Cisco Warns For A Second Zero-Day in IOS XE Exploited for Device Infections

Cisco recently issued a warning about not one but two zero-day vulnerabilities within its IOS XE Software, both actively exploited in the wild. This alarming discovery follows Cisco’s initial disclosure of CVE-2023-20198, a critical zero-day vulnerability with a CVSS score of 10, which is actively under attack.

The company came across these vulnerabilities during its response to multiple Technical Assistance Center (TAC) support cases. Threat actors have not wasted any time and have already leveraged CVE-2023-20198 to compromise thousands of Cisco IOS XE devices, according to a warning from cybersecurity firm VulnCheck.

This zero-day flaw grants attackers the power to gain administrator privileges, effectively enabling them to take control of vulnerable routers. Cisco’s advisory explains that exploitation of this vulnerability allows remote, unauthenticated attackers to create an account on an affected system with privilege level 15 access. Once this account is created, it can be used to assume control of the compromised system.

The vulnerability impacts both physical and virtual devices that are running the Web User Interface (Web UI) feature, especially when the HTTP or HTTPS Server feature is in use.

Cisco recommends that administrators examine system logs for specific log messages containing usernames like “cisco_tac_admin,” “cisco_support,” or any other locally configured users that are unfamiliar to the network. As a precaution, administrators are urged to disable the HTTP server feature on systems exposed to the internet.

Security researchers have been actively tracking the aftermath of these attacks. LeakIX utilized indicators of compromise (IoCs) from Cisco Talos and identified approximately 30,000 Cisco IOS XE devices (routers, switches, VPNs) that had fallen victim to the exploitation of CVE-2023-20198. Most of these compromised devices were located in the United States, the Philippines, Chile, and Mexico. CERT Orange Cyberdefense reported similar findings, with over 34,500 compromised devices using the same IoCs.

In a startling twist, Cisco’s investigation into these attacks revealed an attempt to hide infections even on systems patched against CVE-2023-20198. This raised suspicions of a second zero-day vulnerability in action. The attackers initially exploited CVE-2023-20198 to gain entry, creating a local user and password combination, which was then used for subsequent logins. This initial access was further exploited using another component of the web UI feature, allowing the attacker to elevate privileges to root and implant malware on the system. This second zero-day was designated CVE-2023-20273.

The severity scores for these vulnerabilities are as follows: CVE-2023-20198 scored a perfect 10.0, while CVE-2023-20273 received a score of 7.2.

The IT giant has now addressed both zero-day vulnerabilities and also provided mitigations for them.

Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: [email protected]

Source: securityaffairs.com

Source Link