Cisco fixes two bugs that could have led to supply chain attacks on users

Cisco has moved to fix two vulnerabilities – one live and one in yet-to-be-released code – that affect a wide range of enterprise and industrial network hardware products and left unchecked could allow attackers to gain persistent root access to the underlying system.

Uncovered by Trellix vulnerability researchers Sam Quinn and Kasimir Schulz, the two vulnerabilities were found in the Cisco ISR 4431 router. However, they also affect all 800 Series Industrial ISR industrial routers, CGR1000 Compute Modules for enterprise cloud services, IC3000 Industrial Compute Gateways, IOS XE-based devices configured with IOx, IR510 WPAN Industrial Routers, and Cisco Catalyst access points.

The first and more immediately dangerous issue has been assigned CVE-2023-20076. It is a remote command injection vulnerability in the application hosting component that lets admins deploy application containers or virtual machines to the device. It arises from improper sanitisation of the DHCP Client ID option within interface settings, giving an attacker the ability to inject an operating system command of their choosing.

The attack path additionally bypasses mitigations Cisco has in place to stop vulnerabilities persisting in a system across reboots and firmware upgrades, so if successfully exploited, a malicious package could keep running until the device is factory reset or it is found and manually deleted.

The second issue has not been assigned a CVE designation, but is for now being tracked using Cisco bug ID CSCwc67015. It is an arbitrary file write vulnerability that could enable an attacker to execute code on the affected devices. It arises in the application hosting environment via a feature that enables users to upload and run applications in virtual containers – when reverse engineering this environment, the researchers found a maliciously packed application could bypass a vital security check while simultaneously uncompressing the uploaded application.

The bypassed security check was designed to secure the system against CVE-2007-4559 – a very old vulnerability in Python’s tarfile module that has been the subject of much work by Trellix’s teams before and had not been fixed here. The team investigated further and found that while the code could be reached from the application, the device couldn’t be exploited because it was missing a needed module. Quinn and Schulz reported it just the same because other devices could have been affected, and ultimately it was found exploitable in code set to be deployed by Cisco in the future. Thanks to the disclosure, this code will eventually go live with a fix.

Users should note that both issues require an attacker to have authenticated and obtained admin privileges, so while the potential severity of the vulnerabilities is a little more limited, it is not difficult for determined attackers to gain admin credentials if, for example, the default login credentials have never been changed, via a fairly basic phishing attack or through social engineering. Indeed, said Quinn and Schulz, such bugs are often leveraged by nation-state-backed advanced persistent threat (APT) groups.

In their write-up, Quinn and Schulz described how such vulnerabilities in modern routers were becoming of greater potential impact. “Unlike those of the past, modern routers now function like high-powered servers with many ethernet ports running not only routing software but, in some cases, even multiple containers,” they said. “The complexity of these systems expands the already ripe attack surface for threat actors. If an attacker could access one of these devices and get complete control, they would have a foothold in a network and a powerful ‘server’ within their control.”