Cisco Warns of Vulnerability in IOS and IOS XE Software After Exploitation Attempts

Vulnerability in the Elasticsearch database used in the of Cisco SD-WAN vManage software could allow an unauthenticated, remote attacker to access the Elasticsearch configuration database of an affected device with the privileges of the elasticsearch user. These vulnerability is due to the presence of a static username and password configured on the vManage. An attacker could exploit this vulnerability by sending a crafted HTTP request to a reachable vManage on port 9200. A successful exploit could allow the attacker to view the Elasticsearch database content. There are workarounds that address this vulnerability.

CVE-2023-20109 is an out-of-bounds write (CWE-787) in the Group Encrypted Transport VPN (GET VPN) feature of Cisco IOS and Cisco IOS XE, caused by insufficient validation of Group Domain of Interpretation (GDOI) and G-IKEv2 protocol attributes. An authenticated, remote attacker with administrative control of either a GET VPN group member or key server can trigger the flaw by compromising the installed key server or by modifying a group member's configuration to point at an attacker-controlled key server, then sending crafted GDOI/G-IKEv2 attributes. A successful exploit allows the attacker to execute arbitrary code and gain full control of the device, or to crash/reload it, causing a denial-of-service condition. Only organizations running Cisco IOS/IOS XE devices with the GET VPN feature configured (as group members or key servers) are affected; CVSS 3.1 rates it 6.6 (medium) because exploitation requires high privileges and high attack complexity. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2023-10-10, indicating confirmed in-the-wild exploitation, while EPSS estimates a 2.3% probability of exploitation in the next 30 days and no public PoC is known.

Do: Upgrade affected devices to a fixed release identified in Cisco's security advisory, and inventory GET VPN deployments with 'show crypto gdoi' to identify group members and their key servers. Because exploitation requires a compromised or attacker-controlled key server, harden and restrict access to key servers, verify that group member configurations point only to legitimate key servers, and rotate GET VPN keys if compromise is suspected. Per the CISA KEV required action, apply vendor mitigations promptly or discontinue use where mitigations are unavailable.

A vulnerability in the Security Assertion Markup Language (SAML) APIs of Cisco Catalyst SD-WAN Manager Software could allow an unauthenticated, remote attacker to gain unauthorized access to the application as an arbitrary user. This vulnerability is due to improper authentication checks for SAML APIs. An attacker could exploit this vulnerability by sending requests directly to the SAML API. A successful exploit could allow the attacker to generate an authorization token sufficient to gain access to the application.

A vulnerability in the session management system of the Cisco Catalyst SD-WAN Manager multi-tenant feature could allow an authenticated, remote attacker to access another tenant that is being managed by the same Cisco Catalyst SD-WAN Manager instance. This vulnerability requires the multi-tenant feature to be enabled. This vulnerability is due to insufficient user session management within the Cisco Catalyst SD-WAN Manager system. An attacker could exploit this vulnerability by sending a crafted request to an affected system. A successful exploit could allow the attacker to gain unauthorized access to information about another tenant, make configuration changes, or possibly take a tenant offline causing a denial of service condition.