5 New Vulnerabilities Expose The 'Backbone' Of An Enterprise Network To Data Theft

The flaws in a Cisco protocol show the challenge of keeping one insecure device from being a gateway to another for a hacker.

A protocol that underpins widely used equipment made by telecommunications giant Cisco is vulnerable to multiple data-stealing attacks, researchers warned Wednesday.

The five previously unreported vulnerabilities in implementations of the Cisco protocol — found by Armis Security, a California-based company — show the enduring challenge of keeping one insecure device from being a gateway to another for a hacker.

The zero-day bugs affect the many voice-over-IP phones, routers, and switches at corporations around the world that use the protocol for communications. A hacker with enough skill and motivation to exploit the vulnerabilities could gain access to a company’s network and then, for example, take over the VOIP phones on the network to steal data or eavesdrop on calls.

The routers and switches that are susceptible to the vulnerabilities form “the backbone of [an enterprise] network,” said Ben Seri, Armis’s vice president of research, who wrote a proof-of-concept for an attack on an VOIP phone.

For an attacker, “a switch is a very strong position to be inside the network [because] all the network traffic traverses through” it, Seri added, explaining why he began investigating the issue months ago.

The vulnerabilities, four of which could allow a hacker to deploy their code remotely, are in the Cisco Discovery Protocol (CDP), a popular protocol that allows Cisco devices on the same network to talk to each other. The CDP is a means of separating virtual local area networks within an enterprise. By breaking the protocol, and using a switch as a foothold to other parts of the network, an attacker could gain access to an array of enterprise devices.

“The devices themselves that are there to make sure segmentation works are also embedded devices that might be vulnerable to attacks,” Seri told CyberScoop.

Patches available

Cisco has issued security fixes for all five vulnerabilities and encouraged users to apply them. Neither Cisco nor Armis are aware of any exploitation of the bugs by malicious hackers.

A Cisco spokesperson thanked the Armis researchers for finding the vulnerabilities and advised users to disable the CDP “on all interfaces that are connected to untrusted networks.”

“An attacker must be in the same broadcast domain or subnet as the affected device in order to exploit the vulnerabilities,” the spokesman said.

Seri is the only the latest researcher to probe the CDP. On Saturday, security consultant Ken Pyle revealed multiple vulnerabilities in Cisco networking switches, at least one of which related to the protocol.

Seri said he plans to examine several other protocols that, like CDP, govern the transfer of data between devices on virtual local area networks.

“In a way, it’s the tip of the iceberg,” Seri said of the research released Wednesday.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure