Thursday , July 3 2025

Thousand Cisco devices hacked in IOS XE zero-day attacks

Orange’s CERT Coordination Center discovered over 34.5K Cisco IOS XE devices compromised in CVE-2023-20198 attacks. Hackers have used a newly discovered and very serious software vulnerability to hack and infect more than 10,000 Cisco IOS XE devices with harmful software.

VulnCheck, a threat intelligence company, reported that a severe vulnerability (CVE-2023-20198) is being actively exploited in attacks on Cisco IOS XE systems with the Web User Interface (Web UI) enabled and the HTTP or HTTPS Server feature turned on.

CYDES 2025 Reinforces Malaysia’s Vision of Secure and Trusted Digital Nation

The final day of the Cyber Defence & Security Exhibition and Conference (CYDES) 2025 concluded with high-impact engagements at the...
Read More
CYDES 2025 Reinforces Malaysia’s Vision of Secure and Trusted Digital Nation

Cisco alerts that Unified CM has hardcoded root SSH credentials

Cisco warns that a vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition...
Read More
Cisco alerts that Unified CM has hardcoded root SSH credentials

CYDES 2025
MCSS to implement 6 strategic goals with 7 objectives over 6 year: NACSA Chief

The second day of the Cyber Defence & Security Exhibition and Conference (CYDES) 2025 further cemented Malaysia’s position as a...
Read More
CYDES 2025  MCSS to implement 6 strategic goals with 7 objectives over 6 year: NACSA Chief

CYDES 2025
Malaysia placed cybersecurity heart of the regional agenda: DPM Ahmad Zahid

Malaysia's Deputy Prime Minister Datuk Seri Dr. Ahmad Zahid Hamidi said that Malaysia has placed cybersecurity at the heart of...
Read More
CYDES 2025  Malaysia placed cybersecurity heart of the regional agenda: DPM Ahmad Zahid

Amid Meta moves; OpenAI is largely shutting down next week: Wired

Mark Chen, the chief research officer at OpenAI, sent a forceful memo to staff on Saturday, promising to go head-to-head...
Read More
Amid Meta moves; OpenAI is largely shutting down next week: Wired

Canada orders Hikvision to close operations over national security

The Canadian government ordered Hikvision to stop all operations in the country due to national security concerns. Hikvision, based in...
Read More
Canada orders Hikvision to close operations over national security

First couple “Rosie” to conceive using AI tech “STAR” successfully

Doctors at Columbia University Fertility Center have reported what they are calling the first pregnancy using a new AI system,...
Read More
First couple “Rosie” to conceive using AI tech “STAR” successfully

Scattered Spider Actively Attacking Aviation and Transportation: FBI

Cybersecurity experts and federal authorities are warning that the Scattered Spider hackers are now targeting aviation and transportation, indicating a...
Read More
Scattered Spider Actively Attacking Aviation and Transportation: FBI

Russia’s restrictions on Cloudflare making websites inaccessible

Since June 9, 2025, Russian users connecting to Cloudflare services have faced throttling by ISPs. As the throttling is being...
Read More
Russia’s restrictions on Cloudflare making websites inaccessible

61 million Verizon records allegedly posted online for sale

A new report from SafetyDetectives reveals that hackers posted a massive 3.1GB dataset online, containing about 61 million records reportedly...
Read More
61 million Verizon records allegedly posted online for sale

VulnCheck found many infected hosts on internet-facing Cisco IOS XE web interfaces. The company also developed a scanner to identify these infections on affected devices.

“Cisco buried the lede by not mentioning thousands of internet-facing IOS XE systems have been implanted. This is a bad situation, as privileged access on the IOS XE likely allows attackers to monitor network traffic, pivot into protected networks, and perform any number of man-in-the-middle attacks,” said VulnCheck CTO Jacob Baines
.
“If your organization uses an IOS XE system, it’s imperative that you determine if your systems have been compromised and take appropriate action once implants have been discovered. While a patch is not yet available, you can protect your organization by disabling the web interface and removing all management interfaces from the internet immediately.”

VulnCheck has fingerprinted approximately 10,000 implanted systems, but we’ve only scanned approximately half of the devices listed on Shodan/Censys. We didn’t want to commit to a specific number as it’s evolving (increasing) as we continue our activities,” Baines told BleepingComputer.

A Shodan search for Cisco devices with their Web UI enabled (shared by Aves Netsec CEO Simo Kohonen) currently shows more than 140,000 Internet-exposed devices.

 

  Source: Bleepingcomputer

Cisco: Apply mitigation measures and look for breach indicators

On Monday, Cisco disclosed that unauthenticated attackers can exploit the IOS XE zero-day to gain full administrator privileges and take complete control over affected Cisco routers and switches remotely.

The company cautioned administrators to disable the vulnerable HTTP server feature on all internet-facing systems until a patch becomes available.

Cisco detected the CVE-2023-20198 attacks in late September following reports of unusual behavior on a customer device received by Cisco’s Technical Assistance Center (TAC). Evidence of these attacks dates back to September 18, when the attackers were observed creating local user accounts named “cisco_tac_admin” and “cisco_support.”

Moreover, the attackers deployed malicious implants using CVE-2021-1435 exploits and other unknown methods, enabling them to execute arbitrary commands at the system or IOS levels on compromised devices.

“We assess that these clusters of activity were likely carried out by the same actor. Both clusters appeared close together, with the October activity appearing to build off the September activity,” Cisco said.

“The first cluster was possibly the actor’s initial attempt and testing their code, while the October activity seems to show the actor expanding their operation to include establishing persistent access via deployment of the implant.”

The company also issued a “strong recommendation” for administrators to look for suspicious or recently created user accounts as potential signs of malicious activity linked to this threat.

Source: Bleepingcomputer

Check Also

Amid Meta moves; OpenAI is largely shutting down next week: Wired

Mark Chen, the chief research officer at OpenAI, sent a forceful memo to staff on …

Leave a Reply

Your email address will not be published. Required fields are marked *