Cisco reports bug disclosed in WikiLeaks' Vault 7 CIA dump
More than 300 Borg switches carry critical IOS Telnet vuln the CIA knew about before Cisco
It looks like Cisco won't be chasing up a partnership with WikiLeaks: it's combing the "Vault7" documents itself, and has turned up an IOS / IOS XE bug in more than 300 of its switch models.
The vulnerability is in the Cisco Cluster Management Protocol (CMP) in IOS and IOS XE. The protocol passes around information about switch clusters using either Telnet or SSH.
The bug is in the default configuration of affected devices, even if the user doesn't have switch clusters configured, and can be exploited over either IPv4 or IPv6.
It's a two-fold bug: first, the protocol doesn't restrict CMP-specific Telnet to local communications, instead processing commands over “any Telnet connection to an affected device”; and second, malformed CMP-specific Telnet options are incorrectly processed.
“An attacker could exploit this vulnerability by sending malformed CMP-specific Telnet options while establishing a Telnet session with an affected Cisco device configured to accept Telnet connections. An exploit could allow an attacker to execute arbitrary code and obtain full control of the device or cause a reload of the affected device”, Cisco's advisory states.
The bug affects 264 Catalyst switches, as well as 51 industrial Ethernet switches and three other devices, if they're running IOS and configured to accept Telnet connections.
Until fixes are available, Cisco says Telnet should be disabled in favour of SSH.
Cisco's advisory doesn't tell us if it's aware of exploits using the flaw. If they are discovered, this is very substantial news because The Reg expects there are tens of thousands, if not hundreds of thousands, of these devices installed around the world. And all look to have been at the CIA's mercy for an unknown period of time. ®