Vulnerability Scans for Older Cisco IOS Vulnerability / Opt-Out Headers, (Thu, Nov 5th)
This morning, I was browsing our honeypot data for any new and existing PHP exploit attempts. Instead, I first ran into some GeoServer exploits, but found them to be too boring to write up. This Cisco IOS exploit attempt was a bit more interesting. Still nothing new. I suspect this is for CVE-2023-20198.
Excerpt from the primary source: SANS Internet Storm Center
Who is affected
Home users · Enterprises · Security professionals
Affected technology: Cisco networking & security, IOS XE Web UI
Why it matters
CISA lists this as exploited in the wild. Unpatched Cisco networking & security and IOS XE Web UI systems are exposed to active attacks now.
Automated: stated only from CISA listings and the exploitation evidence in the sources below.
What you should do · Act now
Treat this as an emergency. Identify every system running Cisco networking & security and IOS XE Web UI, apply the vendor's fix or published mitigations immediately, and check for signs of compromise. Patching alone does not remove an attacker who already got in.
CISA's required action for CVE-2023-20198: "Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA." US federal civilian agencies must comply by October 20, 2023.
Automated guidance based on this story's classification. Check the linked advisories for specifics.
Sources
We link to original and authoritative sources. Headlines and excerpts belong to their publishers.
Related
Cisco, WatchGuard Release Patches; SonicWall Won’t Fix GMS Flaws
Cisco patched an RCE in UCS Central Software; WatchGuard fixed authentication and MitM flaws.
Apply the vendor's security update for SonicWall firewalls & SMA and Cisco networking & security.
Cisco Open Sources Quarry to Catch AI Agent Attacks Hidden in Harmless Steps
Cisco open sourced Project Quarry, a rule language for detecting AI agent attacks that only emerge across sequences of benign actions.
New Cisco firewall zero-day exploited to crash SSL VPN devices
Cisco released security updates to patch a denial-of-service zero-day in Adaptive Security Appliance (ASA) and Threat Defense (FTD) software that attackers are exploiting to remotely crash vulnerable firewall devices.
Source reporting says attackers are already exploiting this, so exposed Cisco networking & security systems are at immediate risk.
Treat this as an emergency.
NIK C2: The new AI-enabled command-and-control framework
Cisco Talos observed a new AI-integrated command-and-control (C2) framework in the wild called “NIK C2.”