Threat Source newsletter for Oct. 1, 2020
Summary: Cisco Talos researchers reported a spike in exploitation attempts against CVE-2020-1472, an elevation-of-privilege flaw in Netlogon outlined in Microsoft's August Patch Tuesday report, which lets attackers forge an authentication token and impersonate any computer, including the domain controller, to gain domain admin credentials. Cisco also patched several vulnerabilities in its IOS operating system, many considered severe, addressing denial-of-service, file overwrite and input validation attacks, including CVE-2020-3421 and CVE-2020-3480 in Zone-Based Firewall that could cause a device to reload or stop forwarding traffic.
Why it matters: A flaw that lets an attacker impersonate the domain controller itself and walk away with domain admin credentials is a direct path to controlling the whole network, and Talos is seeing exploitation attempts rise.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2020-1472
- Related
- CVE-2020-1472: Microsoft Netlogon Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021