Cisco reveals exploit code is publicly available for critical switch vulnerabilities
Attackers could target UI vulnerabilities in Cisco switches to execute malicious code
Cisco has released patches for nine vulnerabilities impacting its small business network switches and said that exploit code has been spotted in the wild.
The vulnerabilities have been found in the user interface (UI) of Cisco Small Business Series switches and could be exploited by attackers to execute arbitrary code on a victim’s switch, or cause a denial of service (DoS) on a business’ network.
Four of the nine vulnerabilities were rated ‘critical’ on the CVSSv3 severity scale, each receiving a near-maximum score of 9.8.
The remaining flaws received scores between 7.5 and 8.6.
The critical flaws - tracked as CVE-2023-20159, CVE-2023-20160, CVE-2023-20161, and CVE-2023-20189 - stem from improper validation of requests sent through the web-based UI for the switches, which could allow an attacker to run malicious code via custom requests.
Five high-risk flaws also stem from the same UI issue and allow for individual devices to become subject to a DoS.
It’s recommended that affected organizations install the fixes as quickly as possible given the potential security risk and that exploit code exists online. There are no known workarounds that can mitigate the vulnerabilities.
Cisco did not indicate whether successful attacks have already taken place.
RELATED RESOURCE
Quantifying the public vulnerability market: 2022 edition
An analysis of vulnerability disclosures, impact severity, and product analysis
A number of Cisco’s Smart Switches, Series Managed Switches, and Series Stackable Switches are affected by the flaws with a full list available on the company’s official advisory.
Its 220 and Business 220 Series Smart Switches were found to be unaffected.
Cisco said it will not be releasing updates for the Small Business 200 Series Smart Switches, Small Business 300 Series Managed Switches, or Small Business 500 Series Stackable Managed Switches as all of these products have gone end of life (EOL) and are no longer supported by updates.
EOL notices for the relevant products were published in 2018 and 2019, with businesses having had the years since to move away from the soon-to-be-obsolete switches.
Given the prevalence of Cisco’s hardware in organizations’ networks worldwide, critical vulnerabilities of this kind should be taken seriously and patched as soon as possible.
Cisco small business switches have faced security challenges in the past, with three major vulnerabilities having been found in 2019, a year that also saw the networking and enterprise cyber security firm wrangle with a flaw known as Thrangycat.
Coupled with another flaw, Thrangycat could be used to bypass Cisco’s TAm security controls and remotely seize control of a router or potentially compromise an entire network.
-
NCSC warns vibe coding poses a major risk to businessesNews Vulnerability management approaches are not maturing fast enough to keep up with the downsides of AI-generated code
-
How to achieve cyber resilience today, tomorrow, and beyondResilience in the event of an attack is a business need, not a nice-to-have
-
Ubuntu vulnerability exposes enterprises to root escalation, complete system compromiseNews The high-severity Ubuntu vulnerability allows an unprivileged local attacker to escalate privileges through the interaction of two standard system components
-
CISOs are keen on agentic AI, but they’re not going all-in yetNews Many security leaders face acute talent shortages and are looking to upskill workers
-
Security agencies issue warning over critical Cisco Catalyst SD-WAN vulnerabilityNews Threat actors have been exploiting the vulnerability to achieve root access since 2023
-
Millions of developers could be impacted by flaws in Visual Studio Code extensions – here's what you need to know and how to protect yourselfNews The VS Code vulnerabilities highlight broader IDE security risks, said OX Security
-
CVEs are set to top 50,000 this year, marking a record high – here’s how CISOs and security teams can prepare for a looming onslaughtNews While the CVE figures might be daunting, they won't all be relevant to your organization
-
Microsoft patches six zero-days targeting Windows, Word, and more – here’s what you need to knowNews Patch Tuesday update targets large number of vulnerabilities already being used by attackers
-
AI is “forcing a fundamental shift” in data privacy and governanceNews Organizations are working to define and establish the governance structures they need to manage AI responsibly at scale – and budgets are going up
-
Experts welcome EU-led alternative to MITRE's vulnerability tracking schemeNews The EU-led framework will reduce reliance on US-based MITRE vulnerability reporting database
