Cisco has identified a major vulnerability in its Cluster Management Protocol (CMP), which formed part of the WikiLeaks "Vault 7" document cache.
On 7 March, Omar Santos, principal engineer at Cisco's product security incident response team, published a blog post acknowledging that Cisco devices were among those allegedly targeted by the CIA.
At that time, little was known about the actual method of attack, other than it was a type of malware targeting multiple devices, including routers and switches, which allowed for the attacker to carry out data collection and exfiltration, HTML traffic redirection, DNS poisoning and other malicious actions.
Further analysis of the documents, though, has now enabled the company to identify what it thinks is the vulnerability in question.
In an update to the blog post, Santos said: "Based on the "Vault 7" public disclosure, Cisco launched an investigation into the products that could potentially be impacted by these and similar exploits and vulnerabilities.
"As part of the internal investigation of our own products and the publicly available information, Cisco security researchers found a vulnerability in the Cluster Management Protocol code in Cisco IOS and Cisco IOS XE Software that could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges."
In a security advisory, the company explained that the vulnerability, which affects scores of devices, is due to the fact the Cluster Management Protocol (CMP) uses Telnet internally.
According to the company, there are two factors that combine to create the problem:
- A failure to restrict the use of CMP-specific Telnet options only to internal, local communications between cluster members and instead accept and process them over any Telnet connection to an affected device;
- Incorrect processing of malformed CMP-specific Telnet options
"An attacker could exploit this vulnerability by sending malformed CMP-specific Telnet options while establishing a Telnet session with an affected Cisco device configured to accept Telnet connections. An exploit could allow an attacker to execute arbitrary code and obtain full control of the device or cause a reload of the affected device," the company explained.
Unfortunately there is, for now, no patch or workaround per se. Cisco has advised users that disabling the Telnet protocol for incoming connections and using SSH would mitigate the risk. This is the approach recommended by the company.
Cisco does recognise, however, that this approach may not be acceptable to all, or indeed may be impossible for some. In this case, the company advises implementing infrastructure access control lists.
The advisory, including a list of all affected deviced, can be found in full here.
