Cisco warns of critical switch bugs with public exploit code

Cisco warned customers today of four critical remote code execution vulnerabilities with public exploit code affecting multiple Small Business Series Switches.

All four security flaws received almost maximum severity ratings with CVSS base scores of 9.8/10. Successful exploitation allows unauthenticated attackers to execute arbitrary code with root privileges on compromised devices.

The vulnerabilities—tracked as CVE-2023-20159, CVE-2023-20160, CVE-2023-20161, and CVE-2023-20189—are caused by improper validation of requests sent to the targeted switches' web interfaces.

Attackers can exploit them via maliciously crafted requests sent through targeted devices' web-based user interfaces in low-complexity attacks that don't require user interaction.

"The vulnerabilities are not dependent on one another. Exploitation of one of the vulnerabilities is not required to exploit another vulnerability," Cisco explained.

"In addition, a software release that is affected by one of the vulnerabilities may not be affected by the other vulnerabilities."

The list of affected Cisco switches includes:

Cisco says that the 200, 300, and 500 Series Small Business Switches firmware will not be patched because these devices have already entered the end-of-life process.

The Cisco Product Security Incident Response Team (PSIRT) also revealed that proof-of-concept exploit code is available for these security flaws, which could lead to active exploitation if motivated threat actors create their own

The company warned on Wednesday that its Product Security Incident Response Team (PSIRT) is "aware that proof-of-concept exploit code is available" for these security flaws, which could allow threat actors to target vulnerable devices exposed to remote access.

However, luckily, Cisco's PSIRT is yet to find evidence suggesting attempts to exploit the vulnerabilities in attacks.

Cisco is also working on patching a cross-site scripting (XSS) vulnerability in its Prime Collaboration Deployment (PCD) server management tool, reported by Pierre Vivegnis of NATO's Cyber Security Centre (NCSC).

A joint advisory released by US, UK, and Cisco recently warned that APT28 Russian military hackers have been deploying custom 'Jaguar Tooth' malware on Cisco IOS routers to gain unauthenticated access to compromised devices.

Cisco won't fix zero-day RCE vulnerability in end-of-life VPN routers

New PaperCut RCE exploit created that bypasses existing detections

Cisco phone adapters vulnerable to RCE attacks, no fix available

VMware fixes critical vulnerabilities in vRealize network analytics tool

Zyxel shares tips on protecting firewalls from ongoing attacks