Cisco has warned customers that hackers have been using stolen administrator credentials to install malicious software on networking devices running IOS.
IOS is the operating system that runs on most Cisco routers and switches. When these devices are powered on or rebooted, the hardware is initialized and the IOS software is booted by a bootstrap program called ROM Monitor (ROMMON).
According to an advisory published by the company, attackers are replacing the legitimate ROMMON firmware with a malicious ROMMON image. Once the device is rebooted with the new ROMMON, attackers are able to manipulate its behavior.
“In all cases seen by Cisco, attackers accessed the devices using valid administrative credentials and then used the ROMMON field upgrade process to install a malicious ROMMON,” Cisco said in its advisory.
By installing a malicious image, attackers can ensure that they have control over the device even after a reboot. Cisco said it’s aware of a limited number of such attacks.
The company has pointed out that the ability to install a new ROMMON image on an IOS device is a standard, documented feature. Malicious actors can abuse this feature by stealing administrator credentials or by gaining physical access to the targeted device.
Since the attacks observed by Cisco don’t involve any vulnerabilities, no CVE identifier has been assigned.
Cisco advises customers to read available documentation on protecting IOS devices against cyber threats.
Related Reading: Cisco Fixes DoS Vulnerabilities in IOS Software
Related Reading: Cisco Fixes DoS Vulnerability Affecting Carrier Routing Systems
Related Reading: Cisco Fixes DoS Vulnerabilities in IOS Software