As explained in Cisco’s advisory, Cisco noted that the affected servers were running the vulnerable salt-master service. Hence, the two SaltStack vulnerabilities disclosed earlier this month allowed the hackers to breach Cisco servers.
As stated in the advisory,
Cisco Product Security Incident Response Team (PSIRT) became aware of additional attempted exploitation of these vulnerabilities in the wild.Consequently, the breach affected the Cisco Modeling Labs Corporate Edition (CML) and VIRL-PE.
Specifically, the affected servers were servicing the Cisco VIRL-PE releases 1.2 and 1.3. The compromised servers include,
According to the vendors, the two products Cisco CML and VIRL-PE can either work as a standalone deployment or in cluster mode. Hence, Cisco patched the fixes for both deployment options with the release of Cisco CML and Cisco VIRL-PE software releases 2.0 that do not run salt-master service.
Considering the attempts of exploitation in the wild, Cisco has urged all the users to update the software releases immediately. For this, users can check the salt-master service status using the instructions given in Cisco’s advisory.
SaltStack vulnerabilities surfaced online earlier this month. Shortly after the disclosure, hackers began exploiting the bugs for targeting various corporate networks. Consequently, LineageOS – a mobile OS vendor, Digicert – certificate authority, Ghost blogging platform, Xen Orchestra, and Algolia search service, reported hacking attacks.
