VULNERA Pulse

Qlik — Sense

CVE-2023-41265 / Added: Dec. 7, 2023

CRITICAL CVSS 9.90 EPSS Score 1.13 EPSS Percentile 83.01

Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the backend server hosting the software.

Headlines

• Dec. 1, 2023 - Qlik Sense flaws exploited in Cactus ransomware campaign
• Nov. 30, 2023 - Cactus ransomware exploiting Qlik Sense flaws to breach networks
• Nov. 30, 2023 - CACTUS Ransomware Exploits Qlik Sense Vulnerabilities in Targeted Attacks
• Nov. 16, 2023 - CVE-2023-48365: Critical Qlik Sense Enterprise Flaw Allows Unauthenticated RCE
• Aug. 30, 2023 - Critical Flaws Identified in Qlik Sense Enterprise for Windows

Back to top ↑

Qlik — Sense

CVE-2023-41266 / Added: Dec. 7, 2023

MEDIUM CVSS 6.50 EPSS Score 0.24 EPSS Percentile 61.64

Qlik Sense contains a path traversal vulnerability that allows a remote, unauthenticated attacker to create an anonymous session by sending maliciously crafted HTTP requests. This anonymous session could allow the attacker to send further requests to unauthorized endpoints.

Headlines

• Dec. 1, 2023 - Qlik Sense flaws exploited in Cactus ransomware campaign
• Nov. 30, 2023 - Cactus ransomware exploiting Qlik Sense flaws to breach networks
• Nov. 30, 2023 - CACTUS Ransomware Exploits Qlik Sense Vulnerabilities in Targeted Attacks
• Aug. 30, 2023 - Critical Flaws Identified in Qlik Sense Enterprise for Windows

Back to top ↑

Qualcomm — Multiple Chipsets

CVE-2022-22071 / Added: Dec. 5, 2023

HIGH CVSS 7.80 EPSS Score 0.11 EPSS Percentile 44.43

Multiple Qualcomm chipsets contain a use-after-free vulnerability when process shell memory is freed using IOCTL munmap call and process initialization is in progress.

Headlines

• Dec. 6, 2023 - CISA adds Qualcomm flaws to its Known Exploited Vulnerabilities catalog
• Dec. 6, 2023 - Qualcomm Releases Details on Chip Vulnerabilities Exploited in Targeted Attacks
• Dec. 6, 2023 - CISA warns of attacks targeting vulnerabilities in Qualcomm chips
• Oct. 4, 2023 - Qualcomm patches 3 actively exploited zero-days
• Oct. 4, 2023 - Chipmaker Qualcomm warns of three actively exploited zero-days
• Oct. 4, 2023 - Arm and Qualcomm Hit by Multiple Zero-Day Attacks
• Oct. 4, 2023 - Qualcomm Patches 3 Zero-Days Reported by Google
• Oct. 3, 2023 - Qualcomm Releases Patch for 3 new Zero-Days Under Active Exploitation
• Oct. 3, 2023 - Qualcomm says hackers exploit 3 zero-days in its GPU, DSP drivers
• Oct. 3, 2023 - Four Zero-Day Vulnerabilities in Qualcomm Chips Put Billions of Users at Risk

Back to top ↑

Qualcomm — Multiple Chipsets

CVE-2023-33063 / Added: Dec. 5, 2023

HIGH CVSS 7.80 EPSS Score 0.15 EPSS Percentile 51.49

Multiple Qualcomm chipsets contain a use-after-free vulnerability due to memory corruption in DSP Services during a remote call from HLOS to DSP.

