CDPwn: Taking Over Millions of Enterprise-Things with Layer 2 Zero-Days
summary
Five zero-days in Cisco’s CDP implementation let attackers get remote code execution on Nexus, IOS‑XR and NX‑OS devices and on Cisco IP phones and cameras, impacting an estimated tens of millions of devices. Exploits include integer and stack overflows and malformed TLVs, crashing switches into bootloops and creating root shells to add users and change VLANs. A custom ASLR bypass called polyrop and 32‑bit ROP techniques make exploitation reliable; working demos show call exfiltration and even ran Doom on compromised phones.
AI-written summary · about
chapters (5)
- 0:00Start
- 5:34Double VLAN Tagging
- 8:30CDPwning the Core Switch
- 13:24CDP 1-day - Address update state confusion
- 17:42NX-OS Take-over-Ethernet
related talks
35mLCDPwn: Breaking Enterprise-Things with Layer 2 Discovery Protocol Vulnerabilities Again
44mCritical Zero Days Remotely Compromise the Most Popular Real-Time OS
34mCoDe16; 16 Zero-Day Vulnerabilities Affecting CODESYS Framework Leading to Remote Code Execution
50mPwnie Awards 2016
40mSomething Rotten in the State of Data Centers
47mBLEEDINGBIT: Your APs Belong to Us
44mExposing Critical Threats In Millions Of Connected Devices
31mZero-Touch-Pwn: Abusing Zoom's Zero Touch Provisioning for Remote Attacks on Desk Phones