Get in Touch
Indiscriminate, opportunistic targeting.
Cisco has disclosed several security vulnerabilities within their latest patch release.
Firstly, a Cisco zero-day flaw in the IOS and IOS XE software has been actively exploited by threat actors in the wild. The vulnerability, tracked as CVE-2023-20109 (CVSS v3.1: 6.6), has originated from an inadequate attribute validation within the Group Domain of Interpretation (GDOI) and G-IKEv2 protocols of the GET VPN feature. Exploitation requires threat actors to have administrator privileges with control of a key server or a group member. Regardless of the required access for exploitation, threat actors have initiated attack campaigns, leveraging the security issue.
Five Cisco Catalyst SD-WAN Manager products’ vulnerabilities have also been discovered. CVE-2023-20252 (CVSS v3.1: 9.8) is the most serious of this category of flaws, successful exploitation of which could provide a threat actor with unauthorised access to the affected product as a result of Security Assertion Markup Language (SAML) API issues.
The remaining four have been classified with a lower severity level rating:
- CVE-2023-20253 (CVSS v3.1: 8.4): Unauthorised configuration rollback due to CLI vulnerabilities
- CVE-2023-20034 (CVSS v3.1: 7.5): Information disclosure vulnerability in Elasticsearch access control
- CVE-2023-20254 (CVSS v3.1: 7.2): Authorisation bypass in the session management system
- CVE-2023-20262 (CVSS v3.1: 5.3): DoS vulnerability in the SSH service
Successful exploitation of CVE-2023-20109 could allow a threat actor to execute arbitrary code and gain full control of the affected system or cause the affected system to reload, resulting in a denial-of-service (DoS) condition
Successful exploitation of CVE-2023-20252, CVE-2023-20253, CVE-2023-20034, CVE-2023-20254 and CVE-2023-20262 could allow an unauthenticated, remote threat actor to obtain unauthorised access to the application as an arbitrary user
Security patches for these vulnerabilities have been released by Cisco. Previous product versions therefore remain vulnerable to potential exploitation.
- CVE-2023-20109: All Cisco products running a vulnerable IOS or IOS XE software version with either the GDOI or G-IKEv2 protocol enabled
- CVE-2023-20252, CVE-2023-20253, CVE-2023-20034, CVE-2023-20254 and CVE-2023-20262: Cisco Catalyst SD-WAN Manager
Containment, Mitigations & Remediations
It is strongly recommended that users of the affected product version apply the latest available security patches as soon as possible. A list of the patches correlating to each of the vulnerabilities reported on can be found within the following Cisco Advisories:
Indicators of Compromise
No specific Indicators of Compromise (IoCs) are available currently.
Cisco occupies a significant proportion of the enterprise network infrastructure market share. Given that threat actors generally utilise a combination of probability and asset value to determine which attack surfaces to focus on, Cisco products have become a prime target. Due to the fact that Cisco products have become an integral aspect of business operations, threat actors will continue to exploit vulnerabilities contained within the associated products in an attempt to extract the sensitive data contained therein.
No attribution to specific threat actors or groups has been identified at the time of writing.
TA0001 – Initial Access
TA0002 – Execution