September 2024 hasn’t been kind to Cisco. Their routers, switches, and various networking products are facing a barrage of vulnerabilities that demand immediate attention. If you manage any Cisco hardware or software, this is the kind of news that makes you want to pour another cup of coffee—or maybe something stronger.
From denial-of-service (DoS) exploits to man-in-the-middle attacks, Cisco’s latest security advisory dump reads like a guide to everything you don’t want happening in your network. In this article, we’ll dive into the most pressing vulnerabilities revealed in September 2024 and why you need to patch them yesterday.
Static SSH Host Keys: Cisco Catalyst Center’s Identity Crisis (CVE-2024-20350)
Remember when SSH was supposed to make things more secure? Well, Cisco Catalyst Center (formerly DNA Center) seems to have missed that memo. A vulnerability in the SSH server leaves it wide open to attackers, thanks to something that sounds almost too basic to be real: static SSH host keys.
That’s right. The same host key is used across multiple devices, which means an attacker could impersonate a Cisco Catalyst Center appliance, intercept traffic, inject commands, and even steal user credentials. For those of you running versions older than 2.3.5.6 or 2.3.7.5, it’s time to update. Without these updates, you’re walking around with a sign that says, “Please hack me.”
What makes this particularly sneaky is that it can be exploited by a machine-in-the-middle attack, allowing hackers to silently sit between your SSH clients and the device, controlling the session without anyone noticing. If this doesn’t make you want to patch, I’m not sure what will.
IPv4 Fragmentation Reassembly DoS: Cisco’s Packets Gone Rogue (CVE-2024-20467)
Next up is a vulnerability that sounds like a bad sci-fi movie: IPv4 Fragmentation Reassembly Denial of Service. This issue, found in Cisco IOS XE Software, allows attackers to send specially crafted fragmented packets that can crash your system faster than you can say “denial of service.”
This vulnerability is a goldmine for attackers who want to cause trouble without needing access to your network. Simply by bombarding your router with fragmented packets, they can cause the device to reload and crash, leading to a DoS condition. Cisco ASR 1000 Series Aggregation Services Routers and cBR-8 Converged Broadband Routers are particularly vulnerable, running versions 17.12.1 or 17.12.1a.
You might think, “Can’t I just apply a quick workaround?” Sadly, no. There are no workarounds here—only a software patch can save you from this disaster.
Telephony Services HTTP DoS: The Call Dropped. Permanently. (CVE-2024-20436)
For those of you managing telephony services through Cisco’s IOS XE Software, here’s a vulnerability that might make your next VoIP call go dead. The HTTP server associated with telephony services is vulnerable to an attacker sending a specially crafted HTTP request, leading to a null pointer dereference. What does that mean for you? Well, it’s the tech equivalent of tripping over nothing, causing your device to crash.
Attackers can exploit this by sending crafted HTTP traffic that makes your system stumble and fall, resulting in a full DoS condition. Imagine your telephony services going down just because someone figured out how to send the right kind of garbage traffic. Scary, right?
Cisco has already released a patch for this vulnerability, so get it installed before your next important call gets cut off mid-sentence.
SD-Access Fabric Edge Node DoS: DHCP Packets Gone Wild (CVE-2024-20480)
DHCP packets are like the quiet, well-behaved guests at your network party. Except when they’re not.
In Cisco’s SD-Access Fabric Edge Nodes, improper handling of IPv4 DHCP packets can cause high CPU utilization, which ultimately crashes the device. This is like inviting DHCP to the party only for them to suddenly flip the table, causing the router to choke on traffic and require a manual reboot to recover.
This denial-of-service vulnerability is due to DHCP snooping gone wrong, and once triggered, the affected device’s CPU is consumed with trying to process the onslaught. The only solution? A good old-fashioned reboot. The cause of this chaos is IPv4 DHCP packets, but the solution, unsurprisingly, is patching your SD-Access Fabric Edge Node system.
Protocol Independent Multicast (PIM) DoS: A Multicast Mayhem (CVE-2024-20464)
Multicast protocols are supposed to make network traffic more efficient by allowing a single stream of data to be shared across multiple receivers. But Cisco’s PIM feature seems to have taken that a little too literally—by allowing a single malicious packet to bring your network down.
In another delightful denial-of-service scenario, attackers can send a carefully crafted PIMv2 packet to your device and cause it to reload. That’s right—a single packet, if it’s the right one, can force your router to take a break. Imagine how much havoc that could cause in a corporate environment where uptime is critical.
This vulnerability affects devices running Cisco IOS XE Software 17.13.1 or 17.13.1a that have PIM configured. As with most of these flaws, Cisco has released an update to patch this issue, but no workarounds exist. If your network is running multicast applications, this patch should be a top priority.
RSVP Buffer Overflow: How to Crash a Network with a Reservation (CVE-2024-20433)
Lastly, let’s talk about Cisco’s RSVP (Resource Reservation Protocol) feature. This protocol, used to reserve network resources for specific data streams, has a vulnerability that allows attackers to cause a denial of service by simply sending a malformed RSVP packet.
The issue stems from a buffer overflow, which results in the affected device reloading, leading to—you guessed it—a denial of service. This vulnerability affects both Cisco IOS and IOS XE Software and can be exploited remotely without the attacker needing any sort of authentication. Think of it like making a reservation at a restaurant only to have the whole kitchen shut down when you show up.
Once again, no workarounds here, but Cisco has graciously provided software updates to address the flaw.
FAQs
What’s the most critical vulnerability on the list?
All these vulnerabilities are serious, but the Static SSH Host Key vulnerability (CVE-2024-20350) might be the most critical, given its potential for a man-in-the-middle attack that compromises the entire system.
Are there any workarounds?
Unfortunately, no. For the most part, these vulnerabilities don’t offer any quick fixes. Your only option is to patch the affected systems as soon as possible.
What’s the risk if I don’t update?
The risk varies depending on the vulnerability, but in every case, you’re looking at some form of denial of service or even unauthorized access to your network. At best, it’s a minor inconvenience. At worst, your entire network could be compromised.
How do I know if my system is vulnerable?
Each vulnerability comes with specific instructions on how to determine if your Cisco device is affected. This often involves using CLI commands to check the configuration. Cisco has also provided detailed documentation on which software versions are impacted.
Can these vulnerabilities be exploited remotely?
Yes, many of these vulnerabilities allow attackers to remotely exploit your system, often without authentication. This makes them particularly dangerous in today’s increasingly remote and cloud-connected world.
Conclusion: Patch or Perish
September 2024 has been a tough month for Cisco, but don’t let these vulnerabilities ruin your network’s uptime. The solution is simple: patch now. Don’t wait for a crafty attacker to take down your telephony services, disrupt your router with some rogue IP fragments, or impersonate your network appliance with a static SSH host key.
Cisco has already provided updates for all these vulnerabilities. Now, it’s up to you to make sure your systems are protected. So, get patching, and maybe breathe a little easier knowing that the attackers will have to work just a little harder to get through your defenses.
