Cisco has disclosed that hackers have been exploiting a maximum severity vulnerability in its Catalyst SD WAN products for at least three years, prompting coordinated warnings from the United States and allied governments and an emergency patch order for federal agencies. The flaw, rated 10.0 on the severity scale, allows remote attackers to gain full control of affected devices and maintain persistent access inside enterprise and government networks.
Scope Of The Vulnerability
The bug affects Cisco’s Catalyst SD WAN products, which are used by large enterprises and government agencies to connect private networks across multiple locations. By exploiting the flaw over the internet, attackers can obtain the highest level of privileges on compromised devices. Cisco said this access enables threat actors to remain hidden inside a victim’s network and potentially conduct long term espionage or data theft.
After identifying the issue, Cisco researchers traced evidence of exploitation back to 2023. The company said some of the affected organizations are part of critical infrastructure, a term that can include sectors such as power, water, and transportation. Cisco did not disclose specific victims.
Government Response And Global Warnings
Governments in Australia, Canada, New Zealand, the United Kingdom, and the United States issued a joint alert stating that threat actors are targeting organizations globally. The US Cybersecurity and Infrastructure Security Agency, known as CISA, ordered all civilian federal agencies to patch affected systems by the end of day Friday, citing an imminent threat and unacceptable risk to federal networks.
CISA said it is aware of ongoing exploitation. The agency is currently operating at reduced capacity due to a partial government shutdown.
Neither Cisco nor government agencies attributed the activity to a specific threat group or nation state. One cluster of activity has been tracked as UAT 8616.
Related Security Issues
In December, Cisco warned of another vulnerability rated 10.0 in the Async software that runs many of its products. That flaw was also being actively exploited to gain unauthorized access to customer networks.
Featured image credits: Flickr
For more stories like it, click the +Follow button at the top of this page to follow us.