Norway issues warning after ‘important businesses’ affected by Cisco zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-20198 | Unauthenticated Privilege Escalation in Cisco IOS XE Web UI (Actively Exploited) CVE-2023-20198 is a critical (CVSS 10.0) unauthenticated privilege escalation flaw in the web UI of Cisco IOS XE software, triggered by sending crafted network requests to the exposed web management interface. An attacker with no credentials can use the flaw to gain initial access and issue a privilege 15 command, creating a local user with normal login access; the attacker then chained CVE-2023-20273 (CVSS 7.2) to elevate that account to root and write an implant to the file system. Successful exploitation yields full administrative control of the device, including persistence via the planted implant, on Cisco IOS XE devices with the web UI enabled and reachable from the internet or untrusted networks, including Rockwell Automation Allen-Bradley Stratix 5200 and 5800 switches running IOS XE. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2023-10-16 with a BOD 23-02 directive, EPSS stands at 99.6% (100th percentile), and ongoing campaigns (including the 'BADCANDY' activity flagged by Australia's ASD and Cisco-related telecom intrusions attributed to Salt Typhoon) have been reported. Do: Upgrade affected devices to the fixed releases listed in Cisco's advisory (use Cisco's Software Checker) and, as immediate mitigation, disable the web UI or restrict it to trusted networks/addresses only. Check for compromise by looking for unexpected local user accounts and the implant artifacts Cisco identified (unexpected cisco_tac_alarm.log and cisco_tac.log files in /tmp or /usr/binos/conf), and immediately report positive findings to CISA per BOD 23-02. Keep in mind that patching alone does not remove a root implant, so devices with evidence of compromise should be reimaged or otherwise cleaned per vendor instructions. | 10.0 | 100% | KEV |
| large≈40,000–50,000 internet-exposed IOS XE devices at the time of disclosure (public scan data), within an IOS XE install base in the millions | |
| CVE-2023-20273 | Authenticated Command Injection (Root) in Cisco IOS XE Web UI CVE-2023-20273 is an OS command injection flaw (CWE-78) in the web UI feature of Cisco IOS XE Software, caused by insufficient input validation. An authenticated, remote attacker triggers it by sending crafted input to the web UI, and a successful exploit injects commands that run on the underlying operating system with root privileges, yielding full device compromise (in the October 2023 mass-exploitation campaign it was typically chained with the unauthenticated CVE-2023-20198 to obtain initial access and install a persistent implant). Any Cisco IOS XE device with the web UI enabled and reachable from the internet or an untrusted network is affected; this data does not specify the affected release ranges, which are enumerated in Cisco's advisory. Exploitation is confirmed in the wild: CISA added the flaw to the KEV on 2023-10-23 with BOD 23-02 response actions, EPSS is ~90% (100th percentile), and IOS XE edge devices remain recurring targets of Chinese-nexus espionage campaigns (e.g., Salt Typhoon activity against telecoms). Do: Upgrade affected devices to a fixed IOS XE release per Cisco's advisory; as an interim mitigation, disable the HTTP/HTTPS server (ip http server / ip https server) or restrict Web UI access to trusted hosts only. Per BOD 23-02, hunt for compromise on any exposed device — check for unexpected level-15 local accounts and the implant.lua backdoor in flash memory — and immediately report positive findings to CISA. | 7.2 | 90% | KEV |
| mass≈100,000+ internet-exposed IOS XE devices (public scans observed ~40,000+ compromised within days of disclosure) |
Full article495 words · extracted from therecord.media · click to collapse
The head of Norway’s National Security Authority (NSM) warned on Monday that the exploitation of two recently disclosed Cisco vulnerabilities has resulted in “important businesses” in the country being compromised by hackers. Speaking to Norwegian newspaper Dagens Næringsliv, NSM chief Sofie Nystrøm said her agency was coordinating the national response to the pair of zero-day vulnerabilities affecting Cisco IOS XE. Nystrøm declined to identify the businesses that had been affected beyond describing them as important and saying some provided community services. Her agency did not provide a count of how many organizations in the country had been hacked, nor whether any of them were in the public sector. The situation was “very serious” Nystrøm said, before describing the attack as “more potent” than an incident this summer affecting DSS, Norway’s government support agency, that led to hackers accessing the data of a dozen government ministries. In two recent security advisories, the first published on October 16, the networking technology giant Cisco revealed that attackers were actively exploiting two vulnerabilities (CVE-2023-20198 and CVE-2023-20273), the first of which received the highest possible score under the Common Vulnerability Scoring System of 10/10. Cisco said it had observed attacks exploiting these as early as September 28. The company provided an initial patch on Sunday, October 22, to remediate the issue. The company’s Talos Intelligence team said it had observed a threat actor accessing customers’ systems using CVE-2023-20198 and subsequently deploying an implant. In the days following Cisco’s initial security advisory, several security companies said they found up to 40,000 devices online that appeared to be compromised. After this initial technique to identify the implant circulated, the attackers subsequently updated their malicious code to avoid being detected, and the count of compromised systems that were externally observable dropped. Although the Talos team said that the implant was not able to persist after a device reboot, it warned that the attackers were also creating new local user accounts with administrator privileges. “Organizations should look for unexplained or newly created users on devices as evidence of potentially malicious activity relating to this threat,” the security team warned. NSM has been aware of the vulnerability "for some time," said Deputy Director Gullik Gundersen. "The scope of the damage when the vulnerability is exploited is large since the severity of this vulnerability is rated as critical. An attacker can create a user that achieves complete control over the affected system," Gundersen said. Businesses that use Cisco IOS XE should update their systems immediately, he said. "There have been cases of active exploitation of the vulnerability abroad, and in Norway," Gundersen said. "This is still an ongoing incident, and NSM is working to map affected businesses."
No previous article
No new articles
Alexander Martin
is the UK Editor for Recorded Future News. He was previously a technology reporter for Sky News and a fellow at the European Cyber Conflict Research Initiative, now Virtual Routes. He can be reached securely using Signal on: AlexanderMartin.79
Text extracted automatically; images, tables and formatting may be missing. Original: https://therecord.media/norway-advisory-cisco-zero-days-important-businesses