Cisco warned customers today of four critical remote code execution vulnerabilities with public exploit code affecting multiple Small Business Series Switches.
All four security flaws received almost maximum severity ratings with CVSS base scores of 9.8/10. Successful exploitation allows unauthenticated attackers to execute arbitrary code with root privileges on compromised devices.
The vulnerabilities—tracked as CVE-2023-20159, CVE-2023-20160, CVE-2023-20161, and CVE-2023-20189—are caused by improper validation of requests sent to the targeted switches’ web interfaces.
Attackers can exploit them via maliciously crafted requests sent through targeted devices’ web-based user interfaces in low-complexity attacks that don’t require user interaction.
“The vulnerabilities are not dependent on one another. Exploitation of one of the vulnerabilities is not required to exploit another vulnerability,” Cisco explained.
“In addition, a software release that is affected by one of the vulnerabilities may not be affected by the other vulnerabilities.”
The list of affected Cisco switches includes:
- 250 Series Smart Switches, 350 Series Managed Switches, 350X Series Stackable Managed Switches, and 550X Series Stackable Managed Switches (fixed in firmware version 2.5.9.16)
- Business 250 Series Smart Switches and Business 350 Series Managed Switches (fixed in firmware version 3.3.0.16)
- Small Business 200 Series Smart Switches, Small Business 300 Series Managed Switches, Small Business 500 Series Stackable Managed Switches (no patch available)
Cisco says that the 200, 300, and 500 Series Small Business Switches firmware will not be patched because these devices have already entered the end-of-life process.
The Cisco Product Security Incident Response Team (PSIRT) also revealed that proof-of-concept exploit code is available for these security flaws, which could lead to active exploitation if motivated threat actors create their own
The company warned on Wednesday that its Product Security Incident Response Team (PSIRT) is “aware that proof-of-concept exploit code is available” for these security flaws, which could allow threat actors to target vulnerable devices exposed to remote access.
However, luckily, Cisco’s PSIRT is yet to find evidence suggesting attempts to exploit the vulnerabilities in attacks.
Cisco is also working on patching a cross-site scripting (XSS) vulnerability in its Prime Collaboration Deployment (PCD) server management tool, reported by Pierre Vivegnis of NATO’s Cyber Security Centre (NCSC).
A joint advisory released by US, UK, and Cisco recently warned that APT28 Russian military hackers have been deploying custom ‘Jaguar Tooth’ malware on Cisco IOS routers to gain unauthenticated access to compromised devices.