Cisco Archives - Recon Bee

Cisco finally confirms attackers exploiting Unified CM flaw

3Jul

By RBNo Comments

News

Cisco finally confirms attackers exploiting Unified CM flaw

Attackers are currently taking advantage of a Unified Communications Manager (Unified CM) vulnerability that was fixed in early June, according to Cisco. The central control system for Cisco IP telephony systems, Unified CM (formerly called Cisco CallManager) manages telephony capabilities, device management, and call routing. By sending a crafted HTTP request, threat actors without privileges can remotely exploit the vulnerability (CVE-2026-20230) via low-complexity server-side request forgery (SSRF) attacks. Cisco stated that its Product Security Incident Response Team (PSIRT) was aware of publicly available proof-of-concept exploit code for CVE-2026-20230 but had no proof of active exploitation when it published security fixes read more about Cisco finally confirms attackers e...

Cisco Catalyst SD-WAN Zero-Day CVE-2026-20245 Exploited to Gain Root Access

25Jun

By RBNo Comments

News

Cisco Catalyst SD-WAN Zero-Day CVE-2026-20245 Exploited to Gain Root Access

According to new research from Google-owned Mandiant, an unidentified threat actor used a recently revealed high-severity security issue affecting Cisco Catalyst SD-WAN as a zero-day at least two months prior to it being made public. The vulnerability, identified as CVE-2026-20245 (CVSS score: 7.8), exploits the device's inadequate validation of user-supplied input to enable an authorized, local attacker to execute arbitrary commands with elevated privileges by providing a forged file to the compromised system. Cisco said earlier this month that it became aware of the exploitation of this vulnerability and added that in order for an attack to be effective, a malicious actor needs to have netadmin capabilities on the compromised server. According to Mandiant researchers Chester Sn...

Cisco Patches 9.8 CVSS IMC and SSM Flaws Allowing Remote System Compromise

3Apr

By RBNo Comments

News

Cisco Patches 9.8 CVSS IMC and SSM Flaws Allowing Remote System Compromise

A serious security vulnerability in the Integrated Management Controller (IMC) that, if properly exploited, may enable an unauthenticated, remote attacker to get around authentication and access the system with elevated rights has been fixed by Cisco with updates. The vulnerability has a CVSS score of 9.8 out of a possible 10.0, and it is tagged as CVE-2026-20093. According to a Cisco advisory published on Wednesday, this vulnerability results from improper handling of password update requests. By sending a malicious HTTP request to a compromised device, an attacker could take advantage of this vulnerability. If the exploit is effective, the attacker may be able to get around authentication, change any user's password—including that of an administrator—and access the system as th...

ASD Warns of Ongoing BADCANDY Attacks Exploiting Cisco IOS XE Vulnerability

3Nov

By RBNo Comments

News

ASD Warns of Ongoing BADCANDY Attacks Exploiting Cisco IOS XE Vulnerability

The Australian Signals Directorate (ASD) has issued an alert about ongoing cyber attacks targeting unpatched Cisco IOS XE equipment in the country with a previously undocumented implant known as BADCANDY. CVE-2023-20198 (CVSS score: 10.0), a critical vulnerability that enables a remote, unauthenticated attacker to create an account with elevated privileges and use it to take control of vulnerable systems, is what the intelligence agency claims is being exploited in this action. Since 2023, the security flaw has been actively exploited in the wild; in recent months, threat actors with ties to China, such as Salt Typhoon, have weaponized it to compromise telecom companies. Variants of BADCANDY have been identified since October 2023, according to ASD, and new attacks are still bein...

Cisco discloses data breach impacting Cisco.com user accounts

5Aug

By RBNo Comments

News

Cisco discloses data breach impacting Cisco.com user accounts

Cisco has revealed that, after a voice phishing (vishing) attempt against a corporate representative, thieves acquired the basic profile information of users registered on Cisco.com. The massive networking equipment company learned of the incident on July 24th and found that the attacker had deceived an employee to obtain access to a third-party cloud-based Cisco CRM system. As a result, the threat actor was able to obtain the names, organization names, addresses, Cisco-assigned user IDs, email addresses, phone numbers, and account metadata, including creation dates, of anyone who had Cisco.com user accounts. However, the business said that no passwords or other sensitive data, including proprietary or confidential information about organizational clients, were taken by the attac...

