VULNERA Pulse

Apple — Multiple Products

CVE-2025-24085 / Added: Jan. 29, 2025

HIGH CVSS 7.80 EPSS Score 0.21 EPSS Percentile 58.90

Apple iOS, macOS, and other Apple products contain a user-after-free vulnerability that could allow a malicious application to elevate privileges.

Headlines

• Feb. 2, 2025 - Week in review: Apple 0-day used to target iPhones, DeepSeek’s popularity exploited by scammers
• Jan. 29, 2025 - U.S. CISA adds Apple products' flaw to its Known Exploited Vulnerabilities catalog
• Jan. 28, 2025 - Multiple Vulnerabilities in Apple Products Could Allow for Arbitrary Code Execution
• Jan. 28, 2025 - Apple zero-day vulnerability exploited to target iPhone users (CVE-2025-24085)
• Jan. 28, 2025 - Apple plugs exploited security hole in iOS, updates macOS
• Jan. 28, 2025 - Apple Patches Actively Exploited Zero-Day Affecting iPhones, Macs, and More
• Jan. 27, 2025 - CVE-2025-24085: Apple Patches Actively Exploited Zero-Day Vulnerability
• Jan. 27, 2025 - Apple Patches Actively Exploited Zero-Day Vuln
• Jan. 27, 2025 - Apple fixed the first actively exploited zero-day of 2025
• Jan. 27, 2025 - Apple fixes this year’s first actively exploited zero-day bug

Back to top ↑

CVE-2024-57726

CRITICAL CVSS 9.90 EPSS Score 0.05 EPSS Percentile 21.57

Risk Context N/A

Published: Jan. 15, 2025

SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role.

Vendor Impacted: Simple-Help

Product Impacted: Simplehelp

Quotes

• Attackers can leverage this vulnerability to execute arbitrary commands on affected devices, leading to complete system compromise, data exfiltration, or network infiltration
• If a threat actor chains these vulnerabilities together and gains administrative access to a SimpleHelp server, they could theoretically use it to compromise devices running the SimpleHelp client software
• While it is not confirmed that the recently disclosed vulnerabilities are responsible for the observed campaign, Arctic Wolf strongly recommends upgrading to the latest available fixed versions of the SimpleHelp server software where possible
• On 22 January 2025, Arctic Wolf began observing a campaign involving unauthorised access to devices running SimpleHelp RMM software as an initial access vector. Roughly a week prior to the emergence of this campaign, several vulnerabilities had been publicly disclosed in SimpleHelp by Horizon3 (CVE-2024-57726, CVE-2024-57727, and CVE-2024-57728)

Headlines

• Jan. 29, 2025 - Attackers exploit SimpleHelp RMM Software flaws for initial access
• Jan. 29, 2025 - Zyxel CPE Devices Face Active Exploitation Due to Unpatched CVE-2024-40891 Vulnerability
• Jan. 28, 2025 - Hackers exploiting flaws in SimpleHelp RMM to breach networks
• Jan. 28, 2025 - SimpleHelp RMM Vulnerabilities Exploited in Latest Cyberattack Campaign

CVE-2025-23006

CRITICAL CVSS 9.80 EPSS Score 1.37 EPSS Percentile 86.18

CISA Known Exploited Actively Exploited Remote Code Execution

Published: Jan. 23, 2025

Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC), which in specific conditions could potentially enable a remote unauthenticated attacker to execute arbitrary OS commands.

Vendor Impacted: Sonicwall

Products Impacted: Sma7200, Sma6200, Sma6210, Sra Ex6000, Sra Ex6000 Firmware, Sra Ex7000 Firmware, Sra Ex9000 Firmware, Sma8200v, Sma7200 Firmware, Sra Ex7000, Sma1000 Appliances, Sma6210 Firmware, Sra Ex9000, Sma7210 Firmware, Sma6200 Firmware, Sma7210

Quotes

• At imminent risk of exploitation
• Email bombing + posing as tech support via Microsoft Teams

Headlines

• Jan. 27, 2025 - 5,000+ SonicWall firewalls still open to attack (CVE-2024-53704)
• Jan. 27, 2025 - ⚡ THN Weekly Recap: Top Cybersecurity Threats, Tools and Tips [27 January]
• Jan. 26, 2025 - Week in review: 48k Fortinet firewalls open to attack, attackers "vishing" orgs via Microsoft Teams

CVE-2024-55591

CRITICAL CVSS 9.80 EPSS Score 2.63 EPSS Percentile 90.23

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: Jan. 14, 2025

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.

