“It requires an authenticated person, so a minimum of it’s not an unauthenticated RCE (distant code execution),” mentioned Shipley. The vulnerability has a excessive CVSS rating of seven.7, “however [it’s] not the worst we’ve seen of late.”
Ed Dubrovsky, chief working officer of US-based incident response agency Cypfer, additionally famous {that a} profitable attacker would should be authenticated.
Though many corporations nonetheless use default credentials on the SNMP protocol degree, he mentioned, the requirement to have an extra machine authentication to execute the denial of service or RCE means further complexity for an attacker.
He added that the chance of this being exploited by an insider who has the required credentials is sort of equal to that of an outsider. The truth is, he mentioned, if an out of doors attacker has the required authentication, a corporation would actually be in hassle.
The necessity, primarily based on the CVE, for multi degree authentication for each SNMP and a tool implies that the menace actor isn’t a script kiddie, however fairly somebody extra motivated, possible with a extra technical talent set, who can then additionally leverage that machine entry to maneuver laterally to the excessive worth methods, he mentioned.
“On the finish of the day, a Cisco machine on the edge is more likely to haven’t any firm information on it, and menace actors which can be primarily motivated by monetary features want information and system entry to exfiltrate and lock. APT [advanced persistent threat] and nation state actors current a distinct menace, in fact, however it’s possible that such environments would current further layered defenses to additional scale back the chance from this CVE.
