Critical Cisco SD-WAN vulnerability exploited since 2023

"The zero-day in Cisco Catalyst SD-WAN is being actively exploited, according to Cisco's security arm Talos. The research team discovered that attackers are using this vulnerability to compromise controllers and connect malicious peers to target networks. The group UAT-8616, which is not yet known, has been exploiting the flaw since at least 2023."

"The problem lies in the peering authentication mechanism. According to the National Vulnerability Database (NVD), peering authentication is not working properly. This allows malicious actors to gain access to affected Cisco Catalyst SD-WAN Controllers via specially crafted requests. They then log in as an internal, privileged, non-root user account."

"This account gives attackers access to NETCONF. This access allows them to manipulate network configurations for the SD-WAN fabric. The severity of the vulnerability is also evident from the attack method: UAT-8616 would start by downgrading the SD-WAN solution to an older, vulnerable version. After gaining root access, the criminals restore the original firmware version to cover their tracks."

Cisco Catalyst SD-WAN contains a critical vulnerability in its peering authentication mechanism that has been actively exploited since at least 2023 by the group UAT-8616. The flaw allows attackers to bypass authentication, gain access to controllers as privileged users, and obtain NETCONF access to manipulate network configurations. Attackers exploit this by downgrading the SD-WAN solution to vulnerable versions, gaining root access, then restoring original firmware to hide their activities. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, mandating that US Federal Civilian Executive Branch agencies patch within two days instead of the standard three weeks. Organizations must urgently migrate to patched versions 20.9.8.2, 20.12.6.1, or newer.

Read at Techzine Global