Attackers are hijacking critical networking gear from Cisco, company warns

Legitimate ROMMON firmware replaced with maliciously modified images.

Cisco Systems officials are warning customers of a series of attacks that completely hijack critical networking gear by swapping out the valid ROMMON firmware image with one that's been maliciously altered.




The significance of the advisory isn't that the initial firmware can be replaced. As indicated, that's a standard feature not only with Cisco gear but just about any computing device. What's important is that attackers are somehow managing to obtain the administrative credentials required to make unauthorized changes that take control of the networking gear. The advisory doesn't say how the attackers are obtaining the credentials.

You must to comment.

Channel Ars Technica