← Cybersecurity Today
Cybersecurity Today
Cisco Hits A Perfect 10 With A Critical Flaw in Industrial Wireless Systems: Cyber Security Today for Wednesday, November 13, 2024
00:07:00
In this episode, we discuss urgent cybersecurity concerns: Cisco's critical vulnerability affecting industrial wireless systems with a CVSS 10 rating, D-Link's refusal to patch severe flaws in over 60,000 outdated NAS devices, and Amazon's data breach...
Loading summary
Transcript1 lines
- [00:02]
Jim Love
Cisco hits a perfect 10 with a critical flaw in industrial wireless systems D Link won't patch critical vulnerabilities at 60,000 outdated NAS devices Amazon confirms employee data was exposed in a vendor breach tied to the MoveIt vulnerability and why strong off boarding processes are essential Lessons from Disney's insider threat incident Cisco has issued an urgent alert about a critical vulnerability in its ultra reliable wireless Backhaul systems, which has received a Maximum Common Vulnerability Score System or CVSS rating of 10. The flaw, designated CVE2024 20418, affects Cisco's Unified industrial wireless software, allowing a remote attacker to gain administrator level access without prior privileges. The vulnerability enables attackers to send crafted HTTP requests to the affected systems management interface. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the underlying operating system of the affected device. According to Cisco, such access would allow attackers to install malware and fully control the device. The flaw impacts key models often used in industrial settings that Catalyst Heavy duty access points and Catalyst Rugged access points and wireless clients. Cisco advises customers to check if URWB is enabled by using the Show MPLS config command and to apply the patch immediately if it is. While no exploits have been observed in the wild, the vulnerability severity and ease of exploitation make rapid patching crucial for systems in critical environments like ports and factories. We've included a link to the download of the patch, but only because Cisco site is not exactly intuitive in terms of finding these secure announcements. Take a minute to validate the links though, even when they're supplied by us. D Link has announced it won't fix a serious security flaw affecting over 60,000 network attached storage or NAS devices due to their end of life status. The Vulnerability, tracked as CVE 2024 10914, has a critical severity score of 9.2 and allows attackers to execute arbitrary shell commands via a specially crafted HTTP get request, potentially leading to significant system compromise. It affects a wide range of NAS models. A full list is in the show Notes. D Link recommends that users replace these outdated models with newer devices that receive regular security updates. For those who cannot immediately replace their NAS units, the company advises isolating these devices from the public Internet and restricting access to exposure. Despite the relatively high complexity of exploiting this vulnerability, a public exploit does exist, raising risks for small and medium sized businesses that rely on these devices. NAS devices, which often store sensitive data like financial and business files, are frequent targets of ransomware and other cyber attacks. Amazon has confirmed that work contact details for some employees were exposed in a data leak linked to the MoveIt vulnerabilities CVE 20, 2334362 while Amazon's own systems remained secure, a security incident at a property management vendor resulted in unauthorized access to work email addresses, desk phone numbers and office locations. The full data breach involved over 5 million records from 25 organizations, with Amazon's data making up 2.86 million of those records. The stolen information includes detailed employee data such as names, email addresses, phone numbers and organizational structures. Hudson Rock, a cybercrime intelligence company, warned that this information could be exploited in social engineering attacks. The breach is associated with a vulnerability in Moovit, a file transfer software that allowed hackers to bypass authentication controls. The CIOP ransomware group is linked to the initial attack on Moovit, but the data is now being auctioned on breach forms and offered by an entirely different entity, Nameless NAM3L3SS. Other affected companies include HP, Lenovo and British Telecom. A recent case involving a former Disney employee has highlighted the importance of robust offboarding processes to prevent insider threats after employees leave or are terminated. Michael Schauer, a former menu production manager, faces federal charges for allegedly altering allergen information and launching cyberattacks against former colleagues after being dismissed. This incident serves as a stark reminder of the risks posed by disgruntled employees who retain network access. Experts stress that timely revocation of access for departing employees is essential. This incident shows just how serious insider threats can get, said Damian Garcia, the head of GRC consultancy at IT Governance. Insider threats aren't just about financial loss or reputation, he says. They can be a matter of life and death. In this case, it's reported that Disney caught shower before he allegedly tried to change menus, which would have had meals that contained peanuts relabeled as safe for people with peanut allergies. This could be deadly. These and other exploits were reportedly caught before they reached customers, but the case underscores how easily ex employees can exploit access to inflict harm. Beyond revoking access, experts recommend limiting permissions based on specific roles and implementing continuous monitoring for any unusual activity. Raul Tyagi, CEO of secqual, notes that even seemingly harmless data can become weaponized, impacting business continuity and staff safety. A structured off boarding process coupled with role specific access and regular monitoring can mitigate these risks, according to Garcia. Understanding employee dissatisfaction, especially in technical roles, can also help identify potential threats early and prevent sabotage. And that's our show for today. You can find links to the reports and other details in show notes@technewsday.com. we welcome your comments, tips and the occasional bit of constructive criticism at editorial@technewsday CA. I'm your host, Jim Love. Thanks for listening.