Attackers have exploited a recently disclosed critical zero-day bug to compromise and infect thousands of Cisco IOS XE devices with malicious implants.
According to threat intelligence company VulnCheck, the maximum severity vulnerability (CVE-2023-20198) has been extensively exploited in attacks targeting Cisco IOS XE routers and switches with the Web User Interface (Web UI) feature enabled, that also have the HTTP or HTTPS Server feature toggled on.
VulnCheck scanned internet-facing Cisco IOS XE web interfaces and discovered thousands of compromised and infected hosts. The company has also released a scanner to detect these implants on affected devices.
“This is a bad situation, as privileged access on the IOS XE likely allows attackers to monitor network traffic, pivot into protected networks, and perform any number of man-in-the-middle attacks,” according to VulnCheck CTO Jacob Baines.
“If your organization uses an IOS XE system, it’s imperative that you determine if your systems have been compromised and take appropriate action once implants have been discovered.
“While a patch is not yet available, you can protect your organization by disabling the web interface and removing all management interfaces from the internet immediately.”
Cisco: Apply mitigation measures and look for breach indicators
On Monday, Cisco disclosed that unauthenticated attackers can exploit the IOS XE zero-day to gain full administrator privileges and take complete control over affected Cisco routers and switches remotely.
The company cautioned administrators to disable the vulnerable HTTP server feature on all internet-facing systems until a patch becomes available.
Cisco detected the CVE-2023-20198 attacks in late September following reports of unusual behavior on a customer device received by Cisco’s Technical Assistance Center (TAC). Evidence of these attacks dates back to September 18, when the attackers were observed creating local user accounts named “cisco_tac_admin” and “cisco_support.”
Moreover, the attackers deployed malicious implants, enabling them to execute arbitrary commands at the system or IOS levels on compromised devices.
“We assess that these clusters of activity were likely carried out by the same actor. Both clusters appeared close together, with the October activity appearing to build off the September activity,” Cisco said.
“The first cluster was possibly the actor’s initial attempt and testing their code, while the October activity seems to show the actor expanding their operation to include establishing persistent access via deployment of the implant.”
The company also issued a “strong recommendation” for administrators to look for suspicious or recently created user accounts as potential signs of malicious activity linked to this threat.
In September, Cisco cautioned customers to patch another zero-day vulnerability (CVE-2023-20109) in its IOS and IOS XE software, targeted by attackers in the wild.