Cisco VPN Routers: 19,000 Devices Left Exposed to Remote Command Execution Exploit Chain
Reading Time: 3 Minutes
Over 19,000 end-of-life Cisco VPN routers are exposed to attacks targeting a remote command execution exploit chain.
The exploit is able to chain two security flaws that were disclosed recently, allowing threat actors to bypass authentication and execute arbitrary commands on the underlying operating system of Cisco Small Business RV016, RV042, RV042G, and RV082 routers.
The vulnerability is considered to be critical, and Cisco’s Product Security Incident Response Team is aware of proof-of-concept exploit code that is available in the wild.
See Also: So you want to be a hacker?
Offensive Security, Bug Bounty Courses
No patches from Cisco
Despite this, Cisco has stated that it will not release software updates that address this vulnerability. Currently, Cisco has not found any evidence to suggest that the exploit is being used in any attacks.
However, users can still secure their devices by disabling the web-based management interface and blocking access to ports 443 and 60443. This will prevent exploitation attempts from being successful.
Trending: A primer on OS Command Injection Attacks
Trending: Recon Tool: Shotlooter
Cisco has done it again
This is not the first time Cisco has left a critical vulnerability unpatched, as it also did not fix a critical auth bypass flaw affecting multiple EoL routers in September, instead advising users to switch to RV132W, RV160, or RV160W routers that are still under support.
Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?
If you want to express your idea in an article contact us here for a quote: [email protected]
Source: bleepingcomputer.com
Recent News
New Ghost Tap Attack: The Next-Level Credit Card Scam Exploiting Apple Pay and Google Pay
Apple Rushes to Patch Two Zero-Day Exploits Targeting Intel-Based Macs
Chinese Hackers Exploit Zero-Day in FortiClient VPN with ‘DeepData’ Toolkit
Critical Flaw in Popular WordPress Plugin Puts Millions of Websites at Risk
Offensive Security & Ethical Hacking Course
Begin the learning curve of hacking now!
Information Security Solutions
Find out how Pentesting Services can help you.
