Cisco Networking

Description

The security of our customers is a top priority. We invest heavily in tools, processes and technologies to keep our users and their networks safe. This includes third-party audits, features like two-factor authentication, and our out-of-band cloud management architecture. The Cisco Networking vulnerability rewards program is an important component of our overall security strategy, encouraging external researchers to collaborate with our security team to help keep our customers safe. Be sure to watch for new releases on the Cisco Developer Portal ! Ratings/Rewards For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority. Focus Areas We are specifically looking for high-impact vulnerabilities that affect the security and integrity of our platform and products. While we welcome all valid security reports, we are currently prioritizing the following areas: Insecure Direct Object Reference (IDOR): Vulnerabilities that allow unauthorized access to objects, data, or settings. Privilege Escalation: Flaws that allow a user to gain higher-level permissions (vertical or horizontal escalation). Remote code execution as root Remote root login Remote configuration injections Direct exposure of highly sensitive customer data to unauthorized parties sourced from the Meraki platform, for example, when Cisco or a Cisco employee is responsible for the exposure. This includes: Device secrets Cryptographic keys MV camera footage Customer credentials or PII Full compromise of secure boot "Packet of death" or similar mass Denial of Service

Targets

Any domain/property of Cisco not listed in the targets section is out of scope. This includes any/all subdomains not listed above. Credentials and Access Meraki Dashboard Cloud Platform Create a user account at https://meraki.cisco.com/form/demo , using your @bugcrowdninja.com email address. This will provide you with access to a demo organization and user account. To create a 2nd user-account within this demo organization, navigate to the "Organization" tab (left sidebar) and select "Administrators". We recommend creating two (2) demo organizations to test cross-account permissions and access. Please use a "+" variation of your @bugcrowdninja.com email address (example: [email protected] - for more information on @bugcrowdninja emails, see here: https://researcherdocs.bugcrowd.com/docs/your-bugcrowdninja-email-address ). Out of Scope Attacks The following attacks are excluded from the scope of our bug bounty program: Firmware/component findings without demonstrated product impact, including reports based only on extracted components, standalone binaries, open-source packages, libraries, emulated services, or test harnesses. Reports that only identify a vulnerable package version, CVE, unsafe function, crash, static-analysis result, fuzzing result, emulated behavior, test-harness result, or theoretical weakness without showing reachability, exploitability, and security impact in an in-scope product. Findings that depend on non-shipped configurations, debug or modified builds, disabled features, dead code, manually invoked internal paths, or an already-privileged state, unless the report demonstrates how an attacker can reach that condition on production hardware or through a supported customer-accessible configuration. Exposure of customer credentials where Cisco is not directly responsible for the exposure. Examples include, but are not limited to: credentials leaked due to customer or environment misconfigurations, breaches of third-party systems, data discovered on external data brokerage sites, or any incidents occurring outside of Cisco’s listed in-scope infrastructure or control. Subdomain takeover Adobe Marketo tokens Email bombing/flooding attack Deficiencies in a security feature in an on-prem product. For example, 802.1x multi auth vs multi-host on MX and MS Flaws present only when using out-of-date browsers or plugins Only current versions of Chrome, Firefox, IE, Edge are accepted Self XSS, except novel attacks Text injection Email spoofing and any form of social engineering attack Full or partial path disclosure except when a real security impact can be demonstrated Missing Secure or HTTPOnly flags on cookies, except for these sensitive cookies: dash_auth_token dash_auth devel_dash_auth two_factor_auth Login or Forgot Password page brute force and account lockout not enforced, unless it is configured in one or more of the user's organizations URL redirection Attacks by an administrator that affect the organization’s own users (e.g. malicious custom splash pages) Any attack against Cisco corporate infrastructure Discovery of any in-use service whose running version includes known vulnerabilities without demonstrating an exploit Enumeration: brute force testing any of the below for enumeration each require separate advanced notification and permission from the Cisco Networking Security Organization prior to testing. Any report which comes from unauthorized testing will be considered out of scope. Username Email Order Number Serial Number License Key Enumeration issues will generally not be in scope but for exceptional cases, e.g. ability to enumerate email addresses via incrementing a parameter. All brute force denial-of-service attacks SSL/TLS attacks Any attack which renders the device permanently inoperable Multifactor bypass for users who are already authenticated. Any attack exploitable only by an active Man in the Middle. Any XSS exploitable only by an active Man in the Middle Reflected downloads Any hardware bugs which require a debugger to recreate Vulnerabilities in open source packages less than one month old Any vulnerability not present in the most recent beta firmware of a product Feature deficiencies are excluded, for example: Missing security features (e.g. SSL/TLS on the Local Status Page), except where novel attacks can be demonstrated Bypass of Advanced Security functionality (e.g. AMP, Content Filtering) on the MX Bypass of URL blacklists on any platform Group Policy/Splash Policy bypass on all platforms, this includes firewall rule bypass in the presence of group policies If you are unsure if this exclusion applies, please ask. Vulnerabilities resulting from missing or altered public-key pins DLL injection for mobile apps Being able to enroll in a Systems Manager deployment that has enrollment authentication disabled If the root cause of a vulnerability affects multiple different endpoints, we treat it as one submission and mark reports that exploit the same vulnerability at the multiple endpoints as duplicates. Customer API keys which are used by a Cisco end user to interact with Cisco services are out of scope.

