Cisco warns of IOS XE zero-day actively exploited in attacks

Cisco has discovered a vulnerability in the web UI feature of Cisco IOS XE Software. This vulnerability allows remote attackers to create an account with high privileges on an affected system. They can then use this account to take control of the system.

For steps to close the attack vector for this vulnerability, see the recommendations section of this advisory. Cisco will provide updates on the status of this investigation and when a software patch is available.

• Cyber Attack

DESCO faces cyber attack: Customers Data Breach

By infosecbulletin / Tuesday , September 17 2024

A recent dark web scan revealed that customer data from Dhaka Electric Supply Company Limited (DESCO) has been exposed. The...

Read More

• Cyber Attack
• Vulnerabilities

Alert! Google Fixes GCP Composer Flaw

By infosecbulletin / Monday , September 16 2024

Tenable Research found and fixed a remote code execution (RCE) vulnerability, called CloudImposer, in Google Cloud Platform (GCP). This flaw...

Read More

• National

CTF in Bangladesh: Unveiling Challenges, Opportunities and remedies

By infosecbulletin / Sunday , September 15 2024

In this article, we won’t dive too deep into the technical aspects of Capture The Flag (CTF) competitions. Instead, we...

Read More

• Uncategorized

Bitdefender blog post
Medusa target Fortinet flaw (CVE-2023-48788) for Ransomware Attacks

By infosecbulletin / Sunday , September 15 2024

A recent Bitdefender report reveals that Medusa is still actively attacking and has created a notable presence on both the...

Read More

• Vulnerabilities

Ivanti alerts ongoing exploitation of recently patched CAV

By infosecbulletin / Saturday , September 14 2024

Ivanti warned that a recently fixed security flaw in its Cloud Service Appliance (CSA) is being actively exploited. CVE-2024-8190 is...

Read More

• Uncategorized

CISA unveils 25 new advisories for Industrial Control Systems

By infosecbulletin / Saturday , September 14 2024

CISA issued 25 ICS advisories on September 12, 2024, detailing current security issues, vulnerabilities, and exploits in Industrial Control Systems....

Read More

• Vulnerabilities

Intel Issues Alert on 20+ Vulnerabilities, Urges Firmware Updates

By infosecbulletin / Friday , September 13 2024

Intel announced over 20 vulnerabilities in its processors and products in security advisories released on Tuesday. The chip giant has...

Read More

• Vulnerabilities

Urgent: GitLab Patches flaws allowing unapproved pipeline Job Execution

By infosecbulletin / Friday , September 13 2024

GitLab released security updates on Wednesday to fix 17 vulnerabilities, including a critical issue that lets attackers run pipeline jobs...

Read More

• Cyber Attack

Fortinet admits data breach after hacker claims to steal 440GB

By infosecbulletin / Friday , September 13 2024

Fortinet confirmed a data breach after a threat actor claimed to have stolen 440GB of files from its Microsoft SharePoint...

Read More

• Alert
• Vulnerabilities

Gov.t issues high alert on android devices

By infosecbulletin / Thursday , September 12 2024

Indian Computer Emergency Response Team (CERT-In) issued a high-severity alert for android devices on September 11, 2024 highlighting the vulnerabilities...

Read More

This advisory is available at the following link:

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z

Affected Products Vulnerable Products

This vulnerability affects Cisco IOS XE Software if the web UI feature is enabled. The web UI feature is enabled through the ip http server or ip http secure-server commands.

To read the full report click here