u201d Cisco stated.\u00a0 \u00a0\n\u201cAn attacker could exploit this vulnerability by sending crafted TCP packets to an IP address that is configured on a local interface on TCP port 9075. A successful exploit could allow the attacker to create, delete, or overwrite arbitrary files, including sensitive files that are related to the device configuration,\u201d Cisco stated. \u201cFor example, the attacker could add a user account without the device administrator knowing,\u201d the vendor stated.\nCisco\u00a0has released free software updates that address the critical vulnerabilities and advises customers to go here for more information.\nThere were number of other less serious advisories issued around the NS-OX and Nexus switch portfolio as well.\u00a0 They included one that described a \u00a0vulnerability in the NX-API feature of Cisco\u00a0NX-OS Software could let an unauthenticated, remote attacker conduct a cross-site request forgery (CSRF) attack on an affected system. A successful exploit could let the attacker perform arbitrary actions with the privilege level of the affected user. The attacker could view and modify the device configuration, Cisco stated.\nAnother warning described a vulnerability in the fabric infrastructure VLAN connection establishment of Cisco\u00a0Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) Mode could allow an unauthenticated, adjacent attacker to bypass security validations and connect an unauthorized server to the infrastructure VLAN. With a connection to the infrastructure VLAN, the attacker can make unauthorized connections to Cisco\u00a0APIC services or join other host endpoints, Cisco stated.\nCisco\u00a0said it has released free software updates to address these issues.