Headlines

• Dec. 6, 2023 - CISA adds Qualcomm flaws to its Known Exploited Vulnerabilities catalog
• Dec. 6, 2023 - CISA warns of attacks targeting vulnerabilities in Qualcomm chips
• Oct. 8, 2023 - Week in review: Patch Tuesday forecast, 9 free ransomware guides, Cybertech Europe 2023
• Oct. 4, 2023 - Qualcomm patches 3 actively exploited zero-days
• Oct. 4, 2023 - Chipmaker Qualcomm warns of three actively exploited zero-days
• Oct. 4, 2023 - Arm and Qualcomm Hit by Multiple Zero-Day Attacks
• Oct. 4, 2023 - Qualcomm Patches 3 Zero-Days Reported by Google
• Oct. 3, 2023 - Qualcomm Releases Patch for 3 new Zero-Days Under Active Exploitation
• Oct. 3, 2023 - Qualcomm says hackers exploit 3 zero-days in its GPU, DSP drivers
• Oct. 3, 2023 - Four Zero-Day Vulnerabilities in Qualcomm Chips Put Billions of Users at Risk

Back to top ↑

Qualcomm — Multiple Chipsets

CVE-2023-33107 / Added: Dec. 5, 2023

HIGH CVSS 7.80 EPSS Score 0.15 EPSS Percentile 51.49

Multiple Qualcomm chipsets contain an integer overflow vulnerability due to memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.

Headlines

• Dec. 6, 2023 - CISA adds Qualcomm flaws to its Known Exploited Vulnerabilities catalog
• Dec. 6, 2023 - CISA warns of attacks targeting vulnerabilities in Qualcomm chips
• Oct. 8, 2023 - Week in review: Patch Tuesday forecast, 9 free ransomware guides, Cybertech Europe 2023
• Oct. 4, 2023 - Qualcomm patches 3 actively exploited zero-days
• Oct. 4, 2023 - Chipmaker Qualcomm warns of three actively exploited zero-days
• Oct. 4, 2023 - Arm and Qualcomm Hit by Multiple Zero-Day Attacks
• Oct. 4, 2023 - Qualcomm Patches 3 Zero-Days Reported by Google
• Oct. 3, 2023 - Qualcomm Releases Patch for 3 new Zero-Days Under Active Exploitation
• Oct. 3, 2023 - Qualcomm says hackers exploit 3 zero-days in its GPU, DSP drivers
• Oct. 3, 2023 - Four Zero-Day Vulnerabilities in Qualcomm Chips Put Billions of Users at Risk

Back to top ↑

Qualcomm — Multiple Chipsets

CVE-2023-33106 / Added: Dec. 5, 2023

HIGH CVSS 7.80 EPSS Score 0.15 EPSS Percentile 51.49

Multiple Qualcomm chipsets contain a use of out-of-range pointer offset vulnerability due to memory corruption in Graphics while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND.

Headlines

• Dec. 6, 2023 - CISA adds Qualcomm flaws to its Known Exploited Vulnerabilities catalog
• Dec. 6, 2023 - CISA warns of attacks targeting vulnerabilities in Qualcomm chips
• Oct. 8, 2023 - Week in review: Patch Tuesday forecast, 9 free ransomware guides, Cybertech Europe 2023
• Oct. 4, 2023 - Qualcomm patches 3 actively exploited zero-days
• Oct. 4, 2023 - Chipmaker Qualcomm warns of three actively exploited zero-days
• Oct. 4, 2023 - Arm and Qualcomm Hit by Multiple Zero-Day Attacks
• Oct. 4, 2023 - Qualcomm Patches 3 Zero-Days Reported by Google
• Oct. 3, 2023 - Qualcomm Releases Patch for 3 new Zero-Days Under Active Exploitation
• Oct. 3, 2023 - Qualcomm says hackers exploit 3 zero-days in its GPU, DSP drivers
• Oct. 3, 2023 - Four Zero-Day Vulnerabilities in Qualcomm Chips Put Billions of Users at Risk

Back to top ↑

Apple — Multiple Products

CVE-2023-42917 / Added: Dec. 4, 2023

HIGH CVSS 8.80 EPSS Score 0.09 EPSS Percentile 37.05

Apple iOS, iPadOS, macOS, and Safari WebKit contain a memory corruption vulnerability that leads to code execution when processing web content.

