Attacks Linked to Major GFI KerioControl Firewall Flaw

January 10, 2025January 10, 2025

Critical Vulnerability in GFI KerioControl Firewalls: Urgent Patching Required

GFI KerioControl firewalls are facing a critical security vulnerability, identified as CVE-2024-52857, which has been exploited since December 28th. This flaw, known for enabling carriage return line feed (CRLF) injection, poses significant risks, including the potential for remote code execution. Security experts are urging users to apply the necessary patches immediately to safeguard their networks from ongoing attacks.

Understanding the CRLF Injection Vulnerability

The CRLF injection issue in GFI KerioControl firewalls allows malicious actors to manipulate HTTP response headers. This vulnerability has been traced back to specific IP addresses in Singapore and Hong Kong, as highlighted by GreyNoise’s analysis. Notably, security researcher Egidio Romano, who discovered the flaw, emphasized that the application fails to adequately filter or remove line feed (LF) characters.

Potential Impacts of the Vulnerability

The implications of the CRLF injection vulnerability are severe, including:

HTTP Response Splitting Attacks: Attackers can exploit this flaw to manipulate the responses sent from the server.
Reflected Cross-Site Scripting (XSS): This could lead to the execution of harmful scripts in a user’s browser.
Remote Code Execution: An attacker could potentially gain control over affected systems.

Urgent Action Required for GFI KerioControl Users

With nearly 24,000 GFI KerioControl firewalls currently online, immediate action is crucial. Users are strongly advised to apply the latest security patches to mitigate the risks associated with this vulnerability. The situation underscores the importance of regular updates and security audits to protect against emerging threats.

Additional Resources

For more information on how to patch your GFI KerioControl firewalls, visit the official GFI support page here. Additionally, learn more about protecting your network from vulnerabilities by checking out cybersecurity best practices on the Cybersecurity & Infrastructure Security Agency (CISA) website.

Conclusion

The recent discovery of the CVE-2024-52857 vulnerability in GFI KerioControl firewalls presents a serious risk to network security. By taking decisive action and applying the necessary patches, users can protect their systems from potential exploitation. Share your thoughts on this vulnerability or read more related articles to stay informed on cybersecurity developments.

Moxa Fixes Critical RCE Flaw in OT Devices

January 8, 2025January 8, 2025

On January 3, 2024, Moxa announced critical patches for two vulnerabilities in its cellular routers and network security appliances, essential for protecting critical infrastructure. The first, CVE-2024-9140, has a severity rating of 9.3, allowing remote code execution risks. The second, CVE-2024-9138, rated 8.6, involves hard-coded credentials that could enable privilege escalation. Industry experts stress the need for immediate patch application, monitoring of network activity, and review of security protocols to prevent exploitation. Moxa serves significant clients like Siemens and Microsoft, making timely updates crucial for safeguarding sensitive operations in sectors like telecommunications and utilities.

Critical Rsync Vulnerabilities Risk RCE and Data Leaks

January 16, 2025January 16, 2025

A security alert has been issued regarding six vulnerabilities in the Rsync file synchronization tool, including critical flaws that may lead to remote code execution (RCE) and data leakage. The most severe, CVE-2024-12084, has a CVSS score of 9.8, allowing attackers to exploit checksum mishandling for RCE. Another significant flaw, CVE-2024-12085, can leak sensitive data. Additional medium-severity vulnerabilities have also been identified. Affected Rsync versions (3.3.0 and earlier) have been patched in version 3.4.0. Users are advised to upgrade, limit access, and monitor for unusual activity to mitigate risks.

Why Even Top Companies Experience Breaches and How to Prevent Them

December 17, 2024December 17, 2024

Join our free webinar led by John Paul Cunningham, CISO at Silverfort, to explore why cybersecurity breaches occur, even in well-protected organizations. Cybercriminals exploit overlooked vulnerabilities, and this session will help you identify and address these security gaps. You’ll learn about attackers’ tactics, hidden weaknesses in your defenses, and methods to detect risks. Additionally, discover how to align cybersecurity efforts with business goals to secure leadership support. This informative session is essential for cybersecurity professionals and business leaders alike. Don’t wait for an attack—register now to strengthen your organization’s defenses against potential threats!

Crypto Wallets Hit by Transaction Simulation Spoofing Attack

January 16, 2025January 16, 2025

A new cybersecurity threat, transaction simulation spoofing, is targeting cryptocurrency users and exploiting vulnerabilities in Web3 wallets. This method allows attackers to manipulate a security feature that previews blockchain transaction outcomes, leading users to counterfeit websites that mimic legitimate platforms. By presenting fake claims of small ETH gains, attackers can alter contract states between simulation and actual transactions, resulting in unauthorized asset transfers. Recently, this tactic led to the theft of 143.45 Ethereum, worth about $460,000. Experts recommend configuring simulation refresh intervals, implementing forced refresh mechanisms, and being cautious of unverified sites to protect against these scams.

Misconfiguration Leaks User Data from Virtavo Security Cameras

December 19, 2024December 19, 2024

A major data breach has exposed the personal information of over 100,000 users of Virtavo’s Home V App, primarily affecting users in China. The incident was caused by an unsecured Elasticsearch server, which remained vulnerable for nearly two months. Over 8.7 million records were found, including phone numbers, network information, and device identifiers, raising serious security concerns. Researchers emphasize the need for organizations to enhance data security measures, such as securing Elasticsearch instances, implementing data encryption, monitoring access, and adhering to data minimization principles to protect user information and maintain trust in digital services.

Cisco Alerts: Decade-Old ASA WebVPN Flaw Under Attack

December 3, 2024December 12, 2024

Cisco has issued a critical alert about the active exploitation of a decade-old vulnerability, CVE-2014-2120, in its Adaptive Security Appliance (ASA). This flaw allows unauthenticated attackers to execute cross-site scripting (XSS) attacks via the WebVPN login page. The urgency is heightened by reports from CloudSEK regarding the use of this vulnerability in distributing AndroxGh0st malware, linked to the Mozi botnet. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog, mandating federal agencies to remediate it by December 3, 2024. Users are advised to update installations, monitor for suspicious activity, and educate employees on security risks.