CISA Alerts on Exploitation of Zyxel and ProjectSend Flaws

December 5, 2024December 5, 2024

Title: Critical Cybersecurity Flaws Identified in Zyxel, I-O DATA Routers, and More

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added several significant cybersecurity vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, affecting products from Zyxel, North Grid Proself, ProjectSend, and CyberPanel. These vulnerabilities, which have been actively exploited, pose serious risks to organizations and individuals alike. In this article, we’ll discuss the details surrounding these vulnerabilities and how they can impact your cybersecurity posture.

Major Vulnerabilities in Zyxel and Other Products

CISA has flagged the following vulnerabilities that are currently being exploited:

CVE-2024-51378 (CVSS score: 10.0)
- This vulnerability allows for authentication bypass and execution of arbitrary commands via shell metacharacters in the statusfile property due to incorrect default permissions.
CVE-2023-45727 (CVSS score: 7.5)
- This issue involves improper restriction of XML External Entity (XXE) references, enabling remote, unauthenticated attackers to conduct XXE attacks.
CVE-2024-11680 (CVSS score: 9.8)
- An improper authentication vulnerability that allows remote attackers to create accounts, upload web shells, and embed malicious JavaScript.
CVE-2024-11667 (CVSS score: 7.5)
- A path traversal vulnerability in the web management interface that enables attackers to download or upload files via crafted URLs.

The recent inclusion of CVE-2023-45727 is particularly noteworthy, as a Trend Micro report from November 19, 2024, linked its exploitation to a cyber espionage group known as Earth Kasha (also referred to as MirrorFace). Additionally, cybersecurity firm VulnCheck revealed that malicious actors have been attempting to exploit CVE-2024-11680 since September 2024.

Impact on Federal Agencies

Federal Civilian Executive Branch (FCEB) agencies are advised to remedy the identified vulnerabilities by December 25, 2024, to safeguard their networks against potential breaches. The exploitation of CVE-2024-51378 and CVE-2024-11667 has already been associated with various ransomware campaigns, including PSAUX and Helldown, as reported by Censys and Sekoia.

Vulnerabilities in I-O DATA Routers

In a related development, JPCERT/CC has warned that three critical vulnerabilities in I-O DATA routers (models UD-LT1 and UD-LT1/EX) are under active attack:

CVE-2024-45841 (CVSS score: 6.5)
- This flaw allows attackers with guest account access to read sensitive files, including those containing credentials due to incorrect permission assignments.
CVE-2024-47133 (CVSS score: 7.2)
- This vulnerability permits a logged-in administrative user to execute arbitrary commands through OS command injection.
CVE-2024-52564 (CVSS score: 7.5)
- An undocumented feature allows remote attackers to disable firewall functions and execute arbitrary OS commands, altering router configurations.

While patches for CVE-2024-52564 are now available in firmware version 2.1.9, fixes for the other two vulnerabilities are expected by December 18, 2024 (version 2.2.0). In the meantime, I-O DATA advises customers to secure their routers by limiting settings exposure, disabling remote management, changing default guest user passwords, and using strong administrator passwords.

Conclusion

The cybersecurity landscape is constantly evolving, and awareness of these vulnerabilities is crucial for maintaining a robust defense. Organizations and individuals are encouraged to stay informed and take proactive measures to protect their systems.

For further insights on cybersecurity threats and best practices, feel free to share your thoughts in the comments or explore related articles on our website. Stay secure!

For more detailed information, you can visit CISA’s official page on Known Exploited Vulnerabilities.

Security Flaws Found in Rsync Tool, Risking Client Data

January 15, 2025January 15, 2025

Rsync, a popular file synchronization tool for Unix systems, has been found to have six critical security vulnerabilities, potentially allowing attackers to execute arbitrary code on connected clients. The CERT Coordination Center warns that these flaws could lead to unauthorized access to sensitive files, including SSH keys. Key vulnerabilities include a heap-buffer overflow (CVE-2024-12084), information disclosure, and path traversal issues, with CVSS scores ranging from 5.6 to 9.8. Users are advised to update to Rsync version 3.4.0 to mitigate risks or implement temporary fixes. Maintaining updated software is crucial for cybersecurity.

New AI Chatbot Flaw Exposes Users to Prompt Injection Attacks

December 9, 2024December 9, 2024

A critical security flaw in the DeepSeek AI chatbot exposes users to prompt injection attacks, allowing malicious actors to hijack accounts. Identified by researcher Johann Rehberger, the vulnerability arises from a specific command that triggers JavaScript execution, leading to session hijacking and unauthorized access to user data. This issue isn’t isolated; similar techniques could impact other AI systems, like Anthropic’s Claude, and even command-line interfaces through ANSI escape codes. The findings underscore the urgent need for enhanced security measures in AI applications to protect user privacy and data, highlighting risks from untrusted data integration.

Oracle Alerts Users: Critical Agile PLM Vulnerability Exploited

December 1, 2024December 1, 2024

Oracle has issued a critical alert about a high-severity security flaw, CVE-2024-21287, in its Agile Product Lifecycle Management (PLM) Framework, with a CVSS score of 7.5. This vulnerability, already exploited in the wild, allows unauthorized access to sensitive information without authentication. Attackers could potentially disclose files from affected systems, posing significant risks to organizations. Oracle recommends users promptly apply the latest security patches, monitor for suspicious activity, and educate employees on cybersecurity best practices. The discovery was made by CrowdStrike security experts, though details about the exploitation remain unclear.

NCSC Anticipates Ongoing Ties with CISA During Trump Era

December 10, 2024December 10, 2024

Concerns regarding the potential political influence on the Cybersecurity and Infrastructure Security Agency (CISA) under the Trump administration have been alleviated by UK officials from the National Cyber Security Centre (NCSC). NCSC leaders, including CTO Ollie Whitehouse and CEO Richard Horne, expressed confidence in CISA’s future effectiveness and emphasized the strong collaboration between UK and US cybersecurity agencies. This partnership is crucial for addressing evolving cyber threats, ensuring continuity in effective cyber policies. NCSC’s reassurances highlight the resilience of international cybersecurity frameworks amid political changes, underscoring the importance of ongoing cooperation between the two nations.

Ivanti Flaw CVE-2025-0282 Under Active Exploitation

January 9, 2025January 9, 2025

Ivanti has warned of a critical security flaw, CVE-2025-0282, affecting its products, including Ivanti Connect Secure and Policy Secure, with an active exploitation reported since December 2024. This vulnerability, rated 9.0 on the CVSS scale, allows unauthenticated remote code execution, posing severe risks. Affected versions need urgent patching. Ivanti also addressed CVE-2025-0283, a high-severity privilege escalation vulnerability. Cybersecurity firm Mandiant linked attacks to the threat actor UNC5337, utilizing malware like SPAWN and PHASEJAM. Organizations are urged to upgrade systems, scan for compromises, and report any suspicious activity. CISA has added the vulnerability to its KEV catalog for immediate action.

Security Flaws Found in Major Open-Source ML Frameworks

December 6, 2024December 12, 2024

Cybersecurity researchers have discovered critical vulnerabilities in popular open-source machine learning frameworks such as MLflow, H2O, PyTorch, and MLeap, potentially allowing remote code execution (RCE). Identified by JFrog, these flaws are part of 22 security issues disclosed last month and target ML clients rather than servers. Notable vulnerabilities include cross-site scripting in MLflow and unsafe deserialization in H2O, both rated with high CVSS scores. JFrog advises organizations to avoid loading untrusted ML models and highlights the importance of understanding model usage to prevent unauthorized access to sensitive ML services. Proactive security measures are essential as AI and ML adoption grows.