Additional information

Legal Information In addition to these Terms and Conditions regarding the Cisco Networking Bugcrowd Program (“the Program”), there may be additional restrictions depending upon applicable local laws. The parties to this Agreement are you and Cisco Networking. "Cisco Networking" refers to Cisco Systems, Inc. By participating in the Program, investigating a potential vulnerability, or submitting a vulnerability, you affirm that you have not disclosed and agree that you will not disclose the vulnerability to anyone other than Cisco Networking. Absent Cisco Networking’s prior written consent, any disclosure outside of this process would violate this Agreement. You agree that money damages may not be a sufficient remedy for a breach of this paragraph by you, and that Cisco Networking will be entitled to specific performance as a remedy for any such breach. Such remedy will not be deemed to be the exclusive remedy for any such breach but will be in addition to all other remedies available at law or equity to Cisco Networking. By submitting information about a potential vulnerability, you are granting Cisco Networking a worldwide, royalty-free, non-exclusive license to use your submission for the purpose of addressing vulnerabilities in Cisco Networking’s products and services. In the event of substantially duplicate submissions, Cisco Networking may at its discretion provide a reward only for the earliest received submission. Eligibility for rewards, determination of the recipients, and amount of reward is at the discretion of Cisco Networking. If issues reported to the Program affect a third party or another vendor, Cisco Networking reserves the right to forward details of the issue along to the party without further discussion with the researcher. You are responsible for all taxes associated with and imposed on any reward you may receive from Cisco Networking. You may only exploit, investigate, or target vulnerabilities against your own accounts and/or your own devices. Testing must not violate any law, or disrupt or compromise any data or access data that is not yours; intentional access of customer data other than your own is prohibited. If you inadvertently access proprietary customer, employee, or business-related information during your testing, the information must not be used, disclosed, stored, or recorded in any way. In the event of inadvertent access to such data, you must delete such data immediately and notify Cisco Networking of such inadvertent access within your submission. Your testing activities must not negatively impact Cisco Networking, Cisco Networking’s products or services generally, or Cisco Networking’s online environment availability or performance. Cisco Networking may choose not to remediate at its sole discretion. This Agreement constitutes the entire agreement of the parties with respect to the items listed above. This Agreement is covered by California law. This Agreement may be amended or modified only by a subsequent agreement in writing. If any portion of this Agreement is found to be illegal or unenforceable, then the parties will be relieved of their responsibilities arising under such portion, but only to the extent that such portion is illegal or unenforceable. You must not be the author of the code with the vulnerability. You must not be an employee or contractor of Cisco Networking or its affiliates, or a family member of an employee or contractor. CISCO NETWORKING RESERVES THE RIGHT TO MODIFY OR CANCEL THIS PROGRAM AT ANY TIME WITHOUT NOTICE. ALL PARTICIPANTS AND SUBMISSIONS ARE STRICTLY VOLUNTARY. THIS OFFER IS VOID WHERE PROHIBITED BY LAW AND IN PARTICIPATING, YOU MUST NOT VIOLATE ANY LAW. YOU ALSO MUST NOT DISRUPT ANY SERVICE OR COMPROMISE ANYONE’S DATA.

