NCSC Warns of Destructive Russian Attacks on Critical Infrastructure
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-6742 | Authenticated SNMP Remote Code Execution in Cisco IOS and IOS XE Software CVE-2017-6742 is a memory-corruption flaw (CWE-119) in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE. It is triggered when an affected device processes crafted SNMP packets sent by an authenticated, remote attacker, meaning the device must have SNMP enabled and the attacker must hold valid SNMP credentials or community strings. Successful exploitation lets the attacker execute code on the router or switch, or force the device to reload, yielding either full control of the device or a denial of service on critical network infrastructure. Any organization running vulnerable Cisco IOS or IOS XE releases with SNMP enabled on routers, switches, or other network devices is affected. The flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2023-04-19), confirming in-the-wild exploitation; EPSS estimates a 21.4% probability of exploitation within 30 days (97th percentile), and no public proof-of-concept code is known. Do: Upgrade affected Cisco IOS and IOS XE devices to fixed releases per Cisco's advisory, prioritizing internet-facing routers and switches as the KEV listing makes patching mandatory for federal agencies and urgent for others. As interim mitigation, restrict SNMP access to trusted management hosts with ACLs, disable SNMP entirely where it is not required, and rotate SNMP community strings/credentials that could be used for authentication. Inventory devices for enabled SNMP services and vulnerable releases, focusing first on edge and internet-exposed infrastructure. | 8.8 | 21% | KEV |
| masson the order of hundreds of thousands of systems (well above 100k affected/exposed devices, given Cisco's installed base) |
Full article373 words · extracted from infosecurity-magazine.com · click to collapse
One of the UK’s leading security agencies has sounded the alarm over “state-aligned” Russian groups which could launch destructive attacks on critical national infrastructure (CNI).
The National Cyber Security Centre (NCSC) said in the alert that such groups usually focus on DDoS, web defacement and spreading misinformation, but that they may progress to “destructive and disruptive attacks” on CNI if they see the opportunity.
“In the wake of this emerging threat, our message to CNI sectors is to take sensible, proportionate steps now to protect themselves,” argued Marsha Quallo-Wright, NCSC deputy director for critical national infrastructure.
“The NCSC has produced advice for organizations on steps to take when the cyber threat is heightened, and I would strongly encourage all CNI organizations to follow this now.”
State-aligned groups are not financially motivated or formally state controlled, meaning their actions are “less constrained and their targeting broader” than traditional cyber-criminals, the NCSC warned, adding that this makes them less predictable.
However, the threat from Russian state actors today is also very real. A joint advisory from the NCSC, the US Cybersecurity and Infrastructure Security Agency (CISA) and the FBI on Tuesday warned of continued efforts by a military APT group to compromise Cisco routers.
APT28, which operates out of the Russian military intelligence service GRU, has been exploiting legacy bug CVE-2017-6742 since 2021, to install custom backdoor Jaguar Tooth, the agencies claimed.
Read more on APT28: Cisco: Destructive VPNFilter Malware Has Infected 500K Devices.
Deployed previously against a small number of organizations based in Europe, as well as US government institutions and around 250 Ukrainian victims, the malware apparently enables unauthenticated access to targeted devices for reconnaissance purposes.
“This malicious activity by APT28 presents a serious threat to organizations, and the UK and our US partners are committed to raising awareness of the tactics and techniques being deployed,” said NCSC director of operations, Paul Chichester.
“We strongly encourage network defenders to ensure the latest security updates are applied to their routers and to follow the other mitigation steps outlined in the advisory to prevent compromise.”
These mitigation measures include keeping devices and networks up to date, following password management best practices, and monitoring and logging commands executed on network devices.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/ncsc-russian-attacks-critical/