Serious vulnerability in Cisco IOS XE puts thousands of devices at risk
by Nico Pätzel
Enhanced EU Cybersecurity Regulation for CRITIS
Cisco, a global leader in networking solutions, has issued an urgent security advisory for switches and routers running the IOS XE operating system. The highly critical zero-day vulnerability (CVE-2023-20198) was announced a few days ago. Through vulnerability in the web interface, attackers can create an admin user without prior login and thus take control of the device. We recommend that network administrators act quickly as the vulnerability is currently being actively exploited by attackers and poses a serious threat to the IT security of companies worldwide.
What exactly has happened?
On 16 October 2023, Cisco disclosed details of a worrying vulnerability in Cisco IOS XE. It is currently still being actively exploited by attackers. If a remote attacker gains access to vulnerable system, they can create user accounts with level 15 access rights without authentication. This allows attackers to take control of the affected device and conduct targeted man-in-the-middle attacks within the network. It involved deploying an implant consisting of a configuration file ("cisco_service.conf"), used to interact with the implant, and determining the new web server endpoint (URI path).
In short: An attacker who gains access to the web user interface of a device with IOS XE and sends HTTP requests to this interface can create an admin user account in no time without prior login!
Apparently, backdoors
have thus already been installed on network devices for several weeks. The subsidiary Talos has already published recommendations on how Cisco customers can check their devices for a possible compromise. This post will be updated continuously.
Who is affected by the vulnerability in Cisco IOS XE?
The impact of this vulnerability is far-reaching and affects all devices that use the Cisco IOS XE operating system and whose web UI is enabled. This includes devices such as switches, routers and WLAN controllers.
What is the risk of the vulnerability in Cisco IOS XE?
The vulnerability was assessed with a maximum CVSS score of 10/10! The lack of an available patch exacerbates the situation considerably. IT security managers are dependent on alternative protective measures. Since patches are missing so far, Cisco itself has published recommendations for those affected.
Thousands of systems are already at risk
Already more than 10,000 Cisco IOS XE devices are affected by this vulnerability. These findings come from a wave of attacks on the affected devices. In Germany alone, about 1,700 devices with Cisco IOS XE are freely accessible via the internet and thus at risk.
Recommendation for action
If you are using IOS XE systems in your company, we strongly recommend that you check your systems for possible compromises and examine the system logs for suspicious activity. Administrators whose network contains Cisco devices running IOS XE should therefore definitely check them and consider them compromised until then.
What to do now:
- Check each device for a possible backdoor with the command curl -X POST. (http://IP/webui/logoutconfirm.html?logon_hash=1; the placeholder IP stands for the IP address of the device). If infected devices are discovered, quarantine them immediately and reinstall a configuration backup.
- Devices that do not have a backdoor should be checked via the SSH admin login for unexplained user accounts with administrator rights (authorisation level 15) or suspicious entries in the log files.
The BSI has published further measures and instructions for checking one's own systems in a PDF.
Related articles
QR codes have been around for almost 30 years. Today, we scan the square codes with our smartphone as a matter of course to release bank orders, create a digital vaccination certificate or retrieve coupons. However, since QR codes are also used by cybercriminals for fraudulent purposes, you should not trust the little squares without limits. You should be especially careful if you receive a QR code via email: A sophisticated phishing attack could be hiding behind it. We show you how to recognize quishing attacks and protect yourself from them.
Read more … Caution, Quishing: Criminals use QR codes for phishing attacks
In early October, the ransomware group Black Basta attacked an IT service provider of the Deutsche Presse-Agentur (dpa), stealing the data records of 1,500 dpa employees as well as pension recipients of the dpa support fund. Two weeks later, the cybercriminals published the first sensitive data of the victims on the darknet. This incident is just one of many attacks associated with the notorious Black Basta ransomware - and there will be many more to come. That's because, as new research shows, the cybercriminals act very similarly to other aggressive hacker groups.
Read more … Black Basta: New findings on the notorious ransomware
The cybersecurity industry is more dynamic and rapidly changing than any other sector. Today's insights may already be outdated tomorrow. Because at the same pace as IT security develops new measures to protect IT infrastructure, networks, and endpoints, cyber criminals bring new tools to the market, refine attack methods, or use unknown techniques to successfully carry out cyber attacks. Anyone who wants to stay as well informed as possible in the multi-layered environment is dependent on regular updates. This applies equally to technically interested users and IT staff. One popular source of information in Germany is the podcast. More than 40% of all Germans regularly listen to podcasts - one fifth of them daily. We asked our IT security consultants for recommendations on ethical hacking and present our top 5 most popular cybersecurity podcasts here.