Cisco issues patch to fix serious flaw allowing possible industrial systems takeover

• Cisco issues urgent patch for worrying security flaw
• Vulnerability could have allowed hackers to run malicious code
• Industrial systems and platforms particularly affected, so update now

Cisco has patched a critical vulnerability in some of its software which could have allowed threat actors to run malicious code remotely.

In a security advisory, Cisco said it discovered a flaw in the web-based management interface of Cisco Unified Industrial Wireless Software for Cisco Ultra-Reliable Wireless Backhaul (URWB) Access Points.

These access points are designed for industries that require highly dependable and robust wireless connections in challenging environments. They are particularly popular among industries where maintaining consistent connectivity is critical for operations, such as transportation and logistics, public safety and emergency services, utilities and energy, or mining and construction.

Cisco says update now

The bug that was discovered is tracked as CVE-2024-20418, and has a top severity score – 10/10.

“An attacker could exploit this vulnerability by sending crafted HTTP requests to the web-based management interface of an affected system,” Cisco said in the advisory. “A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the underlying operating system of the affected device.”

Cisco products vulnerable to this flaw are Catalyst IW9165D Heavy Duty Access Points, Catalyst IW9165E Rugged Access Points and Wireless Clients, and Catalyst IW9167E Heavy Duty Access Points. Products that are not working in URWB mode are not affected by vulnerability, Cisco said.

To defend against potential compromises, users are advised to…