Cisco patches critical vulnerability: Identity Services Engine at maximum risk

Cisco patches critical vulnerability in Identity Services Engine

Cisco has released an urgent update to fix a maximum severity vulnerability (CVSS 10.0) in its Identity Services Engine (ISE). The flaw, identified as CVE-2023-20198, allows remote code execution without authentication. The company has confirmed ongoing attacks exploiting this vulnerability, present in versions 3.1 and 3.2 of the software.

Quick Response

Technical details of the vulnerability

The vulnerability resides in the web component of ISE and can be exploited by sending maliciously crafted HTTP requests. According to Cisco's security advisory, the exploit allows attackers to bypass authentication and gain full administrative privileges on the system. The flaw is particularly dangerous because it does not require user interaction.

Impact on business security

The vulnerability CVE-2023-20198 represents a significant risk for organizations using Cisco ISE for identity and access management. A successful attack could compromise the entire security infrastructure, allowing attackers to move laterally within the network and access sensitive data. This underscores the importance of a managed SOC or a MDR service for timely detection of such threats.

Patches and mitigations

Cisco has released patches for all vulnerable versions of its Identity Services Engine. Organizations are strongly advised to apply the updates immediately. In the absence of patches, Cisco recommends disabling the ISE web interface or restricting access to port 443 through firewalls. For further technical details, you can consult the original security advisory on The Register.

Ransomware trend in the manufacturing sector

A recent report reveals that the manufacturing sector represents 22% of all ransomware victims. This data highlights how attackers continue to target industrial organizations, often for their critical supply chains and potential high payments. Protecting sensitive data thus becomes crucial, with solutions like enterprise DLP and ransomware recovery offering essential defense.

Gyazo breach: 23 million records compromised

The Japanese image-sharing service Gyazo has suffered a data breach that exposed 23 million user records. According to SecurityWeek, the compromised data includes email addresses, encrypted passwords, and personal information. The incident underscores the importance of NIS2 compliance and DORA compliance for platforms handling sensitive data.

New ransomware variant Settra exploits remote management software

The ransomware group Settra has developed a new variant that exploits MeshAgent, a remote management (RMM) software. According to Huntress Labs, this tactic allows attackers to evade traditional security systems and spread ransomware within corporate networks. Settra's ability to exploit legitimate tools makes the adoption of incident response and breach remediation solutions even more critical.

Alert on Chinese AI surveillance in Venezuela

An Australian think-tank has warned that the expansion of U.S. influence in Venezuela could expose the country to advanced AI surveillance technologies developed by China. According to The Register, these technologies could be used to monitor activists and political opponents, raising concerns about digital operational resilience and ISO 27001 certification.

Microsoft patches 18 vulnerabilities in AI and cloud products

Microsoft has released updates to fix 18 vulnerabilities in its AI and cloud products. Among these, a critical flaw in the Azure AI service allowed arbitrary code execution. According to SecurityWeek, the vulnerabilities were reported by independent researchers and have been resolved with the latest September patch cycle.

Critical vulnerability in Check Point allows code execution with root privileges

Check Point has revealed a critical vulnerability in its security software that allows attackers to execute code with root privileges. The flaw, identified as CVE-2023-41991, was discovered by researchers at Bleeping Computer. Check Point has released a corrective patch and advises users to update their systems immediately.

Reflection on a decade of attacks on critical infrastructures

Dave Bittner and Maria Varmazis have analyzed the major attacks on critical infrastructures over the past ten years, including the attack on the Ukrainian power grid and the Colonial Pipeline incident. These events have taught the industry the importance of zero trust architecture and cloud security posture to improve resilience and preparedness against emerging threats.