Cisco Starts Rolling Out IOS XE Patches

Sunday Drivers

Yesterday Cisco made a patch available to customers which should resolve both of the vulnerabilities which were revealed last week.  The number of infected edge devices is still unclear, with Cisco suggesting tens of thousands of devices, while other sources put that number in the hundreds of thousands.  The actual number doesn’t matter, if you have Cisco kit you are almost guaranteed to be vulnerable so you should patch immediately.

The first step is to disable all HTTP(S) Server features on devices which face the internet; that should never be done in the first place but it does happen.  As for the patch itself, this being Cisco you will need to reach out to your reseller if they haven’t already reached out to you.  You won’t find this patch by searching the web, anything you find is pretty much guaranteed to be yet another hack.  It might be a bit painful to jump through their hoops, however it’s less painful than having someone else own your network.

The Register has details on some other recent security nightmares here.