Headlines

• Dec. 11, 2023 - Apple emergency updates fix recent zero-days on older iPhones
• Dec. 7, 2023 - Cybersecurity considerations to have when shopping for holiday gifts
• Dec. 3, 2023 - Week in review: PoC for Splunk Enterprise RCE flaw released, scope of Okta breach widens
• Dec. 1, 2023 - Quick: Update iPhones and Macs – WebKit security hole found
• Dec. 1, 2023 - Apple secures WebKit as global ransomware attacks surge
• Dec. 1, 2023 - Multiple Vulnerabilities in Apple Products Could Allow for Arbitrary Code Execution
• Dec. 1, 2023 - Apple Patches Actively Exploited iOS Zero-Days
• Dec. 1, 2023 - Apple patches two zero-days used to target iOS users (CVE-2023-42916 CVE-2023-42917)
• Dec. 1, 2023 - iOS 17.1.2—Update Now Warning Issued To All iPhone Users
• Dec. 1, 2023 - Apple patches two new iOS zero-days - CVE-2023-42916 and CVE-2023-42917
• Nov. 30, 2023 - Apple addressed 2 new iOS zero-day vulnerabilities
• Nov. 30, 2023 - Apple fixes two new iOS zero-days in emergency updates
• Nov. 30, 2023 - Apple Patches WebKit Flaws Exploited on Older iPhones

Back to top ↑

Apple — Multiple Products

CVE-2023-42916 / Added: Dec. 4, 2023

MEDIUM CVSS 6.50 EPSS Score 0.12 EPSS Percentile 45.76

Apple iOS, iPadOS, macOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information when processing web content.

Headlines

• Dec. 11, 2023 - Apple emergency updates fix recent zero-days on older iPhones
• Dec. 7, 2023 - Cybersecurity considerations to have when shopping for holiday gifts
• Dec. 3, 2023 - Week in review: PoC for Splunk Enterprise RCE flaw released, scope of Okta breach widens
• Dec. 1, 2023 - Quick: Update iPhones and Macs – WebKit security hole found
• Dec. 1, 2023 - Apple secures WebKit as global ransomware attacks surge
• Dec. 1, 2023 - Multiple Vulnerabilities in Apple Products Could Allow for Arbitrary Code Execution
• Dec. 1, 2023 - Apple Patches Actively Exploited iOS Zero-Days
• Dec. 1, 2023 - Apple patches two zero-days used to target iOS users (CVE-2023-42916 CVE-2023-42917)
• Dec. 1, 2023 - iOS 17.1.2—Update Now Warning Issued To All iPhone Users
• Dec. 1, 2023 - Apple patches two new iOS zero-days - CVE-2023-42916 and CVE-2023-42917
• Nov. 30, 2023 - Apple addressed 2 new iOS zero-day vulnerabilities
• Nov. 30, 2023 - Apple fixes two new iOS zero-days in emergency updates
• Nov. 30, 2023 - Apple Patches WebKit Flaws Exploited on Older iPhones

Back to top ↑

CVE-2022-0543

CRITICAL CVSS 10.00 EPSS Score 97.09 EPSS Percentile 99.72

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: Feb. 18, 2022

It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.

Vendors Impacted: Debian, Redis, Canonical

Products Impacted: Debian-Specific Redis Servers, Debian Linux, Ubuntu Linux, Redis

Quotes

• It's highly likely that by targeting MIPS, the P2PInfect developers intend to infect routers and IoT devices with the malware
• Cado Security Labs researchers have since encountered a new variant of the malware, specifically targeting embedded devices based on 32-bit MIPS processors, and attempting to bruteforce SSH access to these devices

Headlines

• Dec. 4, 2023 - New P2PInfect bot targets routers and IoT devices
• Dec. 4, 2023 - Stealthier version of P2Pinfect malware targets MIPS devices
• Dec. 4, 2023 - Cado Security Labs Exposes P2Pinfect Botnet's Sophisticated Attack Techniques
• Dec. 4, 2023 - New P2PInfect Botnet MIPS Variant Targeting Routers and IoT Devices

