Cisco Warns of Critical Vulnerability in End-of-Life Routers

Cisco has warned customers of a critical authentication bypass vulnerability with public exploit code impacting numerous close-of-lifestyle (EoL) VPN routers.

The security flaw (tracked CVE-2023-20025) has been found in the web-dependent administration interface of Cisco Smaller Business (SMB) RV016, RV042, RV042G and RV082 routers presented by Hou Liuyang of Qihoo 360 Netlab.

“[These vulnerabilities] could allow for a remote attacker to bypass authentication or execute arbitrary commands on the fundamental running technique of an influenced product,” Cisco wrote.

According to Bugcrowd CTO Casey Ellis, SMB routers are broadly deployed, and in a post-COVID hybrid/do the job-from-property environment, the new Cisco vulnerability could impression hundreds of gadgets.

“Branch places of work, [common operating environments], and even household workplaces are potential buyers of the susceptible item,” Ellis stated.

“Financially motivated attackers would be intrigued simply because of the uncooked quantity of these devices that are out there, and nation-states would most likely pay out attention mainly because of the dimension and criticality of opportunity users.”

Additional, the govt believes the vulnerability is also an eye-catching focus on from a technical place of check out.

“As an attacker, if you deal with to get RCE [remote code execution] on main routing or network infrastructure, your means to shift laterally boosts exponentially.”

Mike Parkin, a senior technological engineer at Vulcan Cyber, echoed Ellis’ position, introducing that the versions influenced by these vulnerabilities even now see reasonably widespread usage, however they are all formally EoL.

“The problem will be that these gadgets are usually discovered in little businesses with limited means or applied by people today who may well not have the price range to swap them,” Parkin warned.

“Unfortunately for them, Cisco is not going to resolve this, so anybody who even now has a single of these in service should strongly think about replacing them with a more recent kit quicker fairly than later on.”

Cisco verified it experienced not produced application updates to address the vulnerabilities and that no workarounds address these vulnerabilities.

The flaw comes weeks just after Krishna C. Tata, supervisor of security risk and architecture at Cisco, reviewed the difficulties of various security compliance frameworks.

Some areas of this post are sourced from:
www.infosecurity-journal.com