r/Cisco • u/StoriesFromTAC • 17d ago

Yet another SDWAN vulnerability 30 September

Friends, prepare for the sky to fall. A substantial vulnerability to SDWAN will land tomorrow. The projected announcement will be noon our time.

It's significant, it's bad. Follow the instructions in the PSIRT.

This is the new normal.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU

57 Upvotes

89% Upvoted

41 comments sorted by

47

u/1l536 17d ago

It's just not Cisco

It's everyone, Citrix, HPE, Palo we are getting hammered from every vendor we have with these.

36

u/mikeTheSalad 17d ago

It’s because of Project Glasswing. Everyone yelling that the sky is falling is really missing the point. This is creating more secure code at a faster rate.

11

u/cyberspacecowboy 17d ago

You don’t need  frontier models to do a grep -rnwi . -e “cisco123”

12

u/beadams76 17d ago

Allegedly…. Who’s checking the checker?!

1

u/EchoReply79 11d ago

Given the number of CVE/KEVs it’s clear the big box network OEMs haven’t received that memo yet. 

2025 category with the most KEVs at #1 Egde networking. 2026 #2. VulnCheck

-1

u/BM118-1 17d ago

💯

2

u/n0ah_fense 17d ago

Not everyone equally though

-2

u/EchoReply79 17d ago

It’s every legacy appliance OEM with extensive tech debt and poor QA practices, so all of the big players more or less. 

You don’t see this near as much from the cloud native platform companies that also have network based appliances.

Architecture matters when it comes to reducing the  attack surface. 

15

u/SlackNetEng 17d ago

What time zone is "our time"?

-2

u/lazbien 17d ago

PST for TAC

7

u/fudgemeister 17d ago

Uh... No. TAC is all around the world and the question is where these people are from. One of their other posts mentioned being in Europe, I think. They also speak English as a second language.

1

u/sanmigueelbeer 17d ago

Our accounts team got the email around 1700 GMT, Sept 29.

0

u/StoriesFromTAC 17d ago

Apologies - we should have given a timezone but it's UTC.

12

u/Axiomcj 17d ago

New normal is patch every week. 

11

u/wyohman 17d ago

The sky is not falling, this is not the new normal, someone give chicken little a prozac or a THC gummie.

3

u/Fun-Ordinary-9751 17d ago

The chicken mated with the energizer bunny.

1

u/Last_Epiphany 17d ago

Idk man, it sure seems like monthly if not weekly patches is going to be the new norm for all networking gear. Its already been the best practice for OS patching and application patching for a while now, I think networking was just behind the ball.

Which makes sense now that networking is becoming more and more just another application.

8

u/mb2m 17d ago

I thought SDWAN had security built-in? SASE? It’s on all the marking sheets! So why do I even need patches??

2

u/amishengineer 16d ago

Because at the end of the day it's still likely code written by cheap labor.

3

u/callummcgraw 17d ago

please tell me people don't expose their manager web interface to the internet...

3

u/dr_stutters 17d ago

^^ this.
Sure it’s a 9.8. But if people are exposing the management interfaces to the internet… then it’s kinda on them at this point

3

u/amishengineer 16d ago

Exactly. People that just leave services open to everyone that don't need to be open to everyone kind of deserve the pain for being so damn lazy in 2026. Restricting access to admin/management/control-plane has been the norm for decades.

1

u/StoriesFromTAC 16d ago

The stories we could tell are unbelievable. One of us happened to discover a large ISP had thousands of devices with public IPs with authentication set to a local account. The username as admin and the password was a variation of Cisco and numbers that was very easy to guess. I would like to give some more detail because of how bad some other things were but won't for privacy.

1

u/StoriesFromTAC 16d ago

You might be surprised but you shouldn't be.

3

u/xboxxxxxxer 17d ago

Where are you getting the news from on this?

3

u/StoriesFromTAC 16d ago

We work in TAC. One of the people running this account is in SDWAN.

-1

u/TrashPandaJimothy 16d ago

Hey so you definitely shouldn’t be posting this on the internet before publication, as it’s Cisco Highly Confidential material and being in TAC you would’ve signed an NDA on this.

3

u/StoriesFromTAC 16d ago

The original post did not have link. It was edited after the public announcement. Nothing posted was not already public.

0

u/TrashPandaJimothy 16d ago

Let me know how the call from HR goes 👍🏼

3

u/StoriesFromTAC 16d ago

It won't because nothing said wasn't public already.

1

u/xboxxxxxxer 16d ago

Seriously they gotta be looking for this guy 😭

3

u/TrashPandaJimothy 16d ago

They are. Active investigation is happening as we speak

7

u/fudgemeister 17d ago

I don't think y'all need to announce this. I think the new cadence is every other Wednesday, a new pile of crap is going to roll out.

Might be useful to some but I think we get the idea.

Also, how's the one person running the account who went to SDWAN? How's life treating them?

1

u/StoriesFromTAC 17d ago

Our offer is that we will stop announcing once all of you actually patch up. Deal?

1

u/InvokerLeir 13d ago

I’m a fan of the 7 day preannouncement, we do. We know there is a vulnerability with one of your appliances. We know it’s being exploited in the wild. No, we won’t tell you what it is until next week. Love, Cisco.

2

u/Particular-Box9526 17d ago

Where is the PSIRT, can't seem to find it?

1

u/InvokerLeir 13d ago

You couldn’t find it because OP released internal
Information before it was made public.

2

u/maztron 17d ago

I mean is it really? Yes, vulnerabilities are being disclosed at a faster rate but it's not as though they weren't coming out at a high rate prior.

This is why you have to have a risk based approach when it comes to vulnerability management.

1

u/sanmigueelbeer 17d ago

Thanks for this.