Cisco fixes security flaw that could have allowed sneaky hacking

News
By
published

Vulnerability allows threat actors to persist even after reboots

A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.
(Image credit: Shutterstock)

Cisco has confirmed it patched a high-severity flaw that was impacting its IOx application hosting environment. 

Cisco IOx is an application environment that allows consistent deployment of applications that are independent of the network infrastructure and docker tooling for development. It is used by a wide range of businesses, from manufacturing, to energy, to the public sector.

The flaw, tracked as CVE-2023-20076, allowed threat actors to achieve persistence on the operating system, thus gaining the ability to execute commands, remotely.

Who is affected?

"An attacker could exploit this vulnerability by deploying and activating an application in the Cisco IOx application hosting environment with a crafted activation payload file," Cisco said in its security advisory. 

Users running IOS XE without native docker support are affected, as well as those running 800 Series Industrial ISR routers, CGR1000 compute modules, IC3000 industrial compute gateways, IR510 WPAN industrial routers, and Cisco Catalyst access point (COS-APs) endpoints.

Catalyst 9000 Series switches, IOS XR and NX-OS software, and Meraki products, are unaffected by the flaw, the company added.

Read more

> Cisco says it won't patch these dangerous VPN security flaws in its SMB routers

> Cisco AnyConnect urges admins to update now to avoid security threats

> Check out the best firewalls right now

The caveat with this vulnerability is that the threat actors need to already be authenticated as an administrator on the vulnerable systems. 

Still, researchers from Trellix, who first discovered the flaw, said crooks could easily pair this vulnerability with others, in their malicious campaigns. Authentication can be obtained with default login credentials (many users never change them), as well as through phishing and social engineering. 

After authenticating, CVE-2023-20076 can be abused for "unrestricted access, allowing malicious code to lurk in the system and persist across reboots and firmware upgrades."

"Side-stepping this security measure means that if an attacker exploits this vulnerability, the malicious package will keep running until the device is factory reset or until it is manually deleted."

The good news is that so far there is no evidence of the flaw being exploited in the wild but still, if you use this solution, make sure it's updated to the latest version. 

Via: BleepingComputer

Sead Fadilpašić

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.