Rockwell Automation Allen-Bradley Stratix and ArmorStratix switches are exposed to hack due to Cisco IOS flaws

A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS and Cisco IOS XE Software allows an unauthenticated, remote attacker to cause a memory leak or a device reload, resulting in a denial of service. The flaw stems from incorrect processing of certain IKEv2 packets (CWE-401 missing memory release; CWE-20 improper input validation) and is triggered by sending crafted IKEv2 packets to an affected device. A successful attack causes the device to continuously consume memory and eventually reload, disrupting VPN termination and any traffic routed through the device, with high availability impact but no confidentiality or integrity impact (CVSS 3.1: 8.6 High, AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H). Affected organizations are those running Cisco IOS or IOS XE on routers, switches, or VPN gateways where IKEv2 processing is enabled and reachable, especially internet-facing edge devices. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-03-03 and carries a 7.2% EPSS probability of exploitation within 30 days (94th percentile), though no public proof-of-concept is known.

Do: Apply fixed Cisco IOS/IOS XE releases per the vendor's instructions for Bug ID CSCvf22394, as required by the CISA KEV catalog entry, and verify running releases against the Cisco advisory since affected ranges span many software trains. As interim mitigation, restrict reachability of IKEv2 (UDP 500 and 4500) from untrusted networks on devices that do not need to terminate IKEv2, and monitor memory utilization on internet-facing IOS/IOS XE devices with IKEv2 enabled.

CVE-2018-0171 is a critical (CVSS 9.8) buffer-overflow vulnerability in the Smart Install feature of Cisco IOS and Cisco IOS XE, caused by improper validation of packet data (CWE-20, CWE-787). An unauthenticated, remote attacker can trigger it by simply sending a crafted Smart Install message to TCP port 4786 on an affected device, with no credentials or user interaction required. A successful exploit can cause a device reload, an indefinite loop that triggers a watchdog crash, or arbitrary code execution, giving the attacker full control of the switch or router. Any IOS or IOS XE device running the Smart Install service is affected — a configuration commonly present on Catalyst switches — and devices exposed to the internet on TCP 4786 are at direct risk. Exploitation is confirmed in the wild: the flaw is on CISA's Known Exploited Vulnerabilities catalog, and both Russian (Static Tundra, FSB-linked) and Chinese (Salt Typhoon) state-sponsored actors have exploited it to compromise unpatched, often end-of-life, Cisco network devices at hundreds of organizations worldwide.

Do: Upgrade IOS/IOS XE to a fixed release per Cisco's advisory (Bug ID CSCvg76186); for end-of-life hardware that cannot be patched, plan replacement given active nation-state targeting of unpatched devices. If Smart Install is not in use, disable it with 'no vstack'; otherwise restrict TCP port 4786 with ACLs to trusted management hosts. Audit internet-facing switches and routers for Smart Install enabled and TCP 4786 exposed, and prioritize those devices for remediation.

Cisco IOS and IOS XE Software improperly validate DHCP option 82 information received in DHCPv4 packets from DHCP relay agents, creating a heap overflow condition. An unauthenticated, remote attacker can trigger the flaw by sending a crafted DHCPv4 packet with option 82 data to an affected device. Successful exploitation causes the device to reload, resulting in a denial of service; no confidentiality or integrity impact is expected, but availability of the networking device is lost. Any Cisco IOS or IOS XE device that processes option 82 information in DHCPv4 packets is affected. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog (added March 3, 2022), indicating confirmed exploitation in the wild, and EPSS assigns it a ~7.8% probability of exploitation over the next 30 days.

Do: Upgrade affected Cisco IOS and IOS XE devices to a fixed release listed in the Cisco security advisory for Bug ID CSCvg62730, per the vendor's instructions. Until patched, restrict DHCPv4 traffic to trusted DHCP relay agents and avoid exposing DHCP relay functionality to untrusted networks, and check whether DHCP relay/option 82 is enabled on exposed devices. Monitor devices for unexpected reloads as a sign of attempted exploitation.

Cisco IOS Software and Cisco IOS XE Software contain an improper input validation flaw (CWE-20) in the DHCP option 82 encapsulation functionality. An unauthenticated remote attacker can trigger it by sending a crafted DHCPv4 packet carrying option 82 information to a device that processes packets received from DHCP relay agents. A successful exploit causes the affected device to reload, producing a denial of service; the CVSS vector confirms no confidentiality or integrity impact. Any organization running Cisco IOS or IOS XE devices that act as DHCP relay agents or otherwise handle relayed DHCP traffic is potentially affected. The flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-03), indicating observed exploitation, though no public proof-of-concept is known.

Do: Apply updated Cisco IOS/IOS XE releases per Cisco's advisory for Bug ID CSCuh91645, prioritizing devices configured as DHCP relay agents or exposed to untrusted DHCP traffic. As an interim mitigation, disable or restrict option 82 processing/insertion on relay configurations and limit DHCPv4 traffic to trusted relay agents. Verify exposure by auditing IOS/IOS XE devices for DHCP relay configurations and for receipt of relayed DHCP packets.