SolarWinds Orion Platform Supply Chain Attack

Available Languages

Updated:December 14, 2020
Document ID:1607983510441145

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Cisco Security Advisory

SolarWinds Orion Platform Supply Chain Attack

Informational
Advisory ID:
cisco-sa-solarwinds-supply-chain-attack
First Published:
2020 December 14 22:00 GMT
Last Updated: 
2020 December 15 18:11 GMT
Version 1.2:
Interim
Workarounds:
No workarounds available

Summary

  • Due to the recent announcement by SolarWinds regarding compromises in their supply chain, SolarWinds has released a security advisory providing guidance on assessing and remediating this issue: https://www.solarwinds.com/securityadvisory

    Cisco recommends that customers assess if they have used an affected version of SolarWinds Orion Platform and, if so, take the following actions:

    1. Follow the guidance provided by the U.S. Department of Homeland Security and in the SolarWinds Security Advisory.
    2. Determine the need to change credentials on all devices being managed by the affected SolarWinds platform software. This includes:
      • User credentials
      • Simple Network Management Protocol (SNMP) version 2c community strings
      • SNMP version 3 user credentials
      • Internet Key Exchange (IKE) preshared keys
      • Shared secrets for TACACS, TACACS+, and RADIUS
      • Secrets for Border Gateway Protocol (BGP), OSPF, Exterior Gateway Routing Protocol (EIGRP), or other routing protocols
      • Exportable RSA keys and certificates for Secure Shell (SSH) or other protocols

    While there are no vulnerabilities in Cisco products related to this issue, if a customer was using an affected version of SolarWinds Orion Platform and would like to investigate potential impact to Cisco devices, Cisco has published a number of documents that can help the investigation. Please consult https://tools.cisco.com/security/center/resources/ir_escalation_guidance.

    Cisco TALOS has also published guidance regarding this issue that can be viewed here: https://blog.talosintelligence.com/2020/12/solarwinds-supplychain-coverage.html

    Customers that need assistance with Incident Response activities can contact Cisco TALOS here: https://talosintelligence.com/incident_response

    Cisco will update this advisory as needed, if additional information becomes available.

Cisco Security Vulnerability Policy

  • To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.

Subscribe to Cisco Security Notifications

URL

Revision History

  • Version Description Section Status Date
    1.2 Updated text to include additional source. Summary Interim 2020-DEC-14
    1.1 Updated Talos link. Summary Interim 2020-DEC-14
    1.0 Initial public release. — Interim 2020-DEC-14
    Show Less

Cisco Security Vulnerability Policy

  • To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.

Subscribe to Cisco Security Notifications