Cisco discloses Vault 7 vulnerabilities

Internal analysis seems to have identified bug revealed by WikiLeaks

Cisco has identified a major vulnerability in its Cluster Management Protocol (CMP), which formed part of the WikiLeaks "Vault 7" document cache.

On 7 March, Omar Santos, principal engineer at Cisco's product security incident response team, published a blog post acknowledging that Cisco devices were among those allegedly targeted by the CIA.

At that time, little was known about the actual method of attack, other than it was a type of malware targeting multiple devices, including routers and switches, which allowed for the attacker to carry out data collection and exfiltration, HTML traffic redirection, DNS poisoning and other malicious actions.

Further analysis of the documents, though, has now enabled the company to identify what it thinks is the vulnerability in question.

In an update to the blog post, Santos said: "Based on the "Vault 7" public disclosure, Cisco launched an investigation into the products that could potentially be impacted by these and similar exploits and vulnerabilities.

"As part of the internal investigation of our own products and the publicly available information, Cisco security researchers found a vulnerability in the Cluster Management Protocol code in Cisco IOS and Cisco IOS XE Software that could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges."

In a security advisory, the company explained that the vulnerability, which affects scores of devices, is due to the fact the Cluster Management Protocol (CMP) uses Telnet internally.

According to the company, there are two factors that combine to create the problem:

  • A failure to restrict the use of CMP-specific Telnet options only to internal, local communications between cluster members and instead accept and process them over any Telnet connection to an affected device;
  • Incorrect processing of malformed CMP-specific Telnet options

"An attacker could exploit this vulnerability by sending malformed CMP-specific Telnet options while establishing a Telnet session with an affected Cisco device configured to accept Telnet connections. An exploit could allow an attacker to execute arbitrary code and obtain full control of the device or cause a reload of the affected device," the company explained.

Unfortunately there is, for now, no patch or workaround per se. Cisco has advised users that disabling the Telnet protocol for incoming connections and using SSH would mitigate the risk. This is the approach recommended by the company.

Cisco does recognise, however, that this approach may not be acceptable to all, or indeed may be impossible for some. In this case, the company advises implementing infrastructure access control lists.

The advisory, including a list of all affected deviced, can be found in full here.

Featured Resources

How virtual desktop infrastructure enables digital transformation

Challenges and benefits of VDI

Free download

The Okta digital trust index

Exploring the human edge of trust

Free download

Optimising workload placement in your hybrid cloud

Deliver increased IT agility with the cloud

Free Download

Modernise endpoint protection and leave your legacy challenges behind

The risk of keeping your legacy endpoint security tools

Download now

Recommended

The IT Pro Podcast: Can 5G close the digital divide?
5G

The IT Pro Podcast: Can 5G close the digital divide?

6 Aug 2021
Cisco launches Webex for Defense for the Pentagon
Software

Cisco launches Webex for Defense for the Pentagon

7 Jul 2021
Cisco flaw under attack after researchers publish exploit PoC
exploits

Cisco flaw under attack after researchers publish exploit PoC

28 Jun 2021
Cisco bolsters Webex for the hybrid workforce
video conferencing

Cisco bolsters Webex for the hybrid workforce

9 Jun 2021

Most Popular

How to move Microsoft's Windows 11 from a hard drive to an SSD
Microsoft Windows

How to move Microsoft's Windows 11 from a hard drive to an SSD

4 Jan 2022
How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

6 Jan 2022
Microsoft Exchange servers break thanks to 'Y2K22' bug
email delivery

Microsoft Exchange servers break thanks to 'Y2K22' bug

4 Jan 2022