CVE-2023-23397

CRITICAL CVSS 9.80 EPSS Score 88.94 EPSS Percentile 98.43

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: March 14, 2023

Microsoft Outlook Elevation of Privilege Vulnerability

Vendor Impacted: Microsoft

Products Impacted: Office, Outlook, 365 Apps

Quotes

• In the next stage of malicious activity, the adversary modifies folder permissions within the victim's mailbox
• Actively exploiting CVE-2023-23397 to provide secret, unauthorized access to email accounts within Exchange servers
• Using a zero-day exploit against a target indicates it is of significant value. It also suggests that existing access and intelligence for that target were insufficient at the time
• During this time, Fighting Ursa conducted at least two campaigns with this vulnerability that have been made public. The first occurred between March-December 2022 and the second occurred in March 2023
• It's one thing to suspect a nation or industry is at risk from a nation-state APT actor — it's another to be able to examine an APT's campaigns in depth and provide concrete observations as to which nations and industries are being targeted
• Microsoft Defender XDR detects activities affiliated with the exploitation of CVE-2023-23397, and additional mitigation info and guidance is detailed in our blog. Organizations should ensure systems are patched and kept up to date to mitigate this threat
• Folders permissions were modified, among others, in mailboxes that were high-value information targets for the adversary. As a result of this change, the adversary was able to gain unauthorized access to the resources of high-value informational mailboxes through any compromised email account in the Exchange organization, using the Exchange Web Services (EWS) protocol
• The Polish Cyber Command, as part of its activities in cyberspace, has observed the use of technique[1] that involved the modification of permissions to mailbox folders within Microsoft Exchange servers. It allows an attacker to provide covert, unauthorized access to email correspondence and was used after gaining access to email accounts through CVE-2023-23397 (Microsoft Outlook Vulnerability) or password-spraying

Headlines

• Dec. 8, 2023 - Russian Espionage Group Hammers Zero-Click Microsoft Outlook Bug
• Dec. 8, 2023 - Zero-Day Outlook Exploit: Fighting Ursa Targets NATO and Critical Infrastructure
• Dec. 8, 2023 - Russia's APT8 exploited Outlook 0day to target EU NATO members
• Dec. 7, 2023 - Russian military hackers target NATO fast reaction corps
• Dec. 6, 2023 - Fancy Bear goes phishing in US, European high-value networks
• Dec. 5, 2023 - Russian hackers use old Outlook vulnerability to target Polish orgs (CVE-2023-23397)
• Dec. 5, 2023 - Russia-linked APT28 group spotted exploiting Outlook flaw to hijack MS Exchange accounts
• Dec. 5, 2023 - Russian APT28 Exploits Outlook Bug to Access Exchange
• Dec. 5, 2023 - Microsoft Warns of Kremlin-Backed APT28 Exploiting Critical Outlook Vulnerability
• Dec. 5, 2023 - Patch Now: Forest Blizzard Targets Exchange Servers with Outlook Zero-Day Exploit
• Dec. 4, 2023 - Russian hackers exploiting Outlook bug to hijack Exchange accounts

CVE-2023-22524

CRITICAL CVSS 9.80 EPSS Score 0.05 EPSS Percentile 18.66

Remote Code Execution

Published: Dec. 6, 2023

Certain versions of the Atlassian Companion App for MacOS were affected by a remote code execution vulnerability. An attacker could utilize WebSockets to bypass Atlassian Companion’s blocklist and MacOS Gatekeeper to allow execution of code.

