Weekly Threat & Vulnerabilities Report

Command Injection

CISA-KEV

OSS

Zero Day

Critical

Affected Product

D-Link DIR-859 1.06B01

Exploited-in-Wild

D-Link DIR-859 1.06B01

CVSS Score

9.8

EPSS Score

0.00212

CVE-2024-20399

OS Command Injection

CISA-KEV

OSS

Zero Day

Medium

Affected Product

Cisco NX-OS

Exploited-in-Wild

Cisco NX-OS

CVSS Score

6.7

EPSS Score

0.00254

CVE-2024-6387

Race Condition

CISA-KEV

OSS

Zero Day

High

Affected Product

OpenSSH's server (sshd)

Exploited-in-Wild

OpenSSH's server (sshd)

CVSS Score

8.1

EPSS Score

0.00063

CVE-2024-39891

Unauthenticated Endpoint

CISA-KEV

OSS

Zero Day

Medium

Affected Product

Twilio Authy API

Exploited-in-Wild

Twilio Authy API

CVSS Score

5.3

EPSS Score

0.00045

CVE-2024-38366

Remote Code Execution

CISA-KEV

OSS

Zero Day

Critical

Affected Product

CocoaPods Trunk

Exploited-in-Wild

False

CVSS Score

EPSS Score

0.00045

CVE-2024-23692

Template injection

CISA-KEV

OSS

Zero Day

Critical

Affected Product

Rejetto HTTP File Server

Exploited-in-Wild

Rejetto HTTP File Server

CVSS Score

9.8

EPSS Score

0.0021

Exploit Activity and Mass Scanning Observed on Cytellite Sensors

Telemetry collected from Loginsoft sensors were analyzed and processed to derive insights on what is actively being exploited and actively being scanned. As source of truth, source IPv4 addresses & payloads can be provided on need-to-know basis.

CVE-2024-3400

CISA-KEV

Critical

Command Injection vulnerability in theGlobalProtect feature of Palo Alto Networks PAN-OS

Affected Products

PaloAlto Networks PAN-OS

Exploited-in-Wild

PaloAlto Networks PAN-OS

CVE-2024-29973

CISA-KEV

Critical

Command Injection vulnerability in “setCookie”parameter in Zyxel NAS326 and NAS542 devices

Affected Products

Zyxel NAS326 and NAS542 devices

Exploited-in-Wild

False

CVE-2024-22729

CISA-KEV

Critical

Command injection vulnerability in NETIS SYSTEMSMW5360 V1.0.1.3031 via the password parameter on the login page

Affected Products

NETIS SYSTEMS MW5360 V1.0.1.3031

Exploited-in-Wild

False

CVE-2023-4966

CISA-KEV

High

Buffer Overflow Vulnerability in Citrix NetScalerADC and NetScaler Gateway

Affected Products

Citrix Netscaler

Exploited-in-Wild

Citrix Netscaler

CVE-2023-6549

CISA-KEV

High

Buffer Overflow vulnerability in Citrix NetScalerADC and NetScaler Gateway leads to unauthenticated denial of service

Affected Products

Citrix NetScaler ADC and NetScaler Gateway

Exploited-in-Wild

Citrix NetScaler ADC and NetScaler Gateway

CVE-2023-38646

CISA-KEV

Critical

Remote code execution vulnerability in Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1.

Affected Products

Metabase open source/Enterprise

Exploited-in-Wild

Metabase open source/Enterprise

CVE-2023-33010

CISA-KEV

Critical

Buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions leads to denial of service or remote code execution on affected device

Affected Products

Zyxel ATP series firmware

Exploited-in-Wild

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CVE-2023-20198

CISA-KEV

Critical

Privilege escalation vulnerability in web UI feature of Cisco IOS XE Software

Affected Products

Cisco IOS XE Web UI

Exploited-in-Wild

Cisco IOS XE Web UI

CVE-2023-1389

CISA-KEV

High

Command Injection Vulnerability in TP-Link Archer AX-21.

