Researchers have found that a recently disclosed vulnerability in Cisco IOS XE has already rendered thousands of compromised devices.
An authentication bypass affecting Cisco IOS X was disclosed on October 16, 2023. Researchers have found since then that the vulnerability is widely being exploited in the wild to help install implants on affected switches and routers.
Cisco IOS XE is a universally deployed Internetworking Operating System (IOS) that enables model-driven programmability, application hosting, and configuration management, helping to automate day-to-day tasks.
The Common Vulnerabilities and Exposures (CVE) database lists publicly disclosed computer security flaws. The vulnerability at hand is listed as:
CVE-2023-20198 (CVSS score 10 out of 10: Cisco is aware of active exploitation of a previously unknown vulnerability in the web UI feature of Cisco IOS XE Software when exposed to the internet or to untrusted networks. This vulnerability allows a remote, unauthenticated attacker to create an account on an affected system with privilege level 15 access. The attacker can then use that account to gain control of the affected system.
What Cisco failed to mention was that thousands of internet-facing IOS XE systems have been implanted. The researchers scanned internet-facing Cisco IOS XE web interfaces and found thousands of implanted hosts.
Cisco has also yet to publish a list of affected devices, but if you are using Cisco switches, routers or Wireless LAN Controllers, you should assume they are vulnerable.
The implants that were found enable the attacker to communicate with the compromised device and use that ability to monitor web traffic, perform lateral movement in the network, or use them for a machine-in-the-middle attack.
The Cisco Talos team discovered there were malicious activities correlated with this vulnerability as early as September 18, 2023.
Mitigation
This vulnerability affects Cisco IOS XE Software if the web UI feature is enabled. The web UI feature is enabled through the ip http server or ip http secure-server commands.
To determine whether the HTTP Server feature is enabled for a system, log in to the system and use the show running-config | include ip http server|secure|active command in the CLI to check for the presence of the ip http server command or the ip http secure-server command in the global configuration. If either command is present, the HTTP Server feature is enabled for the system.
Cisco strongly recommends that customers disable the HTTP Server feature on all internet-facing systems. To disable the HTTP Server feature, use the no ip http server or no ip http secure-server command in global configuration mode. If both the HTTP server and HTTPS server are in use, both commands are required to disable the HTTP Server feature.
While a patch is not yet available, it is advisable to protect your organization by disabling the web interface and removing all management interfaces from the internet immediately. Which is always good advice.
The Cybersecurity & Infrastructure Security Agency (CISA) has added the vulnerability to its Known Exploited Vulnerabilities Catalog, based on the evidence of active exploitation. This means all Federal Civilian Executive Branch Agencies (FCEB) have to verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 (Mitigating the Risk from Internet-Exposed Management Interfaces) and apply mitigations per Cisco’s instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), organizations must follow Cisco’s instructions to determine if a system may have been compromised and immediately report positive findings to CISA before October 20,2023.
Organizations should look for unexplained or newly created users on devices as evidence of potentially malicious activity relating to this threat. One method to identify if the implant is present is to run the following command against the device, where the “{DEVICEIP}” portion is a placeholder for the IP address of the device to check:
curl -k -X POST “https://{DEVICEIP}/webui/logoutconfirm.html?logon_hash=1”
Note: The above check should use the HTTP scheme if the device is only configured for an insecure web interface. If the request returns a hexadecimal string, the implant is present.
We don’t just report on vulnerabilities—we identify them, and prioritize action.
Cybersecurity risks should never spread beyond a headline. Keep vulnerabilities in tow by using Malwarebytes Vulnerability and Patch Management.