Cisco discloses Vault 7 vulnerabilities

Internal analysis seems to have identified bug revealed by WikiLeaks

Cisco has identified a major vulnerability in its Cluster Management Protocol (CMP), which formed part of the WikiLeaks "Vault 7" document cache.

On 7 March, Omar Santos, principal engineer at Cisco's product security incident response team, published a blog post acknowledging that Cisco devices were among those allegedly targeted by the CIA.

At that time, little was known about the actual method of attack, other than it was a type of malware targeting multiple devices, including routers and switches, which allowed for the attacker to carry out data collection and exfiltration, HTML traffic redirection, DNS poisoning and other malicious actions.

Further analysis of the documents, though, has now enabled the company to identify what it thinks is the vulnerability in question.

Advertisement - Article continues below
Advertisement - Article continues below

In an update to the blog post, Santos said: "Based on the "Vault 7" public disclosure, Cisco launched an investigation into the products that could potentially be impacted by these and similar exploits and vulnerabilities.

"As part of the internal investigation of our own products and the publicly available information, Cisco security researchers found a vulnerability in the Cluster Management Protocol code in Cisco IOS and Cisco IOS XE Software that could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges."

In a security advisory, the company explained that the vulnerability, which affects scores of devices, is due to the fact the Cluster Management Protocol (CMP) uses Telnet internally.

According to the company, there are two factors that combine to create the problem:

  • A failure to restrict the use of CMP-specific Telnet options only to internal, local communications between cluster members and instead accept and process them over any Telnet connection to an affected device;
  • Incorrect processing of malformed CMP-specific Telnet options

"An attacker could exploit this vulnerability by sending malformed CMP-specific Telnet options while establishing a Telnet session with an affected Cisco device configured to accept Telnet connections. An exploit could allow an attacker to execute arbitrary code and obtain full control of the device or cause a reload of the affected device," the company explained.

Advertisement - Article continues below

Unfortunately there is, for now, no patch or workaround per se. Cisco has advised users that disabling the Telnet protocol for incoming connections and using SSH would mitigate the risk. This is the approach recommended by the company.

Cisco does recognise, however, that this approach may not be acceptable to all, or indeed may be impossible for some. In this case, the company advises implementing infrastructure access control lists.

The advisory, including a list of all affected deviced, can be found in full here.

Featured Resources

Digitally perfecting the supply chain

How new technologies are being leveraged to transform the manufacturing supply chain

Download now

Three keys to maximise application migration and modernisation success

Harness the benefits that modernised applications can offer

Download now

Your enterprise cloud solutions guide

Infrastructure designed to meet your company's IT needs for next-generation cloud applications

Download now

The 3 approaches of Breach and Attack Simulation technologies

A guide to the nuances of BAS, helping you stay one step ahead of cyber criminals

Download now


internet security

Avast and AVG extensions pulled from Chrome

19 Dec 2019

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019
software-defined wide area network (SD-WAN)

What is SD-WAN?

18 Sep 2019
Network & Internet

What to expect from Cisco Live 2019

10 Jun 2019

Most Popular

operating systems

17 Windows 10 problems - and how to fix them

13 Jan 2020
mergers and acquisitions

Xerox to nominate directors to HP's board – reports

22 Jan 2020
Microsoft Windows

What to do if you're still running Windows 7

14 Jan 2020
web browser

What is HTTP error 503 and how do you fix it?

7 Jan 2020