As Many as 2m Cisco Devices Affected by Actively Exploited 0-Day

Anyways, Cisco hasn’t done great engineering pretty much since the dotcom bust. They’re now essentially a giant PE firm that grows through acquisitions and then milks them dry. It’s a classic case of the accountants took over.

Network infrastructure security has a lot of unsolved gotchas and not a lot of industry desire to fix. Most of what everyone interacts with is in an abstracted or virtualized layer on top of the old plumbing.

How did the attacker get the community string?

For smaller operations I think just disabling SNMP is safer due to constant bugs and issues.

On the other hand bigger operations, you gotta monitor your devices. But now you’re open to the can of worms.

Depends what you mean by "expose". Some people could read that as "exposed to the Internet". I'm reading it as "exposed to anything".

This looks like a good fun for doing lateral movement inside a network. I know of lots of environments with SNMPv2 wide open for "internal" networks to access.

Plus SNMP is UDP-based, so likely the exploit will work with a one-way path and spoofed source addresses.