Vendor Impacted: Fortinet

Products Impacted: Fortiproxy, Fortios, Fortios And Fortiproxy

Quotes

• Email bombing + posing as tech support via Microsoft Teams
• Authentication bypass using an alternate path or channel vulnerability

Headlines

• Jan. 29, 2025 - PoC Releases for Fortinet Zero-Day Vulnerability CVE-2024-5559, 45,000 Remain Vulnerable
• Jan. 28, 2025 - Fortinet Zero-Day Gives Attackers Super-Admin Privileges
• Jan. 26, 2025 - Week in review: 48k Fortinet firewalls open to attack, attackers "vishing" orgs via Microsoft Teams

CVE-2024-40891

HIGH CVSS 8.80 EPSS Score 0.05 EPSS Percentile 23.20

Risk Context N/A

Published: Feb. 4, 2025

**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device via Telnet.

Quotes

• Ordinarily, disclosure would be coordinated with the vendor, but due to the large number of attacks, we decided to publish this immediately
• GreyNoise is observing active exploitation attempts targeting a zero-day critical command injection vulnerability in Zyxel CPE Series devices tracked as CVE-2024-40891
• Attackers can leverage this vulnerability to execute arbitrary commands on affected devices, leading to complete system compromise, data exfiltration, or network infiltration
• CVE-2024-40891 is very similar to CVE-2024-40890 (observed authentication attempts, observed command injection attempts), with the main difference being that the former is telnet-based while the latter is HTTP-based
• After identifying a significant overlap between IPs exploiting CVE-2024-40891 and those classified as Mirai, the team investigated a recent variant of Mirai and confirmed that the ability to exploit CVE-2024-40891 has been incorporated into some Mirai strains
• CVE-2024-40891 is very similar to CVE-2024-40890 (observed authentication attempts, observed command injection attempts), with the main difference being that the former is telnet-based while the latter is HTTP-based. Both vulnerabilities allow unauthenticated attackers to execute arbitrary commands using service accounts (supervisor and/or zyuser)

Headlines

• Jan. 31, 2025 - Zero-Day Alert: Mirai Botnet Exploiting Unpatched Zyxel CPE Vulnerability (CVE-2024-40891)
• Jan. 29, 2025 - Unpatched Zyxel CPE Zero-Day Pummeled by Cyberattackers
• Jan. 29, 2025 - Zyxel CPE devices under attack via critical vulnerability without a patch (CVE-2024-40891)
• Jan. 29, 2025 - Hackers exploit critical unpatched flaw in Zyxel CPE devices
• Jan. 29, 2025 - Attackers actively exploit a critical zero-day in Zyxel CPE Series devices
• Jan. 29, 2025 - Zyxel CPE Devices Face Active Exploitation Due to Unpatched CVE-2024-40891 Vulnerability

CVE-2024-40890

HIGH CVSS 8.80 EPSS Score 0.05 EPSS Percentile 23.20

Risk Context N/A

Published: Feb. 4, 2025

**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device by sending a crafted HTTP POST request.

Quotes

• Ordinarily, disclosure would be coordinated with the vendor, but due to the large number of attacks, we decided to publish this immediately
• Attackers can leverage this vulnerability to execute arbitrary commands on affected devices, leading to complete system compromise, data exfiltration, or network infiltration
• CVE-2024-40891 is very similar to CVE-2024-40890 (observed authentication attempts, observed command injection attempts), with the main difference being that the former is telnet-based while the latter is HTTP-based
• CVE-2024-40891 is very similar to CVE-2024-40890 (observed authentication attempts, observed command injection attempts), with the main difference being that the former is telnet-based while the latter is HTTP-based. Both vulnerabilities allow unauthenticated attackers to execute arbitrary commands using service accounts (supervisor and/or zyuser)

