Cisco Zero-Day Vulnerability Under Active Exploitation

Cisco has patched a critical zero-day vulnerability in its NX-OS software, identified as CVE-2024-20399, which was exploited by the Chinese state-sponsored group Velvet Ant. The vulnerability, a command injection flaw in the Cisco NX-OS Software Command Line Interface (CLI), affects a wide range of Cisco Nexus devices and allows attackers with valid administrator credentials to execute arbitrary commands on the underlying Linux OS of the affected devices. This zero-day was discovered by cybersecurity firm Sygnia during a forensic investigation into Velvet Ant’s cyber espionage operations.

The exploitation involved deploying custom malware on compromised Cisco Nexus devices, enabling remote connections, file uploads, and further code execution. Cisco Nexus switches, often used in enterprise environments, particularly data centers, are at risk due to this vulnerability. Attackers need initial access to an organization’s internal network to exploit this flaw, reducing the overall risk but highlighting the need for robust network monitoring and protection.

Cisco has released software updates to mitigate this vulnerability. Organizations are advised to apply these updates promptly and adopt security best practices, including restricting administrative access, centralizing authentication management, enforcing strong password policies, restricting outbound internet access, and implementing regular patch management. Enhancing visibility through centralized logging and integrating logs with a Security Information and Event Management (SIEM) system are also crucial for detecting malicious activities on network devices.

Source: The Cyber Express

To mitigate potential threats, it is important to implement additional cybersecurity measures with the help of a trusted partner like INFRA www.infrascan.net, or you can try yourself using check.website.