Catalyst switches

[r00igev@@r]

Reports are they going TITSUP left, right and centre.

Edit: Being exploited in the wild - https://github.com/frostbits-security/SIET

 

[syntax]

This is not a particularly useful post.
There are so many models and variants, which ones exactly? What is going wrong, under what circumstances

 

[JohnStarr]

This is not a particularly useful post.
There are so many models and variants, which ones exactly? What is going wrong, under what circumstances

Generalising isn't the best way to get any point across. I've known Catalyst switches to last for donkeys years. Been decommed for a while, but turn them on and they continue running like nothing ever happened and it's 2002!

 

[r00igev@@r]

Here we go:

https://twitter.com/x/status/1392921251090370562

 

[gregmcc]

Reports from who?

 

[gregmcc]

So switches exposed to the internet running old code. What could go wrong.

It's also not specific to Catalyst switches, but Cisco IOS.

 

[r00igev@@r]

Reports from who?

Few forums. They also exploited those on private IPs where they have infiltrated the perimeter.

 

[irBosOtter]

Smart install is the first thing that gets disabled on any Cisco IOS when setup, or else the switch/router will not pass pci compliance scans, or any seurity scan for that matter. Been like this for years, strage that it was never disabled on that one.