Saturday, November 2, 2024
HomeCiscoAuthentication Bypass Vulnerability in Cisco REST API Let Hackers Take Control of...

Authentication Bypass Vulnerability in Cisco REST API Let Hackers Take Control of Cisco Routers Remotely

Published on

Malware protection

Cisco released a security update for critical Authentication Bypass vulnerability that resides in the Cisco REST API virtual service container for Cisco IOS XE Software allows a remote attacker to bypass the authentication in managed Cisco devices.

Cisco IOS XE is an internetworking OS that mainly deployed in Cisco ARS 1000 series routers and Catalyst switches such as 3850 that operating in enterprise wired and wireless access, aggregation, core, and WAN.

An Authentication Bypass vulnerability affected the Cisco IOS XE due to an improper check performed by the area of code that manages the REST API authentication service.

- Advertisement - SIEM as a Service

Cisco REST API is an application that running in the virtual service container, a virtualized environment on a device.

An attacker could exploit the vulnerability by sending malicious HTTP requests to the targeted device. Once the target system has been successfully exploited, the attacker to obtain the token-id of an authenticated user.

If the attacker has successfully obtained the authentication token key, it allows him to bypass the device authentication and execute the system privilege via an interface of the REST API virtual service container.

The Authentication bypass vulnerability affected the following series:

  • Cisco 4000 Series Integrated Services Routers
  • Cisco ASR 1000 Series Aggregation Services Routers
  • Cisco Cloud Services Router 1000V Series
  • Cisco Integrated Services Virtual Router

According to Cisco, In order to exploit the vulnerability, the attack needs to meet with the following conditions:

  • The device runs an affected Cisco IOS XE Software release.
  • The device has installed and enabled an affected version of the Cisco REST API virtual service container.
  • An authorized user with administrator credentials (level 15) is authenticated to the REST API interface.

How to Find the Vulnerable Devices

In order to find whether the Cisco REST API service container is enabled, the admin can use the following command and refer the output.

router#show virtual-service detail | include Restful
Restful API   Enabled, UP             port: 55443

If you will not find the string Enabled, UP then your device is not affected by this vulnerability.

If the device Is using an Affected Cisco REST API Virtual Service Container Release, you can use the following privileged EXEC command.

  router#show virtual-service version installed
Virtual service csr_mgmt installed version:
Name: csr_mgmt
 Version: 16.09.03

If you can see the combination of the virtual service name and version listed in the output, then you can conclude that your device is using a vulnerable REST API virtual service container.

“Cisco has released a fixed version of the REST API virtual service container and released a hardened Cisco IOS XE Software that prevents installation or activation of a vulnerable container on a device” 

If the device was already configured with an active vulnerable container, the IOS XE Software upgrade will deactivate the container, making the device not vulnerable.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates

Also Read:

A Vulnerability In Linux Sudo Let the Restricted Linux Users to Run Commands as Root

Microsoft NTLM Vulnerability Let Hackers to Compromise the Network Domain Controller

RCE Vulnerability in D-Link Routers Let Hackers Access the Router Admin Page Without Credentials

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS...

ATPC Cyber Forum to Focus on Next Generation Cybersecurity and Artificial Intelligence Issues

White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch...

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan...

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Google Chrome Security, Critical Vulnerabilities Patched

Google has updated its Chrome browser, addressing critical vulnerabilities that posed potential risks to...

SMB Force-Authentication Vulnerability Impacts All OPA Versions For Windows

Open Policy Agent (OPA) recently patched a critical vulnerability that could have exposed NTLM...

Vulnerabilities in Realtek SD Card Reader Driver Impacts Dell, Lenovo, & Others Laptops

Multiple vulnerabilities have been discovered in the Realtek SD card reader driver, RtsPer.sys, affecting...