Cisco Releases Patch for Critical URWB Vulnerability in Industrial Wireless Systems

7Nov

By RBNo Comments

News

Cisco Releases Patch for Critical URWB Vulnerability in Industrial Wireless Systems

To fix a maximum severity security hole affecting Ultra-Reliable Wireless Backhaul (URWB) Access Points that might allow remote, unauthenticated attackers to execute commands with elevated privileges, Cisco has published security patches. The vulnerability, identified as CVE-2024-20418 (CVS score: 10.0), has been attributed to a failure to validate input into the Cisco Unified Industrial Wireless Software's web-based administration interface. According to a Cisco alert published on Wednesday, an attacker might take advantage of this vulnerability by sending specially constructed HTTP queries to the web-based administrative interface of a compromised system read more about Cisco Releases Patch for Critical URWB Vulnerability in Industrial Wireless Systems. Get up to date on the la...

Cisco Issues Urgent Fix for ASA and FTD Software Vulnerability Under Active Attack

25Oct

By RBNo Comments

News

Cisco Issues Urgent Fix for ASA and FTD Software Vulnerability Under Active Attack

Cisco announced patches on Wednesday to fix a security vulnerability in its Adaptive Security Appliance (ASA) that is being actively abused and might result in a denial-of-service (DoS) scenario. The vulnerability, identified as CVE-2024-20481 (CVSS score: 5.8), impacts Cisco Firepower Threat Defense (FTD) software and the Cisco ASA Remote Access VPN (RAVPN) service. The security vulnerability, which results from resource exhaustion, could be used by remote, unauthenticated attackers to disrupt the RAVPN service. According to a Cisco statement, an attacker might take advantage of this vulnerability by flooding a compromised device with VPN authentication requests read more about Cisco Issues Urgent Fix for ASA and FTD Software Vulnerability Under Active Attack. Get up to date ...

Cisco Issues Patch for High-Severity VPN Hijacking Bug in Secure Client

11Mar

By RBNo Comments

News

Cisco Issues Patch for High-Severity VPN Hijacking Bug in Secure Client

To address a high-severity security weakness in its Secure Client software that could allow a threat actor to start a VPN session with the targeted user, Cisco has published updates. The networking equipment manufacturer stated that an unauthorized, remote attacker might execute a carriage return line feed (CRLF) injection attack against a user due to the vulnerability, which is listed as CVE-2024-20337 (CVSS score: 8.2). A threat actor could make use of this vulnerability, which results from inadequate validation of user-supplied input, to fool a user into clicking on a specially constructed link in the process of starting a VPN session. According to the company's advice, if the exploit is successful, the attacker might be able to run arbitrary script code in the browser read mo...

Cisco Fixes High-Risk Vulnerability Impacting Unity Connection Software

11Jan

By RBNo Comments

News

Cisco Fixes High-Risk Vulnerability Impacting Unity Connection Software

Cisco has patched Unity Connection with software upgrades to fix a serious security vulnerability that might allow an attacker to run arbitrary instructions on the underlying system. The vulnerability, identified as CVE-2024-20272 (CVSS score: 7.3), is an arbitrary file upload flaw that exists in the web-based administration interface. It is caused by incorrect user-supplied data validation and a lack of authentication in a particular API. In a warning published on Wednesday, Cisco stated that "an attacker could exploit this vulnerability by uploading arbitrary files to an affected system." "A successful exploit could allow the attacker to store malicious files on the system, execute arbitrary commands on the operating system read more Cisco Fixes High-Risk Vulnerability Impacting U...

Cisco Warns of Vulnerability in IOS and IOS XE Software After Exploitation Attempts

29Sep

By RBNo Comments

News

Cisco Warns of Vulnerability in IOS and IOS XE Software After Exploitation Attempts

Cisco has issued a warning regarding attempts to exploit a security hole in its IOS and IOS XE software that might allow a remote, authenticated attacker to execute remote code on vulnerable devices. The medium-severity vulnerability has a CVSS score of 6.6 and is tagged as CVE-2023-20109. All software versions with the GDOI or G-IKEv2 protocol enabled are affected. The vulnerability, according to the manufacturer, "could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute arbitrary code on an affected device or cause the device to crash. It further noted that the issue is the result of insufficient validation of attributes in the Group Domain of Interpretation (GDOI) read more Cisco Warns of Vulnerability in ...