Cisco fixes security flaw that could have allowed sneaky hacking

Cisco has confirmed it patched a high-severity flaw that was impacting its IOx application hosting environment. 

Cisco IOx is an application environment that allows consistent deployment of applications that are independent of the network infrastructure and docker tooling for development. It is used by a wide range of businesses, from manufacturing, to energy, to the public sector.

The flaw, tracked as CVE-2023-20076, allowed threat actors to achieve persistence on the operating system, thus gaining the ability to execute commands, remotely.

Who is affected?

“An attacker could exploit this vulnerability by deploying and activating an application in the Cisco IOx application hosting environment with a crafted activation payload file,” Cisco said (opens in new tab) in its security advisory. 

Users running IOS XE without native docker support are affected, as well as those running 800 Series Industrial ISR routers, CGR1000 compute modules, IC3000 industrial compute gateways, IR510 WPAN industrial routers, and Cisco Catalyst access point (COS-APs) endpoints (opens in new tab).

Catalyst 9000 Series switches, IOS XR and NX-OS software, and Meraki products, are unaffected by the flaw, the company added.

The caveat with this vulnerability is that the threat actors need to already be authenticated as an administrator on the vulnerable systems. 

Still, researchers from Trellix, who first discovered the flaw, said crooks could easily pair this vulnerability with others, in their malicious campaigns. Authentication can be obtained with default login credentials (many users never change them), as well as through phishing and social engineering. 

After authenticating, CVE-2023-20076 can be abused for “unrestricted access, allowing malicious code to lurk in the system and persist across reboots and firmware upgrades.”

“Side-stepping this security measure means that if an attacker exploits this vulnerability, the malicious package will keep running until the device is factory reset or until it is manually deleted.”

The good news is that so far there is no evidence of the flaw being exploited in the wild but still, if you use this solution, make sure it’s updated to the latest version. 

Via: BleepingComputer (opens in new tab)