Agencies Warn of Cisco Catalyst SD-WAN Compromises and Urge Immediate Investigation
Summary
Malicious actors are targeting Cisco Catalyst SD-WAN globally, adding rogue peers to gain root access and persist. Agencies urge investigation, hardening, and software updates; internet-exposed management interfaces are at greatest risk.
Key points
- Attackers are targeting organisations worldwide that use Cisco Catalyst SD-WAN.
- The actors add a rogue peer and pursue follow-on actions to gain root access and maintain persistent access.
- SD-WAN management interfaces exposed to the internet are at greatest risk and should never be internet-accessible.
- Agencies issued a Hunt Guide based on investigation observations, with TTPs, detection and threat-hunting guidance, and mitigation advice.
- Cisco released software updates for Cisco Catalyst SD-WAN Manager and Cisco Catalyst SD-WAN Controller.
- Agencies urge defenders to review the Cisco Catalyst SD-WAN Hardening Guide and take the listed priority actions.
Article Details
- Event Type
- Malicious cyber activity targeting Cisco Catalyst SD-WAN deployments
- Impact
- Malicious actors are compromising Cisco Catalyst SD-WANs to add rogue peers and pursue follow-on actions to gain root access and maintain persistent access. Organisations with management interfaces exposed to the internet are at greatest risk. Cisco has released software updates for Cisco Catalyst SD-WAN Manager and Cisco Catalyst SD-WAN Controller.
Vendors
Products
Cisco Catalyst SD-WANExploitation of Cisco Catalyst SD-WANCisco Catalyst SD-WAN ControllerCisco has released software updates for Cisco Catalyst SD-WAN Manager and Cisco Catalyst SD-WAN Controller.Cisco Catalyst SD-WAN ManagerCisco has released software updates for Cisco Catalyst SD-WAN Manager and Cisco Catalyst SD-WAN Controller.