Flash Notice: Cisco VPN Vulnerabilities Exploited in the Wild

overview

This week, Cisco announced that there are two vulnerabilities affecting their AnyConnect product. The vulnerabilities are being exploited in the wild and are tracked as CVE-2020-3433 and CVE-2020-3153. The flaws affect the AnyConnect Secure Mobility Client for Windows releases earlier than version 4.9.00086.  

According to Cisco, AnyConnect Secure Mobility Client is software used by remote workers. It provides them with access to their enterprise networks from any device in any location. The vulnerabilities affecting AnyConnect were patched by Cisco in August 2020, but attackers are still exploiting the flaws due to unpatched software.  

CVE-2022-3433 and CVE-2020-3153 allow attackers to execute arbitrary code and copy files to system directories with elevated privileges. After exploitation, attackers can then execute arbitrary code on targeted Windows devices with SYTEM privileges. However, attackers need valid credentials on a system for the flaws to be exploited. A proof-of-concept is available for both CVEs.  

There are no further details regarding attacks involving the bugs, but researchers believe that because exploitation requires authentication, the vulnerabilities are likely being used as a part of a multi-stage attack by a sophisticated threat actor. Cisco stated that they are aware of the vulnerability, and they recommend that their customers upgrade to the fixed software release to remediate the issue. 

How Avertium is Protecting Our CUSTOMERS

• Fusion MXDR is the first MDR offering that fuses together all aspects of security operations into a living, breathing, threat-resistant XDR solution. By fusing insights from threat intelligence, security assessments, and vulnerability management into our MDR approach, Fusion MXDR offers a more informed, robust, and cost-effective approach to cybersecurity – one that is great than the sum of its parts. 

• Avertium offers Vulnerability Management to provide a deeper understanding and control over organizational information security risks.  If your enterprise is facing challenges with the scope, resources, or skills required to implement a vulnerability management program with your team, outsourced solutions can help you bridge the gap. 

• Minimizing the impact of a successful ransomware attack requires detecting it as early in the attack as possible. A Security Information and Event Management (SIEM) system can help an organization to accomplish this. Avertium offers a comprehensive SIEM-based approach that increases the potential for detecting a ransomware infection before it deploys. SIEM provides a holistic overview of a company’s IT environment from a single point of view in terms of its specific security events, empowering teams to detect and analyze unusual behavior. 

avertium's recommendations    

INDICATORS OF COMPROMISE (IOCS):

At this time, there are no known IoCs associated with CVE-2020-3433 and CVE-2020-3153. Avertium’s threat hunters remain vigilant in locating IoCs for our customers. Should any be located, Avertium will disclose them as soon as possible. For more information on how Avertium can help protect your organization, please reach out to your Avertium Service Delivery Manager or Account Executive.     

SUPPORTING DOCUMENTATION

 Cisco Confirms In-the-Wild Exploitation of Two VPN Vulnerabilities | SecurityWeek.Com 

Cisco AnyConnect Secure Mobility Client - Cisco 

Cisco warns admins to patch AnyConnect flaws exploited in attacks (bleepingcomputer.com) 

Cisco AnyConnect Windows client under active attack • The Register 

Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability 

Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability