Cisco email gateway hit by active attacks granting root access

En bref

• Active exploitation of Cisco Secure Email Gateway observed on Wednesday.
• Attackers need only send a crafted attachment to trigger the flaw.
• Successful exploitation allows OS file writes and root-level command execution.
• Appliance compromise can lead to bypassed email filtering and further network access.
• No CVE identifier has been assigned yet.

On Wednesday, reports surfaced that a critical vulnerability in Cisco's Secure Email Gateway is being actively exploited by unauthenticated senders. Attackers can deliver a specially crafted attachment through email, triggering the flaw without any credentials.

Once exploited, the vulnerability permits writing arbitrary files to the underlying operating system. This escalates to root command execution, giving attackers full control over the appliance. The compromise is complete: the email gateway, which normally filters incoming messages, can be turned against the organization.

The impact is severe for K-12 and government entities relying on Cisco email security. A compromised gateway can be used to intercept, alter, or block email flows, and it may serve as a pivot point into internal networks. The active exploitation indicates that threat actors are already weaponizing this flaw in the wild.

As of now, no CVE identifier has been published, which complicates tracking and patching efforts. Administrators should treat this as an urgent risk despite the medium severity rating. The lack of a CVE does not diminish the potential for full appliance takeover.

What to watch: Cisco advisories for patches, signs of unusual file writes or root processes on the gateway, and any unexpected email filtering changes. Until a fix is available, mitigation measures like network segmentation and strict attachment handling are essential.

À faire maintenant

1. Apply the latest Cisco security updates for Secure Email Gateway as soon as they are released.
2. Monitor appliance logs for unauthorized file modifications or root command execution attempts.
3. Segment the email gateway from other critical systems to limit lateral movement if compromised.
4. Enforce strict attachment filtering and sandboxing to block crafted files from reaching the gateway.
5. Review and restrict administrative access to the appliance, using MFA and least privilege.
6. Subscribe to Cisco security advisories and threat intelligence feeds for updates on this flaw.
7. Conduct a forensic review if you suspect exploitation, focusing on OS-level changes.

Source originale

The Hacker News