Cisco Meraki Dashboard Platform Targets (in scope)

By way of clarification, the following is additional information on some of the domains that are in scope, and details around how they are used: *.ikarem.io: This domain is used for Meraki internal services, and as such, falls under the higher reward range. *.meraki.com: This domain is for the Cisco Meraki Dashboard and its integrated services. *.network-auth.com: This domain hosts user-created content for Dashboard-configured splash pages. Further public documentation can be found at https://documentation.meraki.com . Additionally, documentation for the Cisco Meraki Dashboard API can be found at https://create.meraki.io/api-docs/ . It's further worth noting that: Most products run a light web server which offers the ability to locally configure the uplink of a device, as well as to see some very basic device status information. However, the Dashboard is the ultimate administrative interface for devices, as well as the primary source for device monitoring. This is touched on in the focus areas section, but any way of obtaining shell access on a Meraki device is an interesting finding to our team — as there should be no way for a user to meaningfully authenticate to a device. In regards to obtaining firmware images, users may configure, via the Dashboard, a firmware version for a device to run and the device will automatically download and install the new version. More information on that can be found in our firmware FAQ.

Cisco Meraki Devices (Hardware & Firmware) (in scope)

We welcome research into in-scope hardware, virtual devices such as Cisco Meraki vMX, device firmware, bootloaders, services, libraries, open-source packages, and other shipped components. Component-level analysis is valuable supporting evidence when it helps identify reachable security issues in shipped products. Eligibility Requirements Reports must demonstrate product-relevant security impact on an in-scope product in a real-world or production-equivalent context. Strong reports should include: affected in-scope product and firmware/software version; affected component, package, binary, code path, or boot path; attacker position and prerequisites; reachable input or execution path in the product; concrete security impact; reproduction steps on real hardware or in a production-equivalent environment, or a clear explanation of why equivalent evidence is sufficient. We encourage researchers to submit well-supported work even when a full exploit is difficult, provided the report clearly separates what has been confirmed on an in-scope product from what is inferred from component-level analysis. When full exploitation is not practical, please provide the strongest evidence available and explain what would be needed to complete validation. Firmware and Component Reachability Component-level evidence, such as reverse engineering, static or dynamic analysis, emulation, fuzzing, extracted component testing, debugger output, or test harnesses, is useful supporting evidence. However, it is not sufficient by itself for bounty eligibility unless the report maps the issue to reachable, exploitable behavior in an in-scope product. Reports should explain how attacker-controlled input or execution reaches the affected code path and how the issue affects confidentiality, integrity, availability, product trust, or customer security posture. If real hardware reproduction is not provided, explain why the evidence is production-equivalent for the claimed impact, such as matching shipped firmware, configuration, exposed paths, and runtime mitigations. Findings that depend on privileged, debug, modified, or non-default states should explain how an attacker obtains that state on production hardware or through a supported customer-accessible configuration. These states are usually prerequisites rather than security impact by themselves, unless the report demonstrates a separate real-world attack path. Hardware Notes Shell Access: Any method of obtaining shell access on a Cisco Meraki device is considered a high-priority finding, as there should be no mechanism for a user to meaningfully authenticate to a device. Firmware Images: Researchers may configure a specific firmware version for a device to run via the Dashboard, which will trigger the device to automatically download and install the selected version. For more details, please refer to our firmware FAQ.

Out of Scope (out of scope)

This program is designed to review and address security issues related to specific Cisco Networking products and applications. Please note that anything that is not explicitly listed as in-scope is considered out-of-scope. Additionally, vulnerabilities specifically related to Adobe Marketo tokens are no longer accepted and will be considered out of scope. If you believe you have found a vulnerability that is outside of this program scope but related to Cisco, please refer to the below resources: If you need to report a vulnerability in a Cisco product not listed as in-scope for this program, please contact [email protected]. If you need to contact Cisco regarding a security incident, please contact [email protected]. Cisco Systems Operational Infrastructure findings can be reported here: https://bugcrowd.com/ciscosecurity Further information can be found here: https://www.cisco.com/security Temporarily Out of Scope We are temporarily not accepting submissions related to certain DNS issues, specifically including DNS configuration problems and dangling DNS records or zones.