Cisco Warns of Vulnerability in IOS and IOS XE Software program After Exploitation Makes an attempt

Sep 29, 2023THNVulnerability / Community Safety

Cisco is warning of tried exploitation of a safety flaw in its IOS Software program and IOS XE Software program that would allow an authenticated distant attacker to realize distant code execution on affected methods.

The medium-severity vulnerability is tracked as CVE-2023-20109and has a CVSS rating of 6.6. It impacts all variations of the software program which have the GDOI or G-IKEv2 protocol enabled.

The corporate said the shortcoming “could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute arbitrary code on an affected device or cause the device to crash.”

It additional famous that the problem is the results of inadequate validation of attributes within the Group Area of Interpretation (GDOI) and G-IKEv2 protocols of the GET VPN function and it may very well be weaponized by both compromising an put in key server or modifying the configuration of a bunch member to level to a key server that’s managed by the attacker.

The vulnerability is alleged to have been found following an inside investigation and supply code audit initiated after an “attempted exploitation of the GET VPN feature.”

The revelation comes as Cisco detailed a set of 5 flaws in Catalyst SD-WAN Supervisor (variations 20.3 to twenty.12) that would permit an attacker to entry an affected occasion or trigger a denial of service (DoS) situation on an affected system –

• CVE-2023-20252 (CVSS rating: 9.8) – Unauthorized Entry Vulnerability
• CVE-2023-20253 (CVSS rating: 8.4) – Unauthorized Configuration Rollback Vulnerability
• CVE-2023-20034 (CVSS rating: 7.5) – Info Disclosure Vulnerability
• CVE-2023-20254 (CVSS rating: 7.2) – Authorization Bypass Vulnerability
• CVE-2023-20262 (CVSS rating: 5.3) – Denial-of-Service Vulnerability

Profitable exploitation of the bugs might permit the menace actor to achieve unauthorized entry to the appliance as an arbitrary person, bypass authorization and roll again controller configurations, entry the Elasticsearch database of an affected system, entry one other tenant managed by the identical occasion, and trigger a crash.

Clients are advisable to improve to a set software program launch to remediate the vulnerabilities.