China’s ‘Velvet Ant’ hackers caught exploiting new zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-20399 | Authenticated Command Injection in Cisco NX-OS Grants Root Privileges CVE-2024-20399 is a command injection flaw (CWE-78) in the CLI of Cisco NX-OS Software, caused by insufficient validation of arguments passed to specific configuration CLI commands. An authenticated attacker who already holds Administrator credentials can trigger it by submitting crafted input as the argument of an affected configuration command, gaining the ability to execute arbitrary commands as root on the device's underlying operating system. Because Administrator access is required, the flaw is effectively a privilege-escalation issue following credential compromise, and it grants no additional privilege on Nexus 3000 Series, Nexus 7000 Series running NX-OS 8.1(1) or later, and Nexus 9000 Series in standalone NX-OS mode, which already allow administrative bash-shell access to the OS. Any organization running affected NX-OS on Cisco Nexus switching is in scope, with the practical risk concentrated in environments where admin credentials may have been stolen. Exploitation has been observed in the wild: the China-linked group 'Velvet Ant' (associated with Salt Typhoon) used it as a zero-day to compromise U.S. ISPs and telecom providers, and CISA added it to the Known Exploited Vulnerabilities catalog on 2024-07-02. Do: Upgrade affected Nexus switches to a fixed NX-OS release per Cisco's security advisory, as required by the CISA KEV listing (apply mitigations per vendor instructions or discontinue use if fixes are unavailable). Restrict and audit Administrator-level CLI access on NX-OS devices, and hunt for suspicious configuration-command activity or unexplained root-level actions, given Velvet Ant/Salt Typhoon targeting of telecom and ISP networks. For Nexus 3000, Nexus 7000 (8.1(1)+), and Nexus 9000 standalone-mode devices the flaw adds no privilege, but patching is still recommended. | 6.7 | 4% | KEV |
| masshundreds of thousands of NX-OS/Nexus devices deployed across enterprise and data-center networks (no authoritative public install count) |
Full article398 words · extracted from therecord.media · click to collapse
A newly identified zero-day vulnerability affecting a popular line of Cisco devices was used in an April attack by state-backed hackers from China. Cisco and cybersecurity firm Sygnia published advisories on Monday about CVE-2024-20399 — a vulnerability affecting the Cisco NX-OS software used for the Nexus-series switches that connect devices on a network. Sygnia incident response research manager Amnon Kushnir said they discovered the vulnerability as part of a larger forensic investigation involving a threat group they call Velvet Ant. “The threat actors gathered administrator-level credentials to gain access to Cisco Nexus switches and deploy a previously unknown custom malware that allowed them to remotely connect to compromised devices, upload additional files and execute malicious code,” Kushnir explained. “We immediately reported this vulnerability and exploitation to Cisco and provided detailed information about the attack flow.” Cisco has released software updates that address the vulnerability but they noted that there are no workarounds. The company said its Product Security Incident Response Team (PSIRT) became aware of attempted exploitation in April. The vulnerability affects multiple Cisco products running a vulnerable release of Cisco NX-OS Software. According to Sygnia, Cisco Nexus switches are prevalent in enterprise environments, especially within data centers, but most are not directly exposed to the internet. Network devices like switches are often not sufficiently protected, and organizations frequently fail to take other steps to protect themselves, Kushnir added. He told Recorded Future News that the Velvet Ant hackers likely breached the organization’s network first before exploiting the vulnerability — calling it “another example of Velvet Ant’s sophistication and stealthiness when infiltrating network devices.” The group’s primary objective is espionage, and it focuses on establishing long-term access to a victim’s network. In June, Sygnia wrote about another Velvet Ant campaign where the hackers were able to maintain multiple footholds within the victim company’s environment for three years. The group used outdated F5 BIG-IP equipment to stay under the radar and obtain private data, including financial and customer information. Correction: A previous version of this article incorrectly spelled the last name of Sygnia's Amnon Kushnir.
No previous article
No new articles
Jonathan Greig
is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.
Text extracted automatically; images, tables and formatting may be missing. Original: https://therecord.media/cisco-velvet-ant-hackers-china