Cisco Zero-Day Exploited to Implant Malicious Lua Backdoor on Thousands of Devices

Cisco has warned of a new zero-working day flaw in IOS XE that has been actively exploited by an not known threat actor to deploy a malicious Lua-primarily based implant on vulnerable devices.

Tracked as CVE-2023-20273 (CVSS rating: 7.2), the issue relates to a privilege escalation flaw in the web UI aspect and is explained to have been utilized alongside CVE-2023-20198 as component of an exploit chain.

“The attacker to start with exploited CVE-2023-20198 to achieve preliminary access and issued a privilege 15 command to create a area person and password mix,” Cisco explained in an updated advisory released Friday. “This allowed the person to log in with usual consumer obtain.”

“The attacker then exploited one more element of the web UI function, leveraging the new community person to elevate privilege to root and write the implant to the file method,” a shortcoming that has been assigned the identifier CVE-2023-20273.

A Cisco spokesperson informed The Hacker Information that a repair that addresses both vulnerabilities has been determined and will be manufactured available to shoppers starting up October 22, 2023. In the interim, it truly is encouraged to disable the HTTP server attribute.

When Cisco has previously outlined that a now-patched security flaw in the very same software package had been exploited to set up the backdoor, the enterprise assessed the vulnerability to be no lengthier associated with the activity in mild of the discovery of the new zero-working day.

“An unauthenticated distant actor could exploit these vulnerabilities to consider regulate of an affected process,” the U.S. Cybersecurity and Infrastructure Security Agency (CISA) reported. “Precisely, these vulnerabilities allow the actor to produce a privileged account that provides entire manage over the device.”

Prosperous exploitation of the bugs could make it possible for attackers to gain unfettered distant entry to routers and switches, watch network targeted visitors, inject and redirect network traffic, and use it as a persistent beachhead to the network thanks to the lack of safety alternatives for these devices.

The progress comes as additional 41,000 Cisco products jogging the susceptible IOS XE software package are believed to have been compromised by danger actors using the two security flaws, for every info from Censys and LeakIX.

“On Oct 19, the amount of compromised Cisco devices has ebbed to 36,541,” the attack surface administration business said. “The key targets of this vulnerability are not massive companies but more compact entities and individuals.”

Identified this write-up exciting? Adhere to us on Twitter  and LinkedIn to examine more special material we post.

Some parts of this article are sourced from:
thehackernews.com