US security researchers have discovered two flaws in the Cisco 1001-X series router that could expose sensitive data to hackers.
The first vulnerability affects Cisco’s operating system, IOS, and providers attackers with root access to the device.
After the attackers have exploited this vulnerability, they can also bypass a tool called the Trust Anchor, which assesses whether security updates are legitimate.
While the former exploit can be fixed with a software update, the latter – dubbed Thrangrycat by the Red Balloon researchers who discovered it – may require on-premise reprogramming.
Cisco warned in a security advisory that “a failure during this reprogramming process may cause the device to become unusable and require a hardware replacement”.
“To exploit this attack is not simple,” Alan Woodward, a professor of cyber security at the University of Surrey, told NS Tech. “But because there are so many devices out there that are potentially affected, it’s a problem people need to take very seriously.”
It’s feared that while the researchers have only discovered how the attack could work on one device, it may be possible to replicate it with minor alterations across a range of Cisco products.
“This could cost Cisco quite a lot of money,” said Woodward. “If they’re going to [fix it], it’s a man in a white van going around hundreds of thousands of devices and it’s a non-trivial action at each one. The nightmare scenario is you just say: ‘I want another one please.'”
A Cisco spokesperson said: “Cisco is committed to transparency. When security issues arise, we handle them openly and as a matter of top priority, so our customers understand the issue and how to address it.
“On May 13, Cisco published a security advisory about a vulnerability in the logic handling access control to one of the hardware components on Cisco’s proprietary Secure Boot implementation. Cisco is not aware of any malicious use of the vulnerability that is described in this advisory.”
The company plans to release fixes in the coming weeks and months.