Weekly Threat & Vulnerabilities Report

Use of Hard-coded Credentials

CISA-KEV

OSS

Zero Day

High

Affected Product

D-Link wireless routers

Exploited-in-Wild

False

CVSS Score

8.8

EPSS Score

0.0005

CVE-2024-37902

Path traversal

CISA-KEV

OSS

Zero Day

High

Affected Product

Deep javalibrary

Exploited-in-Wild

False

CVSS Score

EPSS Score

0.00044

CVE-2024-30103

Remote Code Execution

CISA-KEV

OSS

Zero Day

High

Affected Product

Microsoft Outlook

Exploited-in-Wild

False

CVSS Score

8.8

EPSS Score

0.0005

CVE-2023-32191

Information Disclosure

CISA-KEV

OSS

Zero Day

Critical

Affected Product

Rancher Kubernetes Engine

Exploited-in-Wild

False

CVSS Score

EPSS Score

Exploit Activity and Mass Scanning Observed on Cytellite Sensors

Telemetry collected from Loginsoft sensors were analyzed and processed to derive insights on what is actively being exploited and actively being scanned. As source of truth, source IPv4 addresses & payloads can be provided on need-to-know basis.

CVE-2024-4577

CISA-KEV

Critical

Critical argument injection vulnerability in PHP on Windows servers

Affected Products

PHP-CGI on Windows

Exploited-in-Wild

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CVE-2024-1709

CISA-KEV

Critical

Authentication Bypass Vulnerability in ConnectWise ScreenConnect.

Affected Products

ConnectWise ScreenConnect

Exploited-in-Wild

ConnectWise ScreenConnect

CVE-2023-38646

CISA-KEV

Critical

Remote code execution vulnerability in Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1.

Affected Products

Metabase open source/Enterprise

Exploited-in-Wild

Metabase open source/Enterprise

CVE-2023-26801

CISA-KEV

Critical

Command injection vulnerability in LB-LINK devices.

Affected Products

LB-LINK

Exploited-in-Wild

LB-LINK

CVE-2023-1389

CISA-KEV

High

Command Injection Vulnerability in TP-Link Archer AX-21.

Affected Products

TP-Link Archer AX-21

Exploited-in-Wild

TP-Link Archer AX-21

CVE-2022-30023

CISA-KEV

High

Command injection vulnerability via the Ping function in Tenda Products.

Affected Products

Tenda Devices

Exploited-in-Wild

Tenda Devices

Vulnerabilities abused by Botnet

Identified vulnerabilities exploited by Botnets, including recent CVEs logged in Malware Information Sharing Platform (MISP). Presenting the top 5 CVEs with payloads suggestive of Botnet activities, like utilizing wget with IP addresses.

CVE-2023-1389

An unauthenticated command injection vulnerability found in the TP-Link Archer AX21 WiFi router.

Affected Product

TP-Link Archer AX21

Exploit

An unauthenticated command injection vulnerability found in the TP-Link Archer AX21 WiFi router.

Abused by Botnet

CVE-2017-17215

Remote code execution vulnerability in Huawei HG532 router

Affected Product

Huawei HG532

Exploit

Remote code execution vulnerability in Huawei HG532 router

Abused by Botnet

HinataBot
Zerobot
Mirai
Bashlite
Gitpaste
Beastmode
Enemybot
PerlBot
QakBot
Ircbot

CVE-2016-10372

Improper protocol access control vulnerability in Eir D1000 modem .

Affected Product

Eir D1000 modem

Exploit

Improper protocol access control vulnerability in Eir D1000 modem.

Abused by Botnet

Vulnerabilities Abused by Malware

We proactively monitor the vulnerabilities which are targeted by adversaries. Each vulnerability is humanly studied and mapped with Mitre ATT&CK tactics and techniques. Source of information is derived from our vulnerability intelligence platform collected and curated information from various sources such as Twitter, Telegram, OSINT groups, Blogs, Data leak sites and more.

CVE-2023-20867

Low

Authentication bypass vulnerability in VMware Tools leads to remote code execution

Patch

Authentication bypass vulnerability in VMware Tools leads to remote code execution

Targeted by Malware

UNC3886
VIRTUALPIE
VIRTUALSPHERE
VIRTUALPITA
REPTILE

CVE-2022-22948

Medium

Information disclosure vulnerability due to improper permission of files in vCenter server multiple versions

Patch

Information disclosure vulnerability due to improper permission of files in vCenter server multiple versions

Targeted by Malware

UNC3886
VIRTUALPIE
VIRTUALSPHERE
VIRTUALPITA
REPTILE

CVE-2022-41328

High

Path Traversal vulnerability in Fortinet FortiOS version 7.2.0 through 7.2.3, 7.0.0 through 7.0.9 and before 6.4.11

Patch

Path Traversal vulnerability in Fortinet FortiOS version 7.2.0 through 7.2.3, 7.0.0 through 7.0.9 and before 6.4.11

Targeted by Malware

UNC3886
VIRTUALPIE
VirtualGate
VIRTUALPITA
REPTILE
THINCRUST
CASTLETAP
TABLEFLIP

CVE-2022-42475

Critical

Heap-based buffer overflow vulnerability in FortiOS SSL-VPN and FortiProxy SSL-VPN

Patch

Heap-based buffer overflow vulnerability in FortiOS SSL-VPN and FortiProxy SSL-VPN

Targeted by Malware

UNC3886
VIRTUALPIE
VIRTUALSPHERE
VIRTUALPITA
REPTILE

‍

PRE-NVD observed for this week

It refers to vulnerabilities discovered and potentially exploited before their official inclusion in the National Vulnerability Database. The LOVI Platform aggregates and distributes data from open sources and social media, currently tracking over 100 security alerts and planning to expand.

CVE-2024-5510

Out-Of-Bounds Read

Affected Product

Kofax Power PDF

Reference

Kofax Power PDF

CVE-2024-5511

Out-Of-Bounds Read

Affected Product

Kofax Power PDF

Reference

Kofax Power PDF