Weekly Threat & Vulnerabilities Report

Remote Code Execution (RCE)

CISA-KEV

OSS

Zero Day

Critical

Affected Product

NextGen Healthcare Mirth Connect

Exploited-in-Wild

NextGen Healthcare Mirth Connect

CVSS Score

9.8

EPSS Score

0.95978

CVE-2020-17519

Improper access control vulnerability

CISA-KEV

OSS

Zero Day

High

Affected Product

Apache Flink

Exploited-in-Wild

Apache Flink

CVSS Score

7.5

EPSS Score

0.97227

CVE-2024-4947

Type Confusion

CISA-KEV

OSS

Zero Day

High

Affected Product

Google Chrome

Exploited-in-Wild

Google Chrome

CVSS Score

8.8

EPSS Score

0.00229

Exploit Activity and Mass Scanning Observed on Cytellite Sensors

Telemetry collected from Loginsoft sensors were analyzed and processed to derive insights on what is actively being exploited and actively being scanned. As source of truth, source IPv4 addresses & payloads can be provided on need-to-know basis.

CVE-2023-49103

CISA-KEV

Critical

Information DisclosureVulnerability in ownCloud graphapi.

Affected Products

ownCloud graphapi

Exploited-in-Wild

ownCloud graphapi

CVE-2023-26801

CISA-KEV

Critical

Command injectionvulnerability in LB-LINK devices.

Affected Products

LB-LINK

Exploited-in-Wild

LB-LINK

CVE-2023-1389

CISA-KEV

High

Command Injection Vulnerability in TP-Link Archer AX-21.

Affected Products

TP-Link Archer AX-21

Exploited-in-Wild

TP-Link Archer AX21

CVE-2022-41040

CISA-KEV

High

Server-Side RequestForgery Vulnerability in Microsoft Exchange Server.

Affected Products

Microsoft Exchange Server

Exploited-in-Wild

Microsoft Exchange Server

CVE-2022-30023

CISA-KEV

High

Command injectionvulnerability via the Ping function in Tenda Products.

Affected Products

Tenda Devices

Exploited-in-Wild

Tenda Devices

CVE-2022-34045

CISA-KEV

Critical

Hardcodedencryption/decryption key vulnerability in Wavlink.

Affected Products

Wavlink Devices

Exploited-in-Wild

False

CVE-2022-30489

CISA-KEV

Medium

cross-site scriptingvulnerability in Wavlink Devices.

Affected Products

Wavlink Devices

Exploited-in-Wild

False

CVE-2022-25168

CISA-KEV

Critical

Command injectionvulnerability in Hadoop.

Affected Products

Apache Hadoop

Exploited-in-Wild

False

CVE-2022-24847

CISA-KEV

High

Improper inputvalidation vulnerability in GeoServer.

Affected Products

GeoServer

Exploited-in-Wild

GeoServer

CVE-2022-22947

CISA-KEV

Critical

Code InjectionVulnerability in VMware Spring Cloud Gateway.

Affected Products

VMware Spring Cloud Gateway

Exploited-in-Wild

VMware Spring Cloud Gateway

Vulnerabilities abused by Botnet

Identified vulnerabilities exploited by Botnets, including recent CVEs logged in Malware Information Sharing Platform (MISP). Presenting the top 5 CVEs with payloads suggestive of Botnet activities, like utilizing wget with IP addresses.

CVE-2023-1389

An unauthenticated command injection vulnerabilityfound in the TP-Link Archer AX21 WiFi router.

Affected Product

TP-Link Archer AX21

Exploit

An unauthenticated command injection vulnerabilityfound in the TP-Link Archer AX21 WiFi router.

Abused by Botnet

CVE-2023-26801

Command injection vulnerability in LB-LINK

Affected Product

Lb-Link Devices

Exploit

Command injection vulnerability in LB-LINK

Abused by Botnet

Mirai

CVE-2016-20016

Remote code execution vulnerability in MVPower CCTVDVR models

Affected Product

MVPower CCTV DVR models

Exploit

Remote code execution vulnerability in MVPower CCTVDVR models

Abused by Botnet

IoT-Repear

Vulnerabilities Abused by Malware

We proactively monitor the vulnerabilities which are targeted by adversaries. Each vulnerability is humanly studied and mapped with Mitre ATT&CK tactics and techniques. Source of information is derived from our vulnerability intelligence platform collected and curated information from various sources such as Twitter, Telegram, OSINT groups, Blogs, Data leak sites and more.

CVE-2024-30051

High

Elevation of Privilege (EoP) vulnerability in theDesktop Window Manager (DWM) Core Library of Microsoft Windows.

Patch

Elevation of Privilege (EoP) vulnerability in the Desktop Window Manager (DWM) Core Library of Microsoft Windows.

Targeted by Malware

‍Qakbot

CVE-2023-46805

High

Authentication bypass vulnerability in the webcomponent of Ivanti ICS 9.x, 22.x

Patch

Authentication bypass vulnerability in the webcomponent of Ivanti ICS 9.x, 22.x

Targeted by Malware

Mirai

PRE-NVD observed for this week

It refers to vulnerabilities discovered and potentially exploited before their official inclusion in the National Vulnerability Database. The LOVI Platform aggregates and distributes data from open sources and social media, currently tracking over 100 security alerts and planning to expand.

CVE-2023-50739

Heap-Based Buffer Overflow

Affected Product

Lexmark CX331adwe

Reference

Lexmark CX331adwe

CVE-2023-52718

Connection Hijacking Vulnerability

Affected Product

Huawei home routers

Reference

Huawei home routers