Affected Products

TP-Link Archer AX-21

Exploited-in-Wild

TP-Link Archer AX21

CVE-2023-26801

CISA-KEV

Critical

Command injectionvulnerability in LB-LINK devices.

Affected Products

LB-LINK

Exploited-in-Wild

LB-LINK

Vulnerabilities abused by Botnet

Identified vulnerabilities exploited by Botnets, including recent CVEs logged in Malware Information Sharing Platform (MISP). Presenting the top 5 CVEs with payloads suggestive of Botnet activities, like utilizing wget with IP addresses.

CVE-2023-1389

An unauthenticated command injection vulnerabilityfound in the TP-Link Archer AX21 WiFi router.

Affected Product

TP-Link Archer AX21

Exploit

An unauthenticated command injection vulnerabilityfound in the TP-Link Archer AX21 WiFi router.

Abused by Botnet

CVE-2023-26801

Command injection vulnerability in LB-LINKBL-AC1900_2.0 1.0.1, BL-WR9000 2.4.9, BL-X26 1.2.5 and BL-LTE300 1.0.8

Affected Product

LB-LINK BL Devices

Exploit

Command injection vulnerability in LB-LINKBL-AC1900_2.0 1.0.1, BL-WR9000 2.4.9, BL-X26 1.2.5 and BL-LTE300 1.0.8

Abused by Botnet

CVE-2018-10562

Command Injection vulnerability in Gpon home router

Affected Product

Gpon Home Router

Exploit

Command Injection vulnerability in Gpon home router

Abused by Botnet

CVE-2017-17215

Remote code execution vulnerability in Huawei HG532 router

Affected Product

Huawei HG532

Exploit

Remote code execution vulnerability in Huawei HG532 router

Abused by Botnet

‍

CVE-2016-10372

Improper protocol access control vulnerability in Eir D1000 modem.

Affected Product

Eir D1000 modem

Exploit

Improper protocol access control vulnerability in Eir D1000 modem.

Abused by Botnet

CVE-2015-2051

Arbitrary command execution vulnerability in D-Link DIR-645 Wired/Wireless Router

Affected Product

D-Link DIR-645 Wired/Wireless Router

Exploit

D-Link DIR-645 Wired/Wireless Router

Abused by Botnet

Vulnerabilities Abused by Malware

We proactively monitor the vulnerabilities which are targeted by adversaries. Each vulnerability is humanly studied and mapped with Mitre ATT&CK tactics and techniques. Source of information is derived from our vulnerability intelligence platform collected and curated information from various sources such as Twitter, Telegram, OSINT groups, Blogs, Data leak sites and more.

CVE-2024-20399

Medium

OS Command Injection vulnerability in the CLI ofCisco NX_OS

Patch

OS Command Injection vulnerability in the CLI ofCisco NX_OS

Targeted by Malware

Velvet Ant

CVE-2024-23692

Critical

Template Injection vulnerability in Rejetto HTTPFile Server up to 2.3m version

Patch

False

Targeted by Malware

CVE-2024-39891

Medium

Observable Discrepancy vulnerability in TwilioAuthy API accessed by Authy Android and Authy iOS

Patch

Observable Discrepancy vulnerability in TwilioAuthy API accessed by Authy Android and Authy iOS

Targeted by Malware

ShinyHunters

CVE-2021-40444

High

Microsoft MSHTML Remote Code Execution Vulnerability

Patch

Microsoft MSHTML Remote Code Execution Vulnerability

Targeted by Malware

MerkSpy

PRE-NVD observed for this week

It refers to vulnerabilities discovered and potentially exploited before their official inclusion in the National Vulnerability Database. The LOVI Platform aggregates and distributes data from open sources and social media, currently tracking over 100 security alerts and planning to expand.

CVE-2024-27980

Remote Command Execution

Affected Product

Node.js 18.x, 20.x, 21.x on windows

Reference

Node.js 18.x, 20.x, 21.x on windows

CVE-2024-6249

Stack-Based Buffer Overflow

Affected Product

Wyze Cam v3

Reference

Wyze Cam v3