Cisco routers come under attack, including a destructive hacktivist campaign
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2018-0171 | Unauthenticated RCE/DoS in Cisco IOS & IOS XE Smart Install CVE-2018-0171 is a critical (CVSS 9.8) buffer-overflow vulnerability in the Smart Install feature of Cisco IOS and Cisco IOS XE, caused by improper validation of packet data (CWE-20, CWE-787). An unauthenticated, remote attacker can trigger it by simply sending a crafted Smart Install message to TCP port 4786 on an affected device, with no credentials or user interaction required. A successful exploit can cause a device reload, an indefinite loop that triggers a watchdog crash, or arbitrary code execution, giving the attacker full control of the switch or router. Any IOS or IOS XE device running the Smart Install service is affected — a configuration commonly present on Catalyst switches — and devices exposed to the internet on TCP 4786 are at direct risk. Exploitation is confirmed in the wild: the flaw is on CISA's Known Exploited Vulnerabilities catalog, and both Russian (Static Tundra, FSB-linked) and Chinese (Salt Typhoon) state-sponsored actors have exploited it to compromise unpatched, often end-of-life, Cisco network devices at hundreds of organizations worldwide. Do: Upgrade IOS/IOS XE to a fixed release per Cisco's advisory (Bug ID CSCvg76186); for end-of-life hardware that cannot be patched, plan replacement given active nation-state targeting of unpatched devices. If Smart Install is not in use, disable it with 'no vstack'; otherwise restrict TCP port 4786 with ACLs to trusted management hosts. Audit internet-facing switches and routers for Smart Install enabled and TCP 4786 exposed, and prioritize those devices for remediation. | 9.8 | 99% | KEV |
| mass≈250,000+ internet-exposed devices with TCP/4786 open, on top of a multi-million-device IOS/IOS XE installed base | |
| CVE-2020-3580 | Cross-Site Scripting in Cisco ASA and FTD Web Services Interface CVE-2020-3580 is a cross-site scripting (XSS) flaw caused by insufficient validation of user-supplied input in the web services interface of Cisco ASA and Firepower Threat Defense (FTD) software. An unauthenticated, remote attacker can exploit it by persuading a user of the web interface to click a crafted link, which then executes arbitrary script code in the context of the interface or exposes sensitive browser-based information such as session data. Only devices running specific AnyConnect and WebVPN configurations are affected, so not every ASA/FTD deployment is vulnerable. The flaw is under active exploitation: it is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) with known ransomware use, a public PoC exploit has driven scanning, and groups such as Akira and LockBit are actively searching for vulnerable Cisco ASA devices. Do: Apply updates per the vendor's instructions (Cisco's advisory lists the fixed ASA/FTD releases), prioritizing internet-facing devices since ransomware operators (Akira, LockBit) are actively scanning. Check whether the web services interface (AnyConnect/WebVPN) is enabled, as only those configurations are vulnerable, and restrict internet access to the device's management/web interface where possible. Treat as urgent given its KEV listing and known ransomware use. | 6.1 | 86% | KEV ransomware |
| mass≈100,000–1,000,000 internet-exposed ASA/FTD appliances (Cisco ASA is among the most commonly exposed edge firewall/VPN platforms in public internet scans) |
Full article615 words · extracted from therecord.media · click to collapse
Cisco ASA routers and FTD firewalls are currently seeing exploitation attempts from threat actors and bug bounty hunters alike after proof of concept code was posted online last week. Furthermore, older Cisco systems have also seen renewed attacks in May this year after a hacktivist abused a 2018 bug to overwrite device configurations with a pro-gun manifesto that eventually crashed devices. The most recent attacks are, however, those carried out against ASA and FTD devices. These attacks began last week after security firm Positive Technologies posted a simple proof-of-concept (PoC) exploit code on Twitter for CVE-2020-3580, a vulnerability the company discovered and helped patch in October last year. PoC for XSS in Cisco ASA (CVE-2020-3580) POST /+CSCOE+/saml/sp/acs?tgname=a HTTP/1.1 SAMLResponse="><svg/onload=alert('PTSwarm')> pic.twitter.com/c53MKSK9bg Within an hour after the exploit code was posted online, Mikhail Klyuchnikov, a security researcher for Positive Technologies, said the PoC had already been used by bug hunters to find entry points into corporate networks, which some of them had reported to companies in the hopes of receiving a monetary reward (a bug bounty). The hunt for low hanging CVE-2020-3580 by @ptswarm has begun. However, white hats weren't the only ones that exploited this bug. In a blog post on Friday, security firm Tenable said it received at least one report that the bug was also being actively exploited by threat actors. The CVE-2020-3580 vulnerability, however, is not as dangerous as other past Cisco security flaws. This is because the bug requires tricking a user with an account on the device's admin interface to click a malicious link, a social engineering scenario that is not always easy to incorporate in mass attacks. However, if exploited, the CVE-2020-3580 bug allows the attacker to execute malicious code on the ASA and FTD management panel with admin privileges via one of four different cross-site scripting (XSS) vulnerabilities present in unpatched devices. In addition to these campaigns last week, some older Cisco devices also saw a series of destructive attacks in May. Spotted by Lumen's Black Lotus Labs, the campaign targeted devices that had the Smart Install protocol enabled and accessible over the internet. Using the old CVE-2018-0171 vulnerability, a mysterious hacktivist gained access to Cisco systems and rewrote their config file with text from a pro-gun manifesto, effectively crashing the devices' routing engines. Per the Black Lotus Lab team, this campaign hit around 100 of 18,000 Cisco devices still vulnerable to the old 2018 bug, with most victims based in the US. This also marks the second time this specific 2018 bug was exploited by hacktivists after a first group also used it to deface Cisco routers in Iran and Russia with an ASCII American flag and a message warning the two countries not to mess with the US elections. This attack, which took place in the spring of 2018, hit more than 200,000 Cisco routers, including routers outside Iran and Russia. All in all, both campaigns show why it's important to patch all bugs as soon as possible, even if proof-of-concept code was not immediately released after a bug was patched, as some old vulnerabilities might come back to haunt companies years later when that PoC code becomes broadly available to attackers.The Cisco ASA/FTD attacks
Host: ciscoASA.local
Content-Type: application/x-www-form-urlencoded
Content-Length: 44
A lot of submissions/duplicates are waiting for @Bugcrowd and @Hacker0x01 #bugbountyDestructive hacktivist campaign
No previous article
No new articles
Catalin Cimpanu
is a cybersecurity reporter who previously worked at ZDNet and Bleeping Computer, where he became a well-known name in the industry for his constant scoops on new vulnerabilities, cyberattacks, and law enforcement actions against hackers.
Text extracted automatically; images, tables and formatting may be missing. Original: https://therecord.media/cisco-devices-come-under-new-attacks-including-a-hacktivist-campaign