US and allied Governments' Recommendations: Securing Network Devices Against Russian APT Groups
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2008-4128 | Cross-Site Request Forgery in Cisco IOS 12.4 HTTP Management Interface Cisco IOS 12.4 contains multiple cross-site request forgery (CWE-352) flaws in the IOS HTTP management web interface that allow a remote attacker to execute arbitrary commands on the device. The flaws are triggered when an attacker induces an already-authenticated privileged (level 15) administrator's browser to send crafted HTTP requests to the router's web server, for example a "show privilege" command via the /level/15/exec/- URI or an "alias exec" configuration command via the /level/15/exec/-/configure/http URI, letting the attacker run commands with the administrator's privileges, potentially including device reconfiguration. Any Cisco IOS 12.4 device with the HTTP/HTTPS management server enabled and reachable from an administrator's browser is affected. CISA added the issue to the Known Exploited Vulnerabilities catalog on 2026-07-13, indicating known exploitation in the wild, and EPSS assigns a 33.9% probability of exploitation in the next 30 days (98th percentile); no public proof-of-concept is known and ransomware use is not confirmed. Do: Inventory Cisco IOS devices for the 'ip http server' / 'ip http secure-server' configuration, and disable the HTTP/HTTPS management server where it is not needed or restrict it to management networks via access control lists. Apply Cisco's vendor-recommended fixed IOS release for CVE-2008-4128 in line with CISA BOD 26-04 deadlines, prioritizing internet-facing routers. Because exploitation is confirmed, also review device configurations and logs for unauthorized 'alias exec' entries or unexpected configuration changes. | — | 34% | KEV |
| largelikely tens of thousands of internet-exposed Cisco IOS devices with the HTTP management server enabled (unknown exact count) | |
| CVE-2018-0171 | Unauthenticated RCE/DoS in Cisco IOS & IOS XE Smart Install CVE-2018-0171 is a critical (CVSS 9.8) buffer-overflow vulnerability in the Smart Install feature of Cisco IOS and Cisco IOS XE, caused by improper validation of packet data (CWE-20, CWE-787). An unauthenticated, remote attacker can trigger it by simply sending a crafted Smart Install message to TCP port 4786 on an affected device, with no credentials or user interaction required. A successful exploit can cause a device reload, an indefinite loop that triggers a watchdog crash, or arbitrary code execution, giving the attacker full control of the switch or router. Any IOS or IOS XE device running the Smart Install service is affected — a configuration commonly present on Catalyst switches — and devices exposed to the internet on TCP 4786 are at direct risk. Exploitation is confirmed in the wild: the flaw is on CISA's Known Exploited Vulnerabilities catalog, and both Russian (Static Tundra, FSB-linked) and Chinese (Salt Typhoon) state-sponsored actors have exploited it to compromise unpatched, often end-of-life, Cisco network devices at hundreds of organizations worldwide. Do: Upgrade IOS/IOS XE to a fixed release per Cisco's advisory (Bug ID CSCvg76186); for end-of-life hardware that cannot be patched, plan replacement given active nation-state targeting of unpatched devices. If Smart Install is not in use, disable it with 'no vstack'; otherwise restrict TCP port 4786 with ACLs to trusted management hosts. Audit internet-facing switches and routers for Smart Install enabled and TCP 4786 exposed, and prioritize those devices for remediation. | 9.8 | 99% | KEV |
| mass≈250,000+ internet-exposed devices with TCP/4786 open, on top of a multi-million-device IOS/IOS XE installed base |
Full article395 words · extracted from securityaffairs.com · click to collapse
US and allies warn of Russian APT groups targeting routers and network devices to compromise critical infrastructure worldwide.
The US and allied governments warn that Russian state-sponsored APT groups are scanning and exploiting poorly secured network devices, especially routers, to access critical infrastructure. Groups linked to FSB Center 16, including Berserk Bear, Energetic Bear, Ghost Blizzard, Crouching Yeti, Dragonfly, and Static Tundra, have targeted organizations in communications, defense, energy, finance, government, and healthcare sectors.
“Russian Federal Security Service (FSB) Center 16 cyber actors continue to exploit poorly configured and vulnerable networking devices worldwide, opportunistically compromising multiple critical infrastructure sector networks.” reads the joint advisory.”
Russian FSB Center 16 actors mainly target poorly configured network devices, especially routers, by scanning the internet for exposed SNMP services with weak or default credentials.
They use spoofed requests to steal device configurations and move them to attacker-controlled servers through TFTP or FTP. The group also exploits known Cisco vulnerabilities and management interfaces. These techniques are not unique to Russia and overlap with other nation-state actors, so the recommended protections help defend against multiple threats.
“The Russian FSB Center 16 cyber actors primarily use scanning to identify poorly configured networking devices, primarily routers, for exploitation. The actors scan for Internet IP ranges with active Simple Network Management Protocol (SNMP) agents that accept common or default community strings for authentication” continues the joint advisory.
“While SNMP scanning is the primary method the actors use to discover and exploit poorly configured networking devices, they occasionally exploit common vulnerabilities and exposures (CVEs) in Cisco devices, Cisco’s Smart Install (SMI) functionality, and web portals to manage network devices.”
Russia-linked threat actors have also exploited known vulnerabilities, including CVE-2018-0171 and CVE-2008-4128, to compromise network devices. Their techniques overlap with other threat groups, such as Salt Typhoon.
Network defenders should strengthen router security by disabling Cisco Smart Install, replacing SNMPv1/v2 with SNMPv3 using strong encryption, and enforcing unique passwords with secure storage.
Organizations should monitor SNMP activity, restrict management access through ACLs, block unnecessary ports such as TFTP, SMI and SNMP from external networks, and detect suspicious configuration changes. They should also keep firmware updated, replace unsupported devices, and use attack surface management tools to identify exposed systems and weak configurations.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, newsletter)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/195448/apt/us-and-allied-governments-recommendations-securing-network-devices-against-russian-apt-groups.html