‘Very regarding’: Cisco router vulnerabilities deliver broad dangers

The array of newly disclosed vulnerabilities in Cisco routers, together with 5 with a “crucial” severity ranking, have elevated cyber danger for companies of all sizes, cybersecurity executives informed VentureBeat.

Among the many vulnerabilities are three that include the very best potential severity ranking—together with a distant code execution (RCE) vulnerability and a flaw that permits distant customers to raise their privileges.

Whereas the 15 vulnerabilities have an effect on routers utilized by small and medium-sized companies (SMBs), companies massive and small are intertwined from a safety perspective in 2022. When an SMB doesn’t handle a serious safety problem comparable to this—due, as an illustration, to lack of sources—this may spill over into changing into an issue for the enterprises they do enterprise with.

“When SMBs get hacked, that may impression bigger organizations,” stated Matthew Warner, cofounder and chief know-how officer at Blumira, in an e mail.

Within the 2013 breach of Goal, as an illustration, the attackers reportedly gained their preliminary entry by hacking an HVAC contractor that had labored at Goal places. Moderately than going after Goal immediately, the attackers breached the presumably less-protected contractor—and leveraged that to get entry to Goal’s setting, Warner stated.

“It’s a standard assault mechanism for menace actors to focus on MSPs or different SMBs which have broad entry into a lot of different larger organizations for his or her entry alone,” he stated.

‘Vital’ flaws

This week, Cisco disclosed the 15 vulnerabilities which have been found in its RV160, RV260, RV340, and RV345 Sequence Routers. Cisco stated it has launched patches for the vulnerabilities, and that there are not any workarounds for the issues.

Three of the issues have been awarded the very best potential severity ranking—10.0:

• CVE-2022-20699 is a vulnerability within the SSL VPN module of Cisco Small Enterprise RV340, RV340W, RV345, and RV345P Twin WAN Gigabit VPN Routers. The flaw can permit an unauthenticated attacker to remotely execute code on a susceptible gadget, and will be exploited to accumulate root privileges, Cisco stated.
• CVE-2022-20700 is a vulnerability within the internet interface used to handle Cisco Small Enterprise RV Sequence Routers. The flaw can permit an attacker to remotely elevate their privileges to root, Cisco stated.
• CVE-2022-20708 is a vulnerability within the internet interface used to handle Cisco Small Enterprise RV340, RV340W, RV345, and RV345P Twin WAN Gigabit VPN Routers. The flaw can permit an unauthenticated attacker to remotely inject and execute instructions on the underlying Linux working system, Cisco stated.

The 2 different “crucial” vulnerabilities are CVE-2022-20703—which may permit an unauthenticated native consumer to put in malicious software program, and has a severity ranking of 9.3—and CVE-2022-20701, which carries a 9.0 ranking and is expounded to the distant privilege escalation vulnerability (CVE-2022-20700).

In its advisory, Cisco famous that among the many 15 vulnerabilities, some “are depending on each other. Exploitation of one of many vulnerabilities could also be required to take advantage of one other vulnerability.”

Enterprise danger

The vulnerabilities are “very regarding” on account of their severity and a number of assault vectors introduced, stated Tim Silverline, vice chairman of safety at Gluware, in an e mail.

Whereas SMBs that use the routers are probably the most immediately affected by the vulnerabilities, SMBs typically connect with enterprise companions through VPN tunnels, Silverline famous. “It may very well be one other entry level into [the enterprise] community if these connections will not be correctly secured,” he stated.

Thus, creating sturdy safety insurance policies on the enterprise border utilizing optimistic enforcement or zero belief applied sciences “might help to mitigate many of the danger that these kinds of connections would pose,” Silverline stated.

The disclosure comes at a time of notably excessive consideration on software program vulnerabilities, following the reveal of the RCE flaw in Apache Log4j, a broadly used Java logging part, in December. Different main vulnerabilities disclosed just lately have included “PwnKit,” which impacts a broadly put in Linux program—polkit’s pkexec—and will be simply exploited for native privilege escalation.