Vigilante hackers strike Russia and Iran Networks exploiting Cisco CVE-2018
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2018-0156 | Unauthenticated DoS in Cisco IOS/IOS XE Smart Install clients CVE-2018-0156 is an improper input-validation flaw (CWE-20) in the Smart Install feature of Cisco IOS and IOS XE that lets an unauthenticated, remote attacker force an affected switch to reload. The attacker sends a single crafted TCP packet to port 4786, the Smart Install listener, and the device crashes and reboots, producing a denial of service with no credentials or user interaction required. Impact is availability-only (CVSS 3.1:7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H): the attacker gains no code execution or data theft, only the ability to repeatedly knock devices offline. Only switches operating as Smart Install clients are affected; devices configured as Smart Install directors, or without the feature enabled, are not vulnerable. CISA added the flaw to the KEV catalog on 2022-03-03 (ransomware use unknown), EPSS rates 30-day exploitation probability at 8.6% (95th percentile), and no public PoC is known. Do: Apply updated IOS/IOS XE releases per Cisco's instructions for bug CSCvd40673 (CISA's required action). As an interim mitigation, restrict TCP port 4786 with ACLs to trusted Smart Install directors, and inventory which switches actually run as Smart Install clients since director-only devices are unaffected. Prioritize internet-reachable switches given the March 2022 KEV listing. | 7.5 | 9% | KEV |
| masson the order of 100,000+ internet-exposed Smart Install client switches, with a larger count including internal-only deployments | |
| CVE-2018-0171 | Unauthenticated RCE/DoS in Cisco IOS & IOS XE Smart Install CVE-2018-0171 is a critical (CVSS 9.8) buffer-overflow vulnerability in the Smart Install feature of Cisco IOS and Cisco IOS XE, caused by improper validation of packet data (CWE-20, CWE-787). An unauthenticated, remote attacker can trigger it by simply sending a crafted Smart Install message to TCP port 4786 on an affected device, with no credentials or user interaction required. A successful exploit can cause a device reload, an indefinite loop that triggers a watchdog crash, or arbitrary code execution, giving the attacker full control of the switch or router. Any IOS or IOS XE device running the Smart Install service is affected — a configuration commonly present on Catalyst switches — and devices exposed to the internet on TCP 4786 are at direct risk. Exploitation is confirmed in the wild: the flaw is on CISA's Known Exploited Vulnerabilities catalog, and both Russian (Static Tundra, FSB-linked) and Chinese (Salt Typhoon) state-sponsored actors have exploited it to compromise unpatched, often end-of-life, Cisco network devices at hundreds of organizations worldwide. Do: Upgrade IOS/IOS XE to a fixed release per Cisco's advisory (Bug ID CSCvg76186); for end-of-life hardware that cannot be patched, plan replacement given active nation-state targeting of unpatched devices. If Smart Install is not in use, disable it with 'no vstack'; otherwise restrict TCP port 4786 with ACLs to trusted management hosts. Audit internet-facing switches and routers for Smart Install enabled and TCP 4786 exposed, and prioritize those devices for remediation. | 9.8 | 99% | KEV |
| mass≈250,000+ internet-exposed devices with TCP/4786 open, on top of a multi-million-device IOS/IOS XE installed base |
Full article504 words · extracted from securityaffairs.com · click to collapse
Last week, the hacking crew “JHT” launched a hacking campaign exploiting Cisco CVE-2018-0171 flaw against network infrastructure in Russia and Iran.
Last week, the hacking crew “JHT” launched a hacking campaign against CISCO devices in Russian and Iranian networks.
The hackers exploited the Cisco CVE-2018-0171 Smart Install to reset the routers to the startup-config and reboot the devices, then they left the following message to the victims:
“Don’t mess with our elections…. -JHT [email protected]”
Threat actors used seemly automated tools to exploit Cisco IOS and Cisco IOS XE critical flaws (CVE-2018-0171 & CVE-2018-0156) to cause mass network outages.
Smart Install is a legacy plug-and-play configuration and image-management feature that provides zero-touch deployment for new switches.
https://twitter.com/xnetua/status/982316233411325952
Cisco PSIRT has published a new security advisory for abuse of the Smart Install protocol, the IT giant has identified hundreds of thousands of exposed devices online.
Cisco is advising organizations that hackers could target its switches via the Smart Install protocol. The IT giant has identified hundreds of thousands of exposed devices and warned critical infrastructure using them of potential risks.
“Cisco is aware of a significant increase in Internet scans attempting to detect devices where, after completing setup, the Smart Install feature remains enabled and without proper security controls. This could leave the involved devices susceptible to misuse of the feature. ” reads the new security advisory.
“Several researchers have reported on the use of Smart Install (SMI) protocol messages toward Smart Install clients, also known as integrated branch clients (IBC), allowing an unauthenticated, remote attacker to change the startup-config file and force a reload of the device, load a new IOS image on the device, and execute high-privilege CLI commands on switches running Cisco IOS and IOS XE Software.”
The wave of attacks hit thousands of devices in Iran, Iran’s Communication and Information Technology Ministry stated that over 200,000 routers worldwide were affected, with 3,500 of them being in Iran.
“Hackers have attacked networks in a number of countries including data centers in Iran where they left the image of a U.S. flag on screens along with a warning: “Don’t mess with our elections”, the Iranian IT ministry said on Saturday.”
“The attack apparently affected 200,000 router switches across the world in a widespread attack, including 3,500 switches in our country,” the Communication and Information Technology Ministry said in a statement carried by Iran’s official news agency IRNA.
Iran’s ICT Minister Mohammad Javad Azari-Jahromi stated 95% of the affected routers in the country had been already restored to normal service.
تا کنون بیش از ۹۵ درصد مسیریابهای متاثر از حمله به حالت عادی بازگشتند و سرویس دهی را از سر گرفتند
— MJ Azari Jahromi (@azarijahromi) April 6, 2018
According to Joseph Cox from Motherboard who has reached the attackers, behind the assaults, there are vigilante hackers that scanned the Internet for vulnerable CISCO devices and exploited the flaw against systems in Russia and Iran.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(Security Affairs – Cisco CVE-2018-0171, hacking)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/71181/hacking/cve-2018-0171-russia-iran-attacks.html