The FBI has issued a warning regarding the ongoing exploitation of a seven-year-old vulnerability in Cisco networking devices by Russian state-sponsored hackers linked to the Federal Security Service (FSB). The group, known as Static Tundra, has been leveraging the CVE-2018-0171 vulnerability in Cisco's Smart Install feature to gain unauthorized access to thousands of devices associated with U.S. critical infrastructure sectors, including energy, transportation, and utilities. 'In the past year, the FBI detected the actors collecting configuration files for thousands of networking devices associated with US entities across critical infrastructure sectors,' stated the FBI in its advisory.
The vulnerability, which has a CVSS score of 9.8, allows unauthenticated attackers to remotely execute arbitrary code or trigger denial-of-service conditions on affected devices. Cisco Talos has highlighted that Static Tundra has been operational for over a decade and is regarded as a sub-cluster of a broader group known as Energetic Bear. According to Cisco's findings, the group has been systematically targeting organizations based on their strategic relevance to Russia, particularly focusing on sectors such as telecommunications, education, and manufacturing, with an increase in attacks against Ukrainian entities since the onset of the Russo-Ukrainian conflict.
Experts have noted that the exploitation of legacy vulnerabilities, such as CVE-2018-0171, remains prevalent due to the reluctance of many organizations to patch outdated systems. 'Threat actors will continue to abuse devices which remain unpatched and have Smart Install enabled,' said a cybersecurity analyst. The FBI's findings indicate that the attackers modified configuration files on vulnerable devices to establish persistent unauthorized access, allowing them to conduct extensive reconnaissance within victim networks.
Industry responses have included calls for immediate patching of affected systems and heightened vigilance regarding network security. Cisco has urged organizations to prioritize updating their devices and to implement defensive measures to mitigate these risks. The FBI has also recommended that organizations review their network configurations and ensure that outdated devices are either upgraded or taken offline to reduce vulnerabilities. 'Organizations must take proactive steps to secure their infrastructure against these persistent threats,' emphasized a security official.
Moving forward, organizations are advised to install patches for CVE-2018-0171 and to ensure that all Cisco devices are updated to the latest firmware versions. Regular audits of network configurations and security posture are also recommended to identify and address vulnerabilities proactively.