Vendors Impacted: Atlassian, Apple

Products Impacted: Companion, Macos

Quotes

• Inject unsafe user input into a Confluence page
• The vulnerability exists between the Assets Discovery application (formerly known as Insight Discovery) and the Assets Discovery agent

Headlines

• Dec. 7, 2023 - Atlassian patches several critical vulnerabilities
• Dec. 6, 2023 - Patch Now: Critical Atlassian Bugs Endanger Enterprise Apps
• Dec. 6, 2023 - Atlassian patches critical RCE flaws across multiple products
• Dec. 6, 2023 - Atlassian fixes four critical RCE vulnerabilities, patch quickly!
• Dec. 6, 2023 - Atlassian Releases Critical Software Fixes to Prevent Remote Code Execution

CVE-2023-22523

HIGH CVSS 8.80 EPSS Score 0.05 EPSS Percentile 18.78

Remote Code Execution

Published: Dec. 6, 2023

This vulnerability, if exploited, allows an attacker to perform privileged RCE (Remote Code Execution) on machines with the Assets Discovery agent installed. The vulnerability exists between the Assets Discovery application (formerly known as Insight Discovery) and the Assets Discovery agent.

Vendor Impacted: Atlassian

Products Impacted: Assets Discovery Data Server, Assets Discovery Data Center, Assets Discovery Cloud

Quotes

• Inject unsafe user input into a Confluence page
• The vulnerability exists between the Assets Discovery application (formerly known as Insight Discovery) and the Assets Discovery agent

Headlines

• Dec. 7, 2023 - Atlassian patches several critical vulnerabilities
• Dec. 6, 2023 - Patch Now: Critical Atlassian Bugs Endanger Enterprise Apps
• Dec. 6, 2023 - Atlassian patches critical RCE flaws across multiple products
• Dec. 6, 2023 - Atlassian fixes four critical RCE vulnerabilities, patch quickly!
• Dec. 6, 2023 - CVE-2023-22523: Critical RCE Vulnerability in Assets Discovery

CVE-2023-22522

HIGH CVSS 8.80 EPSS Score 0.05 EPSS Percentile 18.78

Remote Code Execution

Published: Dec. 6, 2023

This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject unsafe user input into a Confluence page. Using this approach, an attacker is able to achieve Remote Code Execution (RCE) on an affected instance. Publicly accessible Confluence Data Center and Server versions as listed below are at risk and require immediate attention. See the advisory for additional details Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

Vendor Impacted: Atlassian

Products Impacted: Confluence Data Center, Confluence Server

Quotes

• Inject unsafe user input into a Confluence page
• The vulnerability exists between the Assets Discovery application (formerly known as Insight Discovery) and the Assets Discovery agent

Headlines

• Dec. 7, 2023 - Atlassian patches several critical vulnerabilities
• Dec. 6, 2023 - Patch Now: Critical Atlassian Bugs Endanger Enterprise Apps
• Dec. 6, 2023 - Atlassian patches critical RCE flaws across multiple products
• Dec. 6, 2023 - Atlassian fixes four critical RCE vulnerabilities, patch quickly!
• Dec. 6, 2023 - Atlassian Releases Critical Software Fixes to Prevent Remote Code Execution

CVE-2023-26360

HIGH CVSS 8.60 EPSS Score 93.43 EPSS Percentile 98.87

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: March 23, 2023

Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.

Vendor Impacted: Adobe

Product Impacted: Coldfusion

Quotes

• Aware that CVE-2023-26360 has been exploited in the wild in very limited attacks
• The vulnerability in ColdFusion (CVE-2023-26360) presents as an improper access control issue and exploitation of this CVE can result in arbitrary code execution
• In both incidents, Microsoft Defender for Endpoint (MDE), alerted of the potential exploitation of an Adobe ColdFusion vulnerability on public-facing web servers in the agency's pre-production environment
• Additionally, various commands were initiated by the threat actors on the compromised web servers; the exploited vulnerability allowed the threat actors to drop malware using HTTP POST commands to the directory path associated with ColdFusion
• In June 2023, through the exploitation of CVE-2023-26360, threat actors were able to establish an initial foothold on two agency systems in two separate instances. In both incidents, Microsoft Defender for Endpoint (MDE) alerted of the potential exploitation of an Adobe ColdFusion vulnerability on public-facing web servers in the agency’s pre-production environment. Both servers were running outdated versions of software which are vulnerable to various CVEs

