Week of October 23, 2023: Cisco IOS XE KEV Additions and Okta Breach Fallout

Security leaders watched Cisco's IOS XE web UI vulnerabilities dominate advisories as CISA added CVE-2023-20273 to its Known Exploited Vulnerabilities Catalog and later confirmed fixes for additional release trains, while fallout from the Okta Support System breach reached password manager 1Password. CISA also paired with HHS to launch a healthcare-sector cybersecurity toolkit, VMware disclosed vCenter Server flaws, and nine industrial control systems advisories were released, giving CISOs a dense week of patch and incident tracking.

CISA Adds Cisco IOS XE Flaw to KEV Catalog

On October 23, 2023, CISA added CVE-2023-20273, a command injection vulnerability in the Cisco IOS XE Web UI, to its Known Exploited Vulnerabilities Catalog after confirming active exploitation. Under Binding Operational Directive 22-01, federal civilian agencies were required to remediate the flaw by a set due date. The addition followed Cisco's disclosure that attackers used the vulnerability alongside an earlier flaw, CVE-2023-20198, to install a persistent implant on internet-facing network devices running the affected software. (CISA)

CISA Updates Cisco IOS XE Patch Guidance Again

On October 27, 2023, CISA revised its guidance on CVE-2023-20198 and CVE-2023-20273 after Cisco published a fix for the 17.6 IOS XE release train, version 17.6.6a. The agency noted that patches for the 17.3 and 16.12 Catalyst 3650/3850 trains remained undetermined, and urged organizations running the 17.9 and 17.6 trains to update immediately to 17.9.4a and 17.6.6a respectively to close the web UI vulnerabilities used in recent intrusions. (CISA)

Roundcube Webmail XSS Flaw Joins KEV Catalog

On October 26, 2023, CISA added CVE-2023-5631, a persistent cross-site scripting vulnerability in Roundcube Webmail, to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. The listing triggered Binding Operational Directive 22-01 remediation deadlines for federal civilian executive branch agencies, and CISA again urged all organizations to prioritize timely patching of catalog vulnerabilities as part of routine vulnerability management practice. (CISA)

VMware Discloses vCenter Server Out-of-Bounds Write Flaws

VMware issued a security advisory on October 26, 2023 covering two vCenter Server vulnerabilities, CVE-2023-34048 and CVE-2023-34056, warning that a remote actor could exploit the out-of-bounds write issue to take control of an affected system. CISA encouraged administrators to review VMware's advisory and apply the necessary updates, flagging the flaws as a priority for organizations running vCenter Server in production environments. (CISA)

Okta Support System Breach Reaches 1Password

On October 24, 2023, 1Password disclosed that it had been affected by the Okta Support System breach, following earlier disclosures from BeyondTrust and Cloudflare. 1Password's CTO said suspicious activity was detected on its Okta instance used for employee-facing apps on September 29, and that the company found no compromise of user data after investigating. The incident stemmed from an attacker accessing Okta's support case management system using a stolen credential. (Help Net Security)

CISA and HHS Launch Healthcare Cybersecurity Toolkit

On October 25, 2023, CISA and the Department of Health and Human Services co-hosted a roundtable and released a joint Cybersecurity Toolkit for Healthcare and Public Health, consolidating resources such as CISA's Cyber Hygiene Services and HHS's Health Industry Cybersecurity Practices. CISA Deputy Director Nitin Natarajan said the agency had conducted pre-ransomware notifications to over 65 U.S. healthcare organizations in 2023 to warn of early-stage ransomware activity before encryption occurred. (CISA)

CISA Publishes Nine ICS Advisories

CISA released nine Industrial Control Systems advisories on October 26, 2023, covering products including Dingtian DT-R002, Centralite Pearl Thermostat, Rockwell Automation Arena, FactoryTalk View Site Edition, FactoryTalk Services Platform, Sielco PolyEco and Radio Link FM transmitters, and an updated advisory for the BD Alaris System with Guardrails Suite MX. The advisories detailed current vulnerabilities, exploits, and mitigations for operators of affected industrial control system equipment. (CISA)