Attackers have exploited a recently disclosed critical zero-day bug to compromise and infect more than 10,000 Cisco IOS XE devices with malicious implants. The list of products running Cisco IOS XE software includes enterprise switches, aggregation and industrial routers, access points, wireless controllers, and more. According to threat intelligence company VulnCheck, the maximum severity vulnerability has been extensively exploited in attacks targeting Cisco IOS XE systems with the Web User Interface feature enabled, that also have the HTTP or HTTPS Server feature toggled on. VulnCheck scanned internet-facing Cisco IOS XE web interfaces and discovered thousands of infected hosts. The company has also released a scanner to detect these implants on affected devices. "Cisco buried the lede by not mentioning thousands of internet-facing IOS XE systems have been implanted. This is a bad situation, as privileged access on the IOS XE likely allows attackers to monitor network traffic, pivot into protected networks, and perform any number of man-in-the-middle attacks," said VulnCheck CTO Jacob Baines. "If your organization uses an IOS XE system, it's imperative that you determine if your systems have been compromised and take appropriate action once implants have been discovered. While a patch is not yet available, you can protect your organization by disabling the web interface and removing all management interfaces from the internet immediately." "VulnCheck has fingerprinted approximately 10,000 implanted systems, but we've only scanned approximately half of the devices listed on Shodan/Censys. We didn't want to commit to a specific number as it's evolving as we continue our activities," Baines told BleepingComputer. A Shodan search for Cisco devices with their Web UI enabled currently shows more than 140,000 Internet-exposed devices. On Monday, Cisco disclosed that unauthenticated attackers can exploit the IOS XE zero-day to gain full administrator privileges and take complete control over affected Cisco routers and switches remotely. Cisco detected the CVE-2023-20198 attacks in late September following reports of unusual behavior on a customer device received by Cisco's Technical Assistance Center. Evidence of these attacks dates back to September 18, when the attackers were observed creating local user accounts named "Cisco tac admin" and "Cisco support." The attackers deployed malicious implants, enabling them to execute arbitrary commands at the system or IOS levels on compromised devices. "We assess that these clusters of activity were likely carried out by the same actor. Both clusters appeared close together, with the October activity appearing to build off the September activity," Cisco said. In September, Cisco cautioned customers to patch another zero-day vulnerability in its IOS and IOS XE software, targeted by attackers in the wild. Cisco warns of new IOS XE zero-day actively exploited in attacks. Cisco urges admins to fix IOS software zero-day exploited in attacks. Ivanti warns of new actively exploited MobileIron zero-day bug. Hackers exploit critical flaw in WordPress Royal Elementor plugin. Microsoft: State hackers exploiting Confluence zero-day since September.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Thu, 30 Nov 2023 23:19:27 +0000