minsta

Cisco releases patch to fix serious flaw allowing possible takeover of industrial systems

Pabio November 8, 2024

Cisco releases urgent patch for worrying security flaw
Vulnerability could have allowed hackers to execute malicious code
Industrial systems and platforms are particularly affected, so update now

Cisco has fixed a critical vulnerability in some of its software that could have allowed malicious actors to run. malicious code from a distance.

In a security advisory, Cisco said it discovered a flaw in the web-based management interface of Cisco Unified Industrial Wireless Software for Cisco Ultra-Reliable Wireless Backhaul (URWB) access points.

These access points are designed for industries that require highly reliable and robust wireless connections in harsh environments. They are particularly popular in industries where maintaining constant connectivity is essential for operations, such as transportation and logistics, public safety and emergency services, utilities and energy, or mining and construction.

Cisco says update now

The discovered bug is tracked as CVE-2024-20418 and has a high severity score: 10/10.

“An attacker could exploit this vulnerability by sending crafted HTTP requests to the web-based management interface of an affected system,” Cisco said in the advisory. “A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the underlying server. operating system of the device concerned.”

Cisco products vulnerable to this flaw are Catalyst IW9165D Rugged Access Points, Catalyst IW9165E Rugged Access Points and Wireless Clients, and Catalyst IW9167E Rugged Access Points. Products that do not operate in URWB mode are not affected by the vulnerability, Cisco said.

To defend against possible compromises, users are advised to upgrade their Cisco Unified Industrial Wireless software to version 17.15.1. Anyone using versions 17.14 and earlier is advised not to wait with the patches.

Cisco has not mentioned any evidence (or lack thereof) of abuse in the wild. It said it discovered the flaw during internal security testing, so miscreants may not have detected it yet. However, now that the cat is out of the bag, it’s only a matter of time before they start looking for vulnerable endpoints.

Via TheHackerNews