Headlines

• Dec. 6, 2023 - CISA: Threat Actor Breached Federal Systems via Adobe ColdFusion Flaw
• Dec. 6, 2023 - CISA: Adobe ColdFusion flaw leveraged to access government servers (CVE-2023-26360)
• Dec. 6, 2023 - Hackers Exploited ColdFusion Vulnerability to Breach Federal Agency Servers
• Dec. 6, 2023 - Threat actors breached US govt systems by exploiting Adobe ColdFusion flaw
• Dec. 5, 2023 - CISA reveals how fed agency succumbed to ColdFusion attacks
• Dec. 5, 2023 - Hackers breach US govt agencies using Adobe ColdFusion exploit
• Dec. 5, 2023 - Threat Actors Exploit Adobe ColdFusion Vulnerability (CVE-2023-26360), CISA Warns
• Dec. 5, 2023 - CISA Releases Advisory on Threat Actors Exploiting CVE-2023-26360 Vulnerability in Adobe ColdFusion | CISA

CVE-2023-38831

HIGH CVSS 7.80 EPSS Score 23.40 EPSS Percentile 96.09

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: Aug. 23, 2023

RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file (such as an ordinary .JPG file) and also a folder that has the same name as the benign file, and the contents of the folder (which may include executable content) are processed during an attempt to access only the benign file. This was exploited in the wild in April through October 2023.

Vendor Impacted: Rarlab

Product Impacted: Winrar

Quotes

• In the next stage of malicious activity, the adversary modifies folder permissions within the victim's mailbox
• Folders permissions were modified, among others, in mailboxes that were high-value information targets for the adversary. As a result of this change, the adversary was able to gain unauthorized access to the resources of high-value informational mailboxes through any compromised email account in the Exchange organization, using the Exchange Web Services (EWS) protocol

Headlines

• Dec. 6, 2023 - Fancy Bear goes phishing in US, European high-value networks
• Dec. 5, 2023 - Russian hackers use old Outlook vulnerability to target Polish orgs (CVE-2023-23397)
• Dec. 5, 2023 - Russia-linked APT28 group spotted exploiting Outlook flaw to hijack MS Exchange accounts
• Dec. 5, 2023 - Russian APT28 Exploits Outlook Bug to Access Exchange
• Dec. 5, 2023 - Microsoft Warns of Kremlin-Backed APT28 Exploiting Critical Outlook Vulnerability
• Dec. 5, 2023 - Patch Now: Forest Blizzard Targets Exchange Servers with Outlook Zero-Day Exploit
• Dec. 4, 2023 - Russian hackers exploiting Outlook bug to hijack Exchange accounts

CVE-2021-40444

HIGH CVSS 7.80 EPSS Score 97.19 EPSS Percentile 99.78

CISA Known Exploited Remote Code Execution Public Exploits Available

Published: Sept. 15, 2021

Microsoft MSHTML Remote Code Execution Vulnerability

Vendor Impacted: Microsoft

Products Impacted: Windows 7, Windows Rt 8.1, Windows 8.1, Windows Server 2019, Windows 10, Mshtml, Windows Server 2012, Windows Server 2022, Windows Server 2008, Windows Server 2016

Quotes

• Folders permissions were modified, among others, in mailboxes that were high-value information targets for the adversary. As a result of this change, the adversary was able to gain unauthorized access to the resources of high-value informational mailboxes through any compromised email account in the Exchange organization, using the Exchange Web Services (EWS) protocol

Headlines

• Dec. 5, 2023 - Russian hackers use old Outlook vulnerability to target Polish orgs (CVE-2023-23397)
• Dec. 5, 2023 - Russia-linked APT28 group spotted exploiting Outlook flaw to hijack MS Exchange accounts
• Dec. 5, 2023 - Russian APT28 Exploits Outlook Bug to Access Exchange
• Dec. 4, 2023 - Russian hackers exploiting Outlook bug to hijack Exchange accounts