Headlines

• Jan. 31, 2025 - Zero-Day Alert: Mirai Botnet Exploiting Unpatched Zyxel CPE Vulnerability (CVE-2024-40891)
• Jan. 29, 2025 - Unpatched Zyxel CPE Zero-Day Pummeled by Cyberattackers
• Jan. 29, 2025 - Zyxel CPE devices under attack via critical vulnerability without a patch (CVE-2024-40891)
• Jan. 29, 2025 - Hackers exploit critical unpatched flaw in Zyxel CPE devices
• Jan. 29, 2025 - Attackers actively exploit a critical zero-day in Zyxel CPE Series devices
• Jan. 29, 2025 - Zyxel CPE Devices Face Active Exploitation Due to Unpatched CVE-2024-40891 Vulnerability

CVE-2025-22217

HIGH CVSS 8.60 EPSS Score 0.04 EPSS Percentile 11.48

Risk Context N/A

Published: Jan. 28, 2025

Avi Load Balancer contains an unauthenticated blind SQL Injection vulnerability which was privately reported to VMware. Patches are available to remediate this vulnerability in affected VMware products.  A malicious user with network access may be able to use specially crafted SQL queries to gain database access.

Quotes

• Use specially crafted SQL queries to gain database access
• VMware AVI Load Balancer contains an unauthenticated blind SQL Injection vulnerability
• A malicious user with network access may be able to use specially crafted SQL queries to gain database access

Headlines

• Jan. 31, 2025 - Broadcom Patches VMware Aria Flaws – Exploits May Lead to Credential Theft
• Jan. 29, 2025 - VMware Avi Load Balancer Flaw (CVE-2025-22217) Exposes Networks to Blind SQLi Attacks
• Jan. 29, 2025 - Broadcom Warns of High-Severity SQL Injection Flaw in VMware Avi Load Balancer
• Jan. 28, 2025 - VMware fixed a flaw in Avi Load Balancer

CVE-2025-24085

HIGH CVSS 7.80 EPSS Score 0.21 EPSS Percentile 58.90

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: Jan. 27, 2025

A use after free issue was addressed with improved memory management. This issue is fixed in visionOS 2.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3. A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 17.2.

Vendor Impacted: Apple

Products Impacted: Iphone Os, Watchos, Tvos, Ipados, Multiple Products, Macos, Visionos

Quotes

• The media pipeline used by AVFoundation and other high-level media frameworks found on Apple platforms
• A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 17.2

Headlines

• Jan. 29, 2025 - U.S. CISA adds Apple products' flaw to its Known Exploited Vulnerabilities catalog
• Jan. 28, 2025 - Multiple Vulnerabilities in Apple Products Could Allow for Arbitrary Code Execution
• Jan. 28, 2025 - Apple zero-day vulnerability exploited to target iPhone users (CVE-2025-24085)
• Jan. 28, 2025 - Apple plugs exploited security hole in iOS, updates macOS
• Jan. 28, 2025 - Apple Patches Actively Exploited Zero-Day Affecting iPhones, Macs, and More
• Jan. 27, 2025 - CVE-2025-24085: Apple Patches Actively Exploited Zero-Day Vulnerability
• Jan. 27, 2025 - Apple Patches Actively Exploited Zero-Day Vuln
• Jan. 27, 2025 - Apple fixed the first actively exploited zero-day of 2025
• Jan. 27, 2025 - Apple fixes this year’s first actively exploited zero-day bug

CVE-2024-57727

HIGH CVSS 7.50 EPSS Score 0.47 EPSS Percentile 75.53

Public Exploits Available

Published: Jan. 15, 2025

SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files include server configuration files containing various secrets and hashed user passwords.

Vendor Impacted: Simple-Help

Product Impacted: Simplehelp

Quotes

• Attackers can leverage this vulnerability to execute arbitrary commands on affected devices, leading to complete system compromise, data exfiltration, or network infiltration
• If a threat actor chains these vulnerabilities together and gains administrative access to a SimpleHelp server, they could theoretically use it to compromise devices running the SimpleHelp client software
• While it is not confirmed that the recently disclosed vulnerabilities are responsible for the observed campaign, Arctic Wolf strongly recommends upgrading to the latest available fixed versions of the SimpleHelp server software where possible
• On 22 January 2025, Arctic Wolf began observing a campaign involving unauthorised access to devices running SimpleHelp RMM software as an initial access vector. Roughly a week prior to the emergence of this campaign, several vulnerabilities had been publicly disclosed in SimpleHelp by Horizon3 (CVE-2024-57726, CVE-2024-57727, and CVE-2024-57728)

