tag: Network-Infrastructure · 8 items
- Engineer — Plan: If your organization runs Aruba switches or wireless gear, schedule patching of ArubaOS to address eight CVSS 10 auth bypass and RCE issues; no active exploitation or public PoC is confirmed yet, so this fits a near-term patch window rather than emergency response.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Plan: Five critical RCE-to-root flaws in NX-OS affect data center Nexus switches; no KEV listing or public PoC yet. Confirm whether Nexus switches are in scope, then schedule patching against Cisco’s advisory within the next maintenance window.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Act: CISA KEV listing confirms active exploitation of Zyxel GS1900 series switches; if any are in your environment, patch immediately and audit management-plane access logs for signs of unauthorized access.
- SOC/IR — Act: Active exploitation for data theft means assume-compromise posture on any Zyxel GS1900 devices; hunt for anomalous traffic or config changes originating from or through these switches since KEV listing date.
- Leader — Plan: Confirm whether Zyxel GS1900 switches appear in network inventory and verify patching is prioritized this week; federal agencies face a hard CISA deadline, but private-sector organizations should treat this as elevated-urgency given confirmed exploitation.
- Engineer — Plan: Patch ArubaOS-CX to the fixed version HPE released; no KEV listing or public PoC signals active exploitation, but a critical RCE on network OS warrants scheduled patching this quarter.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Act: Public PoC on GitHub for an unauthenticated root RCE on widely deployed data-center switches raises exploitation risk even with low EPSS; apply Cisco’s Nexus 9000 patch now and separately assess IOS XR exposure for the two 9.8-rated CVEs that have no available workaround.
- SOC/IR — Plan: No active exploitation confirmed yet, but the public PoC means attempts are likely imminent; build detections for anomalous access to Nexus 9000 management interfaces and prepare a hunt query baseline now before KEV listing forces a reactive response.
- Leader — Plan: Unauthenticated root RCE on core network switches with a public PoC is a meaningful risk-register item; confirm your network team has the Nexus 9000 patch cycle scheduled and note the IOS XR exposure for environments running that platform.
- Signals: CVE-2026-20212 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: Fire Ant is actively implanting GRE tunnel interfaces on Cisco IOS XR routers that persist invisibly outside running configuration and commit history — audit all IOS XR devices for unexplained GRE interfaces and cross-check interface state against configuration databases.
- SOC/IR — Act: Active Chinese APT campaign against network edge devices warrants an assume-breach sweep; hunt for GRE tunnel interfaces on IOS XR routers that lack corresponding config entries, and look for anomalous GRE-encapsulated flows in NetFlow or firewall logs.
- Leader — Plan: A Chinese state-sponsored actor is using Cisco IOS XR routers as persistent espionage platforms — confirm whether IOS XR is in your environment, task the network team with an audit, and flag this to leadership given the espionage implications for sensitive traffic traversing core routing infrastructure.
- Engineer — Act: Maximum-severity command injection in VeloCloud Orchestrator is actively exploited — if you run on-premises VeloCloud Orchestrator, patch immediately and audit for signs of compromise.
- SOC/IR — Act: Active exploitation of a max-severity edge orchestrator means assume-breach posture for any environment running on-prem VeloCloud Orchestrator — hunt for anomalous command execution or lateral movement from those hosts since before the patch date.
- Leader — Act: A maximum-severity zero-day actively exploited in SD-WAN infrastructure warrants immediate confirmation of whether VeloCloud Orchestrator is in use on-premises, and if so, direct the team to patch and assess exposure before this surfaces as a board-level incident.
- Engineer — Plan: Dnsmasq is embedded in Kubernetes nodes, containers, and network appliances at scale; six CERT-issued serious CVEs warrant auditing all deployments and scheduling patches as soon as vendor-specific builds are available — no exploitation signals yet, but the network-accessible attack surface (DNS/DHCP) is historically high-value.
- SOC/IR — Skip
- Leader — Learn: Noteworthy as a potential systemic risk given dnsmasq’s ubiquity in Linux and embedded network gear, but without confirmed exploitation or a Log4Shell-scale event there is no leadership action required today — confirm teams are tracking patches.