CISCO addresses two critical remote code execution flaws in IOS XE operating system

A vulnerability in Cisco IOS XE Software could allow an unauthenticated, remote attacker to log in to a device running an affected release of Cisco IOS XE Software with the default username and password that are used at initial boot, aka a Static Credential Vulnerability. The vulnerability is due to an undocumented user account with privilege level 15 that has a default username and password. An attacker could exploit this vulnerability by using this account to remotely connect to an affected device. A successful exploit could allow the attacker to log in to the device with privilege level 15 access. This vulnerability affects Cisco devices that are running a vulnerable release of Cisco IOS XE Software Release 16.x. This vulnerability does not affect Cisco IOS XE Software releases prior to Release 16.x. Cisco Bug IDs: CSCve89880.

CVE-2018-0151 is a critical (CVSS 9.8) buffer overflow (CWE-119) in the quality of service (QoS) subsystem of Cisco IOS and Cisco IOS XE, caused by incorrect bounds checking of values in packets destined to the device itself on UDP port 18999. An unauthenticated, remote attacker triggers the flaw by sending crafted packets to UDP 18999 on an affected device; traffic merely transiting the device will not trigger it. When the malicious packets are processed, an exploitable buffer overflow may allow the attacker to execute arbitrary code with elevated privileges on the device, or alternatively cause the device to reload and create a temporary denial-of-service condition. Any organization running Cisco IOS or IOS XE on routers or switches where UDP 18999 on the device is reachable from an untrusted network is affected. Exploitation is confirmed: the flaw was added to the CISA Known Exploited Vulnerabilities catalog on 2022-03-03 (ransomware use unknown), and EPSS estimates a 14.2% probability of exploitation in the next 30 days (96th percentile), though no public proof-of-concept is known.

Do: Apply the fixed Cisco IOS/IOS XE releases specified in the vendor advisory for Bug ID CSCvf73881 as soon as possible, prioritizing internet-facing devices given the KEV listing and critical severity. As an interim mitigation, block or restrict inbound UDP 18999 with interface ACLs or firewall rules so untrusted hosts cannot send packets destined to the device. Inventory your network for Cisco IOS/IOS XE devices and verify which ones accept traffic on UDP 18999 on any externally reachable interface.

CVE-2018-0171 is a critical (CVSS 9.8) buffer-overflow vulnerability in the Smart Install feature of Cisco IOS and Cisco IOS XE, caused by improper validation of packet data (CWE-20, CWE-787). An unauthenticated, remote attacker can trigger it by simply sending a crafted Smart Install message to TCP port 4786 on an affected device, with no credentials or user interaction required. A successful exploit can cause a device reload, an indefinite loop that triggers a watchdog crash, or arbitrary code execution, giving the attacker full control of the switch or router. Any IOS or IOS XE device running the Smart Install service is affected — a configuration commonly present on Catalyst switches — and devices exposed to the internet on TCP 4786 are at direct risk. Exploitation is confirmed in the wild: the flaw is on CISA's Known Exploited Vulnerabilities catalog, and both Russian (Static Tundra, FSB-linked) and Chinese (Salt Typhoon) state-sponsored actors have exploited it to compromise unpatched, often end-of-life, Cisco network devices at hundreds of organizations worldwide.

Do: Upgrade IOS/IOS XE to a fixed release per Cisco's advisory (Bug ID CSCvg76186); for end-of-life hardware that cannot be patched, plan replacement given active nation-state targeting of unpatched devices. If Smart Install is not in use, disable it with 'no vstack'; otherwise restrict TCP port 4786 with ACLs to trusted management hosts. Audit internet-facing switches and routers for Smart Install enabled and TCP 4786 exposed, and prioritize those devices for remediation.