Cisco Vulnerability Exposes URWB Access Points to Command Injection Attacks

Cisco has recently addressed a serious vulnerability that poses a significant risk to Ultra-Reliable Wireless Backhaul (URWB) access points, which are crucial for industrial wireless automation. This flaw, tracked as CVE-2024-20418, allows attackers to execute commands with root privileges on affected devices, potentially leading to severe security breaches.

The Vulnerability

The vulnerability was identified in Cisco’s Unified Industrial Wireless Software, specifically within its web-based management interface. It is classified as a high-severity issue because it enables unauthenticated attackers to perform low-complexity command injection attacks without any user interaction. Cisco described the flaw as stemming from inadequate input validation in the management interface. By sending specially crafted HTTP requests, an attacker can manipulate the system, gaining root access to the device’s operating system.

Affected Devices

The security advisory issued by Cisco highlights that this vulnerability affects several models of access points, including:

• Catalyst IW9165D Heavy Duty Access Points
• Catalyst IW9165E Rugged Access Points and Wireless Clients
• Catalyst IW9167E Heavy Duty Access Points

However, these devices are only vulnerable if they are operating with the URWB mode enabled and are running the affected software versions.

Assessing Your Risk

To determine if the URWB mode is enabled on your devices, administrators can use the command line interface (CLI) command “show mpls-config.” If this command is unavailable, it indicates that URWB mode is disabled, and the device is not susceptible to this vulnerability.

No Evidence of Active Exploits

As of now, Cisco’s Product Security Incident Response Team (PSIRT) has not found any publicly available exploit code nor confirmed instances of this vulnerability being actively exploited in the wild. However, given the potential severity of the issue, immediate attention to this flaw is warranted.

Recent Cisco Security Updates

This vulnerability is part of a broader trend of security challenges that Cisco has been addressing. In July, the company released patches for a denial-of-service flaw in its Cisco ASA and Firepower Threat Defense (FTD) software, which had been exploited in large-scale brute-force attacks targeting Cisco VPN devices. This highlights the growing need for robust security measures, especially given the increasing sophistication of cyber threats.

Additionally, just a month earlier, Cisco had issued security updates for another command injection vulnerability that had public exploit code. This vulnerability allowed attackers to escalate privileges to root on compromised systems. The rapid succession of these vulnerabilities has drawn attention from cybersecurity agencies.

Industry Response

In light of recent attacks targeting Cisco, Palo Alto, and Ivanti network edge devices, agencies like CISA (Cybersecurity and Infrastructure Security Agency) and the FBI have urged software companies to address OS command injection vulnerabilities proactively. These efforts aim to bolster the security of network devices before they are deployed in operational environments.