Cisco Issues Warning for Critical Switch Vulnerabilities with Public Exploit Code

May 17, 2023

Cisco has issued a warning to customers regarding four critical remote code execution vulnerabilities that have public exploit code, impacting multiple Small Business Series Switches. These security flaws have received near-maximum severity ratings, with Common Vulnerability Scoring System (CVSS) base scores of 9.8 out of 10. If successfully exploited, unauthenticated attackers can execute arbitrary code with root privileges on affected devices. The vulnerabilities in question are CVE-2023-20159, CVE-2023-20160, CVE-2023-20161, and CVE-2023-20189, which stem from improper validation of requests sent to the switches' web interfaces. These vulnerabilities can be exploited through malicious requests sent via the targeted devices' web-based user interfaces in low-complexity attacks that do not require user interaction.

Cisco clarified that these vulnerabilities are not interdependent, stating, "The vulnerabilities are not dependent on one another. Exploitation of one of the vulnerabilities is not required to exploit another vulnerability." Furthermore, a software release affected by one vulnerability may not necessarily be impacted by the other vulnerabilities. The list of affected Cisco switches includes the 200, 300, and 500 Series Small Business Switches. However, the firmware for these devices will not receive patches, as they have already entered the end-of-life process.

The Cisco Product Security Incident Response Team (PSIRT) disclosed that proof-of-concept exploit code is available for these security flaws, potentially leading to active exploitation if motivated threat actors create their own. On Wednesday, the company warned that its PSIRT is "aware that proof-of-concept exploit code is available" for these security flaws, which could allow threat actors to target vulnerable devices exposed to remote access. Fortunately, Cisco's PSIRT has not yet discovered any evidence of attempts to exploit the vulnerabilities in attacks.

In addition to these critical vulnerabilities, Cisco is working on patching a cross-site scripting (XSS) vulnerability in its Prime Collaboration Deployment (PCD) server management tool, reported by Pierre Vivegnis of NATO's Cyber Security Centre (NCSC). A joint advisory released by the US, UK, and Cisco recently warned that APT28 Russian military hackers have been deploying custom 'Jaguar Tooth' malware on Cisco IOS routers to gain unauthenticated access to compromised devices.

Latest News

Like what you see?

Get a digest of headlines, vulnerabilities, risk context, and more delivered to your inbox.

Subscribe Below

By submitting this form, you’re giving us permission to email you. You may unsubscribe at any time.

Accelerate Security Teams

Continuously identify and prioritize the risks that are most critical in your environment, and validate that your remediation efforts are reducing risk. An always-on single source-of-truth of your assets, services, and vulnerabilities.