Cisco under attack, again.

[L&LD]

“Cisco buried the lede.” >10,000 network devices backdoored through unpatched 0-day

An unknown threat actor is exploiting the vulnerability to create admin accounts.

arstechnica.com

@coxhaus, hope you're not affected by this one.

 

[coxhaus]

From what I can tell it is not related to Cisco small business networking gear. It relates to a web interface on the front end of the network. I think turning off the web interface on the internet device is a work around.

I don't believe Cisco has any currently supported small business routers so it is a non issue for me.

 

[coxhaus]

I just saw this. It looks like it is already patched.

Cisco releases urgent patch for flaw that could let hackers access Emergency Response Systems

Cisco's ERS was carrying a rather worrying security flaw

www.techradar.com

 

[sfx2000]

From what I can tell it is not related to Cisco small business networking gear. It relates to a web interface on the front end of the network. I think turning off the web interface on the internet device is a work around.

I don't believe Cisco has any currently supported small business routers so it is a non issue for me.

It's devices that run IOS XE - and it's the WebUI...

There's a privilege escalation bug that allows the attacker to create a new local user account - the exploit drops in a web implant, but that implant is not persistent, so a reboot can clear it - the local user account still exists however.

Depends on the environment - most gear of this type has the management interface segregated out on a management VLAN, so someone on the production LAN/VLAN wouldn't have access to the WebUI in any case.

But... some folks are not quite as aware, so the WebUI may be accessed on the regular network.

Unfortunately, there are some IOS XE platforms that are internet accessible, and this is why the Severity Level is what it is...

 

[coxhaus]

I saw this.

Number of hacked Cisco IOS XE devices plummets from 50K to hundreds

The number of Cisco IOS XE devices hacked with a malicious backdoor implant has mysteriously plummeted from over 50,000 impacted devices to only a few hundred, with researchers unsure what is causing the sharp decline.

www.bleepingcomputer.com