Cisco discloses Vault 7 vulnerabilities

Internal analysis seems to have identified bug revealed by WikiLeaks

Cisco has identified a major vulnerability in its Cluster Management Protocol (CMP), which formed part of the WikiLeaks "Vault 7" document cache.

On 7 March, Omar Santos, principal engineer at Cisco's product security incident response team, published a blog post acknowledging that Cisco devices were among those allegedly targeted by the CIA.

Advertisement - Article continues below

At that time, little was known about the actual method of attack, other than it was a type of malware targeting multiple devices, including routers and switches, which allowed for the attacker to carry out data collection and exfiltration, HTML traffic redirection, DNS poisoning and other malicious actions.

Further analysis of the documents, though, has now enabled the company to identify what it thinks is the vulnerability in question.

In an update to the blog post, Santos said: "Based on the "Vault 7" public disclosure, Cisco launched an investigation into the products that could potentially be impacted by these and similar exploits and vulnerabilities.

"As part of the internal investigation of our own products and the publicly available information, Cisco security researchers found a vulnerability in the Cluster Management Protocol code in Cisco IOS and Cisco IOS XE Software that could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges."

Advertisement - Article continues below
Advertisement - Article continues below

In a security advisory, the company explained that the vulnerability, which affects scores of devices, is due to the fact the Cluster Management Protocol (CMP) uses Telnet internally.

According to the company, there are two factors that combine to create the problem:

  • A failure to restrict the use of CMP-specific Telnet options only to internal, local communications between cluster members and instead accept and process them over any Telnet connection to an affected device;
  • Incorrect processing of malformed CMP-specific Telnet options

"An attacker could exploit this vulnerability by sending malformed CMP-specific Telnet options while establishing a Telnet session with an affected Cisco device configured to accept Telnet connections. An exploit could allow an attacker to execute arbitrary code and obtain full control of the device or cause a reload of the affected device," the company explained.

Unfortunately there is, for now, no patch or workaround per se. Cisco has advised users that disabling the Telnet protocol for incoming connections and using SSH would mitigate the risk. This is the approach recommended by the company.

Cisco does recognise, however, that this approach may not be acceptable to all, or indeed may be impossible for some. In this case, the company advises implementing infrastructure access control lists.

The advisory, including a list of all affected deviced, can be found in full here.

Featured Resources

The case for a marketing content hub

Transform your digital marketing to deliver customer expectations

Download now

Fast, flexible and compliant e-signatures for global businesses

Be at the forefront of digital transformation with electronic signatures

Download now

Why CEOS should care about the move to SAP S/4HANA

And how they can accelerate business value

Download now

IT faces new security challenges in the wake of COVID-19

Beat the crisis by learning how to secure your network

Download now



K2View innovates in data management with new encryption patent

28 May 2020
video conferencing

Zoom 5.0 adds 256-bit encryption to address security concerns

23 Apr 2020

WhatsApp flaw leaves users open to 'shoulder surfing' attacks

21 Apr 2020
cyber security

Microsoft AI can detect security flaws with 99% accuracy

20 Apr 2020

Most Popular

Microsoft Windows

Microsoft warns users not to install Windows 10's May update

28 May 2020
Server & storage

Dell EMC PowerEdge R7525 review: An EPYC core density to make Intel weep

26 May 2020
Network & Internet

Intel releases Wi-Fi and Bluetooth driver updates for Windows 10

26 May 2020