ºÚÁÏÉç

On 4 October 2023, Cisco published a disclosing a critical authentication bypass vulnerability (CVE-2023-20101, CVSS: 9.8) in Cisco Emergency Responder. CVE-2023-20101 allows an unauthenticated, remote threat actor to utilise the root account (this account by default has hard coded credentials that cannot be altered) to log into an affected device.?

?

?

This vulnerability was discovered by Cisco during internal security testing. Since its disclosure, Arctic Wolf has not observed active exploitation of CVE-2023-20101 in the wild. Cisco products have become prime targets for threat actors due to the extensive access they can potentially gain within a compromised network. Arctic Wolf recently observed ransomware threat actors targeting Cisco Products; numerous other Cisco vulnerabilities have been exploited by threat actors and added to CISA¡¯s Known Exploited Vulnerabilities catalog.??

Recommendation CVE-2023-20101?

Upgrade Cisco Emergency Responder to Fixed Release??

Arctic Wolf strongly recommends upgrading Cisco Emergency Responder to the latest fixed release.??

Please follow your organisation’s patching and testing guidelines to avoid operational impact.??

References??

2. Arctic Wolf Blog (Cisco Exploitation)