Cisco botched patches for its RV320/RV325 routers

By ice41 | 3:58 AM Leave a Comment

Cisco RV320 and RV325 WAN VPN routers are still vulnerable to attack through two flaws that Cisco had supposedly patched.

There are still many vulnerable devices

CVE-2019-1652 and CVE-2019-1653 were discovered in September 2018 by security experts from RedTeam Pentesting and disclosed to Cisco, which delivered patches in January 2019.

Unfortunately, the patches did not fix the vulnerabilities, but merely blacklisted the user agent for curl, a command-line tool for transferring data that is used by many popular Internet scanning tools.

That discovery was again made by RedTeam Pentesting, and the vulnerabilities continue to allow attackers with administrative access to the router’s web interface to:

  • Execute arbitrary operating system commands on the device (CVE-2019-1652), and/or
  • Gather configuration and diagnostic information that can be used to compromise the device or attached networks (CVE-2019-1653). “By downloading the configuration/diagnostic information, attackers can obtain internal network configuration, VPN or IPsec secrets, as well as password hashes for the router’s user accounts,” they pointed out.

Complete fixes are on the way

Cisco has confirmed their findings and has promised to release new, complete fixes by the middle of April 2019.

Troy Mursch of Bad Packets Report says attackers have been trying to exploit the flaws (especially CVE-2019-1653) since January, and there are currently over 8,000 vulnerable routers Cisco RV320/RV325 routers out there that attackers can extract configuration settings from.

Cisco says there are no workarounds that address these vulnerabilities, but RedTeam Pentesting experts note that the threat of attack can be mitigated by preventing untrusted users from using the vulnerable routers’ web interface and by preventing untrusted clients from connecting to the devices’ web server.


from Help Net Security https://ift.tt/2TGtLpx
Related Items

0 comments:

Post a Comment