Weekly Threat & Vulnerabilities Report

Information Disclosure Vulnerability

CISA-KEV

OSS

Zero Day

High

Affected Product

Check Point Quantum Security Gateways

Exploited-in-Wild

Check Point Quantum Security Gateways

CVSS Score

8.6

EPSS Score

0.94504

CVE-2024-1086

Use-after-free vulnerability

CISA-KEV

OSS

Zero Day

High

Affected Product

Linux Kernel

Exploited-in-Wild

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CVSS Score

7.8

EPSS Score

0.00969

CVE-2017-3506

Code execution vulnerability

CISA-KEV

OSS

Zero Day

High

Affected Product

Oracle WebLogic Server

Exploited-in-Wild

CISA Adds One Known Exploited Vulnerabilities to Catalog

CVSS Score

7.4

EPSS Score

0.8686

Exploit Activity and Mass Scanning Observed on Cytellite Sensors

Telemetry collected from Loginsoft sensors were analyzed and processed to derive insights on what is actively being exploited and actively being scanned. As source of truth, source IPv4 addresses & payloads can be provided on need-to-know basis.

CVE-2024-3273

CISA-KEV

High

CommandInjection Vulnerability in D-Link NAS devices

Affected Products

D-Link DNS devices

Exploited-in-Wild

D-Link DNS devices

CVE-2023-49103

CISA-KEV

Critical

Information DisclosureVulnerability in ownCloud graphapi

Affected Products

ownCloud graphapi

Exploited-in-Wild

ownCloud graphapi

CVE-2023-46747

CISA-KEV

Critical

F5 BIG-IP ConfigurationUtility Authentication Bypass Vulnerability

Affected Products

F5 BIG-IP

Exploited-in-Wild

CISA Adds Two Known Exploited Vulnerabilities Catalog

CVE-2023-4415

CISA-KEV

High

ImproperAuthentication vulnerability in Ruijie RG-EW1200G 07161417 r483

Affected Products

Ruijie RG-EW1200G 07161417 r483

Exploited-in-Wild

False

CVE-2023-23752

CISA-KEV

Medium

Joomla! Improper AccessControl Vulnerability

Affected Products

Joomla

Exploited-in-Wild

Joomla

CVE-2023-4966

CISA-KEV

High

Buffer Overflow Vulnerability in Citrix NetScaler ADC andNetScaler Gateway

Affected Products

Citrix Netscaler

Exploited-in-Wild

CISA Adds Two Known Exploited Vulnerabilities Catalog

CVE-2023-38646

CISA-KEV

Critical

Remotecode execution vulnerability in Metabase open source and Metabase Enterprise

Affected Products

Metabase open source/Enterprise

Exploited-in-Wild

Metabase open source/Enterprise

CVE-2023-26801

CISA-KEV

Critical

Command injection vulnerability in LB-LINK devices

Affected Products

LB-LINK

Exploited-in-Wild

LB-LINK

CVE-2023-1389

CISA-KEV

High

Command InjectionVulnerability in TP-Link Archer AX-21

Affected Products

TP-Link Archer AX-21

Exploited-in-Wild

TP-Link Archer AX-21

CVE-2022-30023

CISA-KEV

High

Command injectionvulnerability via the Ping function in Tenda Products

Affected Products

Tenda Devices

Exploited-in-Wild

Tenda Devices

‍

Vulnerabilities abused by Botnet

Identified vulnerabilities exploited by Botnets, including recent CVEs logged in Malware Information Sharing Platform (MISP). Presenting the top 5 CVEs with payloads suggestive of Botnet activities, like utilizing wget with IP addresses.

CVE-2023-1389

An unauthenticated command injection vulnerabilityfound in the TP-Link Archer AX21 WiFi router.

Affected Product

TP-Link Archer AX21

Exploit

An unauthenticated command injection vulnerabilityfound in the TP-Link Archer AX21 WiFi router.

Abused by Botnet

CVE-2023-26801

Command injection vulnerability in LB-LINK

Affected Product

Lb-Link Devices

Exploit

Command injection vulnerability in LB-LINK

Abused by Botnet

Mirai

CVE-2017-17215

Remote code execution vulnerability in Huawei HG532 router

Affected Product

Huawei HG532

Exploit

Remote code execution vulnerability in Huawei HG532 router

Abused by Botnet

HinataBot
Zerobot
Mirai
Bashlite
Gitpaste
Beastmode
Enemybot
PerlBot
QakBot
Ircbot

CVE-2016-10372

Improper protocol access control vulnerability in Eir D1000 modem.

Affected Product

Eir D1000 modem

Exploit

Improper protocol access control vulnerability in Eir D1000 modem

Abused by Botnet

Vulnerabilities Abused by Malware

We proactively monitor the vulnerabilities which are targeted by adversaries. Each vulnerability is humanly studied and mapped with Mitre ATT&CK tactics and techniques. Source of information is derived from our vulnerability intelligence platform collected and curated information from various sources such as Twitter, Telegram, OSINT groups, Blogs, Data leak sites and more.

CVE-2023-21839 

High

critical vulnerability in Oracle WebLogic Server

Patch

critical vulnerability in Oracle WebLogic Server

Targeted by Malware

8220 Gang 

CVE-2020-1472

Critical

Microsoft Netlogon Privilege Escalation Vulnerability

Patch

Microsoft Netlogon Privilege Escalation Vulnerability

Targeted by Malware

RansomHub

CVE-2018-4233

High

Code execution vulnerability affecting WebKit

Patch

Code execution vulnerability affecting WebKit 

Targeted by Malware

LightSpy

CVE-2018-4404

High

Memory corruption vulnerability in Apple products iOS and macOS operating systems

Patch

Memory corruption vulnerability in Apple products iOS and macOS operating systems

Targeted by Malware

LightSpy

CVE-2017-3506 

High

critical vulnerability in the Oracle WebLogic Server

Patch

critical vulnerability in the Oracle WebLogic Server

Targeted by Malware

8220 Gang 

PRE-NVD observed for this week

It refers to vulnerabilities discovered and potentially exploited before their official inclusion in the National Vulnerability Database. The LOVI Platform aggregates and distributes data from open sources and social media, currently tracking over 100 security alerts and planning to expand.

CVE-2024-28038

Stack-Based Buffer Overflow

Affected Product

Multiple multi-function printers by Sharp Corporation and Toshiba

Reference

Multiple multi-function printers by Sharp Corporation and Toshiba

CVE-2023-26322

Remote Code Execution

Affected Product

Xiaomi Pro 13

Reference

Xiaomi Pro 13