CVE-2022-22071

HIGH CVSS 7.80 EPSS Score 0.11 EPSS Percentile 44.43

CISA Known Exploited

Published: June 14, 2022

Possible use after free when process shell memory is freed using IOCTL munmap call and process initialization is in progress in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music

Vendor Impacted: Qualcomm

Products Impacted: Sd780g, Sd765g Firmware, Qca6391, Sdx55m Firmware, Wcn3615, Wsa8815, Ar8035 Firmware, Qca8337 Firmware, Sm7250p, Sd690 5g, Wcn7851, Wcn6851 Firmware, Qcs610, Sd460 Firmware, Qca6174a Firmware, Sdx65 Firmware, Sdx12, Msm8953 Firmware, Csra6640 Firmware, Sd662, Wcd9370 Firmware, Sdx12 Firmware, Sa8155p, Wcn6850 Firmware, Multiple Chipsets, Wsa8830, Wcn3991 Firmware, Qca6574a, Qcs410 Firmware, Wcn6750 Firmware, Wcd9385 Firmware, Csra6620 Firmware, Wcd9380, Qrb5165m, Wcn7851 Firmware, Wsa8830 Firmware, Qrb5165, Wcd9375 Firmware, Qcm2290, Mdm9150 Firmware, Wcn6855, Sd870 Firmware, Wcn3680b, Wcn3950 Firmware, Sa8155p Firmware, Wcn6740, Wcd9335, Wcn6850, Qca6174a, Qca6426 Firmware, Sd768g, Wcn6856 Firmware, Qcs410, Wcn6851, Sa8195p, Qca6426, Wcn6740 Firmware, Qca6574 Firmware, Qcm4290 Firmware, Sd888 5g Firmware, Wsa8835, Sd695, Wcd9326 Firmware, Wcd9335 Firmware, Sd765g, Ar8031, Wcn3980, Qcs4290 Firmware, Wcn3988 Firmware, Qcs2290 Firmware, Sm7325p, Qca6595au, Apq8053 Firmware, Qcm6490 Firmware, Sdx55, Wcn3988,...

Quotes

• Could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed

Headlines

• Dec. 6, 2023 - CISA adds Qualcomm flaws to its Known Exploited Vulnerabilities catalog
• Dec. 6, 2023 - Qualcomm Releases Details on Chip Vulnerabilities Exploited in Targeted Attacks
• Dec. 6, 2023 - CISA warns of attacks targeting vulnerabilities in Qualcomm chips

CVE-2023-45866

CVSS Not Assigned EPSS Score 0.04 EPSS Percentile 8.20

Risk Context N/A

Published: Dec. 8, 2023

Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such access. An example affected package is bluez 5.64-0ubuntu1 in Ubuntu 22.04LTS. NOTE: in some cases, a CVE-2020-0556 mitigation would have already addressed this Bluetooth HID Hosts issue.

Quotes

• By tricking the Bluetooth host state-machine into pairing with a fake keyboard without user confirmation
• Multiple Bluetooth stacks have authentication bypass vulnerabilities that permit an attacker to connect to a discoverable host without user confirmation and inject keystrokes
• The most severe of these issues is a critical security vulnerability in the System component that could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation
• The vulnerabilities work by tricking the Bluetooth host state-machine into pairing with a fake keyboard without user-confirmation. The underlying unauthenticated pairing mechanism is defined in the Bluetooth specification, and implementation-specific bugs expose it to the attacker

Headlines

• Dec. 7, 2023 - New Bluetooth Flaw Let Hackers Take Over Android, Linux, macOS, and iOS Devices
• Dec. 6, 2023 - Apple and some Linux distros are open to Bluetooth attack
• Dec. 6, 2023 - Critical Bluetooth Flaw Exposes Android, Apple & Linux Devices to Takeover
• Dec. 4, 2023 - December Android updates fix critical zero-click RCE flaw