ZeroFox Daily Intelligence Brief - October 22, 2023

ZeroFox Daily Intelligence Brief - October 22, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup to give you and your clients an advantage over the adversary.

Brief Highlights

• Critical Vulnerabilities Uncovered in Open Source CasaOS Cloud Software
• Unpatched Cisco Zero-Day Vulnerability Actively Targeted in the Wild
• Navigating the Mis- and Disinformation Minefield in the Current Israel-Hamas War

Critical Vulnerabilities Uncovered in Open Source CasaOS Cloud Software

Two critical security vulnerabilities, CVE-2023-37265 and CVE-2023-37266, have been discovered in the open-source CasaOS personal cloud software. The flaws, both rated 9.8 out of 10 on the CVSS scale, allow attackers to bypass authentication requirements and gain full access to the CasaOS dashboard. Further, CasaOS's support for third-party applications can be exploited to execute arbitrary commands, potentially leading to persistent access and internal network compromise. Responsible disclosure led to the flaws being addressed in version 0.4.4 released on July 14, 2023.

Unpatched Cisco Zero-Day Vulnerability Actively Targeted in the Wild

Cisco has detected an active exploitation of an undisclosed zero-day vulnerability (CVE-2023-20198) in the web UI feature of Cisco IOS XE Software when exposed to the internet or untrusted networks. The flaw could allow a remote, unauthenticated attacker to create an account with privilege level 15 access, potentially gaining control over the entire system. To address this, customers are strongly advised to disable the HTTP Server feature on internet-facing systems. Additional workarounds were provided based on the system's configuration, along with indicators of compromise.

Navigating the Mis- and Disinformation Minefield in the Current Israel-Hamas War

The proliferation of mis- and disinformation adds another layer of complexity to an already sensitive issue. ZeroFox has detailed how an information war is raging on online platforms amidst the Israel-Hamas war. While the frontline is amorphous, the impact is deeply consequential. The advisory elaborates the recurring themes of mis/disinformation in the current situation and highlights some prominent examples. ZeroFox recommends exercising skepticism and verifying information through official channels before accepting it as truth.