Cisco finds CMP (Cisco Cluster Management Protocol) vulnerability capable of allowing a RCE (Remote Code Execution) with elevated privileges. The vulnerability affects Cisco IOS and IOS XE software (switches) that allows an attacker to gain access through malformed Telnet requests and eventually run a RCE. Look for the advisory and full list of affected products on Cisco’s page.
There is no patch, as of the date this article was written, but please keep advised of the pending update. Regardless of when the patch is out, it is always advisable to block or greatly restrict Telnet communications to priority devices.
Cisco discovered the vulnerability from the CIA’s, “Vault 7” leaks released earlier this month from Wikileaks. This may be the first public acknowledgment of an affected commercial product directly related to “Vault 7”, but it stands to reason there will be more.