Cisco has addressed the two vulnerabilities that hackers exploited to compromise tens of thousands of IOS XE devices over the past week. The free software release comes after a threat actor leveraged the security issues as zero-days to compromise and take full control of more than 50,000 Cisco IOS XE hosts. In an update to the original advisory, Cisco says that the first fixed software release is available from the company's Software Download Center. Both vulnerabilities, which Cisco tracks as CSCwh87343, are in the web UI of Cisco devices running the IOS XE software. The vendor of networking gear says that the threat actor exploited the critical flaw to gain initial access to the device and then "Issued a privilege 15 command" to create a normal local account. On Cisco devices, permissions to issue commands are locked into levels from zero to 15, with zero providing five basic commands and 15 being the most privileged level that provides complete control over the device. The company warns that the two vulnerabilities can be exploited if the web UI feature of the device is turned on, which is possible through the ip http server or ip http secure-server commands. "The presence of either command or both commands in the system configuration indicates that the web UI feature is enabled" - Cisco. When Cisco disclosed CVE-2023-20198 on October 16 as a zero-day exploited in the wild, security researchers started looking for compromised devices. Initial findings estimated that about 10,000 Cisco IOS XE vulnerable devices had been infected by Tuesday. On October 20, Cisco disclosed the second zero-day being exploited in the same campaign to take complete control of systems running the IOS XE software. Over the weekend researchers saw a steep drop in the number of Cisco IOS XE hosts hacked using the two zero-day vulnerabilities, from about 60,000 to just a few hundred. Piotr Kijewski, the CEO of The Shadowserver Foundation told BleepingComputer that they observed a sharp drop in implants since October 21 to just 107 devices. The reason for the sudden low number could also be that a grey-hat hacker has been automatically rebooting infected devices to remove the malicious implant. We can't know for sure until Cisco completes its investigation and provides a public report or other security researchers come to a conclusion analyzing a breached Cisco IOS XE system. Number of hacked Cisco IOS XE devices plummets from 50K to hundreds. Over 40,000 Cisco IOS XE devices infected with backdoor using zero-day. Cisco discloses new IOS XE zero-day exploited to deploy malware implant. Over 10,000 Cisco devices hacked in IOS XE zero-day attacks. Cisco warns of new IOS XE zero-day actively exploited in attacks.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Thu, 30 Nov 2023 23:19:27 +0000