Organisations are encouraged to take action to mitigate vulnerabilities affecting Cisco IOS XE (CVE-2023-20198 and CVE-2023-20273) and follow the latest vendor advice.
What has happened?
Cisco has published an updated advisory detailing two vulnerabilities affecting Cisco IOS XE devices. Both are being actively exploited.
CVE-2023-20198 – A remote, unauthenticated attacker could create an account on an affected system with privilege level 15 access. The attacker can then use that account to gain control of the affected system.
CVE-2023-20273 – A remote, authenticated attacker could inject arbitrary commands as the root user.
The NCSC is working with UK organisations known to be impacted and have notified affected UK organisations signed up for the NCSC Early Warning service.
Who is affected?
Organisations using Cisco IOS XE devices.
The NCSC will continue to monitor the impact of these vulnerabilities on UK organisations.
What should I do?
The NCSC recommends following vendor best-practice advice to mitigate vulnerabilities. In this case, if you use Cisco IOS XE devices, you should take these priority actions:
- Check for compromise using the detection steps and indicators of compromise (IoCs) detailed in the Cisco advisory.
- If you believe you have been compromised and are in the UK, you should report it to the NCSC.
- Disable the HTTP Server feature on all internet-facing devices, or restrict access to trusted networks.
- Install the latest version of Cisco IOS XE. More information is on the Cisco website. Organisations should monitor that advisory for the latest information and software updates.
NCSC guidance, services and tools
The NCSC provides a range of free guidance, services and tools that help to secure systems:
- Follow NCSC guidance including preventing lateral movement and how to protect your administration interfaces to reduce the attack surface.
- Sign up to the NCSC Early Warning service. If you are an Early Warning user already, please check your MyNCSC portal.
- UK central government departments can take advantage of the NCSC’s host based capability.
- The vulnerability disclosure toolkit helps organisations of all sizes with the essential components of implementing a vulnerability disclosure process.
Information from National Cyber Security Centre
Related content
Phishing is a cybercrime in which a target or targets are contacted through email, by someone posing as a legitimate organisation to lure individuals and companies into providing sensitive data. A form of phishing is quishing, which uses QR codes to lure you to nefarious websites. As with any type of phishing, the best defence against quishing attacks is to be aware of the threat.
The National Cyber Security Centre (NCSC) has published a press release urging UK organisations to check out their recently updated cyber security guidance in response to malicious cyber incidents in and around Ukraine. This guidance encourages organisations to take actionable […]
Our colleagues at the National Cyber Security Centre (NCSC), the UK’s technical authority on cyber security, have issued an advisory highlighting the activities of the Russia-based SEABORGIUM and Iran-based TA453.
These state sponsored threat actors continue to successfully use spear-phishing attacks against targeted organisations and individuals in the UK, and other areas of interest, for information gathering activity.
Although there is similarity in the tactics techniques, procedures and targeting profiles, these campaigns are separate and the two groups are not collaborating.