Security researchers have discovered 5 vulnerabilities in Cisco Discovery Protocolthat could allow a hacker to take control of corporate phones, routers , and other devices.
In the past, many corporate phones and routers have been found to have vulnerabilities. Now, security researchers have discovered vulnerabilities in corporate phones, webcams, and switches from Cisco that can be used by hackers to infiltrate corporate networks. Cisco is one of the most popular companies , which means that many businesses are at risk .
The vulnerabilities are dangerous because they could be used for espionage. They were discovered by security firm Armis. According to the researchers, they can bypass the “segmentation” strategy that network administrators use to protect networks .
Attackers could target a vulnerable Cisco network switch to gain access to unencrypted, internal information and to move around the target system. Attackers could also use the vulnerabilities to attack multiple devices (e.g., all corporate phones or all cameras). In this way, hackers could monitor an organization or cause damage by disabling devices.
“Network segmentation is a key technique for securing IoT gadgets,” said one researcher. However, experienced hackers and APT groups are constantly on the lookout to act if they find a vulnerability.
According to the researchers, the vulnerabilities were discovered in the Cisco Discovery Protocol, which allows Cisco products to show their identity to other products within a private network. CDP is part of a network’s “Layer 2,” which determines data connectivity between devices that belong to the same network.
Researchers believe that using CDP has some benefits, but it can also help attackers find Cisco products when they are on a network. And because all of the company's products use CDP, a vulnerability could be used to automatically and simultaneously target multiple devices.
Armis said it disclosed its findings to Cisco in late August 2019. The company is now releasing patches to fix the five vulnerabilities, with Armis researchers helping to patch them.
"On February 5th, we disclosed vulnerabilities in the Cisco Discovery Protocol across multiple Cisco products, along with mitigation advisories and fixes," a Cisco spokesperson said.
The company said there is no evidence that the vulnerabilities have been exploited by malicious hackers.
To exploit the vulnerabilities, attackers would first need to gain access to the target network. However, if they manage to get into the network, they could compromise one Cisco device after another. If attackers gain control of a router or switch, they could compromise unencrypted network data
The patches released by Cisco are very important, but not all vulnerable devices are updated automatically. Therefore, it needs to be done manually by the user. Given the widespread use of Cisco equipment in enterprise networks, patches are essential to protect networks.