Headlines

• Jan. 29, 2025 - Attackers exploit SimpleHelp RMM Software flaws for initial access
• Jan. 29, 2025 - Zyxel CPE Devices Face Active Exploitation Due to Unpatched CVE-2024-40891 Vulnerability
• Jan. 28, 2025 - Hackers exploiting flaws in SimpleHelp RMM to breach networks
• Jan. 28, 2025 - SimpleHelp RMM Vulnerabilities Exploited in Latest Cyberattack Campaign

CVE-2024-57728

HIGH CVSS 7.20 EPSS Score 0.05 EPSS Percentile 21.29

Risk Context N/A

Published: Jan. 15, 2025

SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user.

Vendor Impacted: Simple-Help

Product Impacted: Simplehelp

Quotes

• Attackers can leverage this vulnerability to execute arbitrary commands on affected devices, leading to complete system compromise, data exfiltration, or network infiltration
• If a threat actor chains these vulnerabilities together and gains administrative access to a SimpleHelp server, they could theoretically use it to compromise devices running the SimpleHelp client software
• While it is not confirmed that the recently disclosed vulnerabilities are responsible for the observed campaign, Arctic Wolf strongly recommends upgrading to the latest available fixed versions of the SimpleHelp server software where possible
• On 22 January 2025, Arctic Wolf began observing a campaign involving unauthorised access to devices running SimpleHelp RMM software as an initial access vector. Roughly a week prior to the emergence of this campaign, several vulnerabilities had been publicly disclosed in SimpleHelp by Horizon3 (CVE-2024-57726, CVE-2024-57727, and CVE-2024-57728)

Headlines

• Jan. 29, 2025 - Attackers exploit SimpleHelp RMM Software flaws for initial access
• Jan. 29, 2025 - Zyxel CPE Devices Face Active Exploitation Due to Unpatched CVE-2024-40891 Vulnerability
• Jan. 28, 2025 - Hackers exploiting flaws in SimpleHelp RMM to breach networks
• Jan. 28, 2025 - SimpleHelp RMM Vulnerabilities Exploited in Latest Cyberattack Campaign

CVE-2024-41710

MEDIUM CVSS 6.80 EPSS Score 0.04 EPSS Percentile 17.83

Actively Exploited Remote Code Execution

Published: Aug. 12, 2024

A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could allow an authenticated attacker with administrative privilege to conduct an argument injection attack, due to insufficient parameter sanitization during the boot process. A successful exploit could allow an attacker to execute arbitrary commands within the context of the system.

Quotes

• We haven't seen this behavior before in a Mirai variant so perhaps it may become a new feature
• Tacked on concealment and persistence mechanisms, such as preventing device shutdown and restart
• Aquabot is a botnet that was built off the Mirai framework with the ultimate goal of distributed denial-of-service (DDoS)
• This third iteration adds a novel activity for a Mirai-based botnet: C2 communication when the botnet catches certain signals
• Akamai SIRT detected exploit attempts targeting this vulnerability through our global network of honeypots in early January 2025 using a payload almost identical to the PoC
• This malware exhibits a behavior we have never before seen with a Mirai variant: a function (report_kill) to report back to the command and control (C2) when a kill signal was caught on the infected device

Headlines

• Jan. 31, 2025 - Aquabotv3: The Mirai-Based Botnet Exploiting CVE-2024-41710 for DDoS Attacks
• Jan. 30, 2025 - New Aquabot Botnet Exploits CVE-2024-41710 in Mitel Phones for DDoS Attacks
• Jan. 30, 2025 - New Aquabotv3 botnet malware targets Mitel command injection flaw
• Jan. 29, 2025 - Aquabot variant v3 targets Mitel SIP phones
• Jan. 29, 2025 - Mirai Variant ‘Aquabot’ Exploits Mitel Device Flaws
• Jan. 29, 2025 - Beware of DDoSes from Mirai-based botnet of Mitel phones