Bach Seat

If you are using Cisco (CSCO) switches or routers that run on IOS XE software, you may be at risk of a serious security breach. A vulnerability (CVE-2023-20198) affecting the web user interface (UI) of IOS XE software has been actively exploited by cyber threat actors to take control of affected devices. This vulnerability allows an attacker to send malicious HTTP requests to the web UI and execute arbitrary commands with elevated privileges.

What is the Cisco IOS XE Vulnerability?

The Cisco IOS XE vulnerability is a command injection vulnerability that affects the web UI feature of IOS XE software. CERT Orange Cyberdefense discovered more than 34,500 IOS XE IPs compromised by the 10/10 vulnerability. The web UI is a web-based management interface that allows users to configure and monitor Cisco devices through a web browser. Cisco’s web UI feature is enabled by default on the base image and can be enabled or disabled through the command-line interface (CLI).

The vulnerability exists because the web UI does not properly validate the user input in the HTTP requests. An attacker can exploit this vulnerability by sending specially crafted HTTP requests to the web UI that contain malicious commands. These commands are then executed with root privileges on the underlying operating system. Root grants the attacker full control over the device.

The attacker does not need to authenticate to the web UI to exploit this vulnerability. What they need is access to the web UI through the network. This means that any device that has the web UI exposed to the internet or an untrusted network is vulnerable.

How Can This Vulnerability Impact Your Network?

The impact of this vulnerability depends on the role and configuration of the device in your network. An attacker who gains control of a Cisco device can use it to perform various malicious actions, such as:

• Modify or delete the device configuration.
• Install malware or backdoors on the device.
• Redirect or intercept network traffic.
• Launch attacks against other devices or networks.
• Exfiltrate sensitive data from the device or network.

Depending on the device type and location, these actions can have serious consequences for your network. For example, an attacker who compromises a core switch or router can disrupt or manipulate the network traffic for a large segment of your network, affecting multiple services and users.

What Can You Do to Mitigate the Risk?

Cisco has released a patch for this vulnerability. However, Cisco has not patched some versions of IOS XE software. You can check if your device is affected and if there is a fixed version available by visiting the Cisco Security Advisory page. If there is a fixed version for your device, you should apply it as soon as possible.

However, if there is no fixed version for your device yet, or if you cannot apply it immediately, you should take some additional steps to protect your network from this vulnerability. Here are some recommendations:

• Disable the web UI feature on your device if you do not need it. You can do this by using the `no ip http server` and `no ip http secure-server` commands in the CLI.
• Restrict access to the web UI feature by using access control lists (ACLs) or firewall rules. You should only allow trusted IP addresses or networks to access the web UI. You should also block any unauthorized or external access.
• Monitor your network for any suspicious activity. You should use network security tools such as intrusion detection systems (IDS), intrusion prevention systems (IPS), or security information and event management (SIEM) systems to detect and respond to any potential attacks.
• Report any information or evidence related to this vulnerability with CISA and Cisco to help them investigate and mitigate this threat.

How Can You Check If Your Device Is Affected?

To check if your device is affected by this vulnerability, you need to verify two things: the version of IOS XE software running on your device, and the status of the web UI feature on your device.

Check the version. Check the version of IOS XE software running on your device by using the `show version` command in the CLI. You should compare the output with the list of affected and fixed versions provided by Cisco in the security advisory.

Check the status of the web UI. To do this you use the `show ip http server status` and `show ip http secure-server status` commands in the CLI. You should look for any output that indicates that the web UI feature is enabled or listening on any port.

If your device is running an affected version of IOS XE software and has the web UI feature enabled, you should consider it vulnerable and take immediate action to protect it.

The vulnerability is evolving

On 10/18/2023 threat intelligencer Censys found over 40,000 vulnerable devices. On 10/21/2023 ONYPHE said its scanning found 1,214 unique compromised IP addresses. That is a 97% decrease nearly overnight. There are number of possible explanations for the rapid decline. Some have argued that the attach is evolving. CERT Orange Cyberdefense speculated it is “a potential trace cleaning step is underway [by the threat actor] to hide the implant.”

rb-

The Cisco IOS XE vulnerability is a serious security issue that affects many Cisco devices running on IOS XE software. You should patch your device as soon as possible because the attacker are evolving the exploit. The ability to hide the exploit will make this a long-term problem on many networks.

How you can help Ukraine!

Related article

• Exploit released for critical Cisco IOS XE flaw, many hosts still hacked (Bleeping Computer)

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.