topic Re: Cisco IOS and IOS XE Software Cluster Management Protocol Remote C in Network Security

Cisco IOS and IOS XE Software Cluster Management Protocol Remote Code

dissai — Thu, 07 Mar 2024 10:08:44 GMT

Dear Friends,

I'm looking for solution to resolve below vulnerability for Cisco router ISR4331

Cisco IOS and IOS XE Software Cluster Management Protocol Remote Code Execution Vulnerability (cisco-sa-20170317-cmp)

I have attached the screen shot.

Regards

Re: Cisco IOS and IOS XE Software Cluster Management Protocol Remote C

Rob Ingram — Thu, 07 Mar 2024 10:16:10 GMT

@dissai

Disabling the Telnet protocol as an allowed protocol for incoming connections would eliminate the exploit vector. Disabling Telnet and using SSH is recommended by Cisco. Information on how to do both can be found on the Cisco Guide to Harden Cisco IOS Devices.

refer to this advisory - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170317-cmp

Re: Cisco IOS and IOS XE Software Cluster Management Protocol Remote C

dissai — Thu, 07 Mar 2024 10:21:36 GMT

Hello Roby,

See below output. I have not allowed telnet and still I'm getting the
vulnerability query.

SERVICE-RT#
SERVICE-RT#show run | sec line vty
line vty 0 4
exec-timeout 60 0
privilege level 15
transport input ssh
transport output none
line vty 5 15
exec-timeout 60 0
privilege level 15
transport input ssh
transport output none
SERVICE-RT#

Another router has the same issue.

line vty 0 4
transport input ssh
transport output ssh
line vty 5
privilege level 15
transport input ssh
transport output ssh
line vty 6 14
transport input ssh
line vty 15
session-timeout 10 output
transport input ssh

Re: Cisco IOS and IOS XE Software Cluster Management Protocol Remote C

Rob Ingram — Thu, 07 Mar 2024 10:33:17 GMT

@dissai From your output you've enabled only SSH on all VTY lines and from that link I provided:-

The SSH protocol is the only protocol enabled for incoming connections on all VTYs. No Telnet connections are possible to any VTY on the device while using this configuration. This configuration is not vulnerable.

Switch#show running-config | include ^line vty|transport input
line vty 0 4
 transport input ssh
line vty 5 15
 transport input ssh
Switch#

I suggestion would be to upgrade your software to remove the vulnerability.

You should as a best practice have a VTY ACL restricting trusted networks to connect on SSH only.