VULNERA Pulse

FXC — AE1021, AE1021PE

CVE-2023-49897 / Added: Dec. 21, 2023

HIGH CVSS 8.80 EPSS Score 0.28 EPSS Percentile 65.08

FXC AE1021 and AE1021PE contain an OS command injection vulnerability that allows authenticated users to execute commands via a network.

Headlines

• Dec. 22, 2023 - CISA Warns of FXC Router, QNAP NVR Vulnerabilities Exploited in the Wild
• Dec. 21, 2023 - FXC AE1021/AE1021PE | CISA
• Dec. 17, 2023 - InfectedSlurs botnet targets QNAP VioStor NVR vulnerability
• Dec. 16, 2023 - QNAP VioStor NVR vulnerability actively exploited by malware botnet
• Dec. 8, 2023 - New botnet malware exploits zero-day CVE-2023-49897 flaw in routers

Back to top ↑

QNAP — VioStor NVR

CVE-2023-47565 / Added: Dec. 21, 2023

HIGH CVSS 8.80 EPSS Score 1.45 EPSS Percentile 85.24

QNAP VioStar NVR contains an OS command injection vulnerability that allows authenticated users to execute commands via a network.

Headlines

• Dec. 22, 2023 - CISA Warns of FXC Router, QNAP NVR Vulnerabilities Exploited in the Wild
• Dec. 21, 2023 - QNAP VioStor NVR | CISA
• Dec. 17, 2023 - InfectedSlurs botnet targets QNAP VioStor NVR vulnerability
• Dec. 16, 2023 - QNAP VioStor NVR vulnerability actively exploited by malware botnet

Back to top ↑

CVE-2023-50164

CRITICAL CVSS 9.80 EPSS Score 9.72 EPSS Percentile 94.23

Actively Exploited Remote Code Execution Public Exploits Available

Published: Dec. 7, 2023

An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.

Vendor Impacted: Apache

Product Impacted: Struts

Quotes

• AEM 6.5 Service Pack 19.1 (6.5.19.1)
• We believe that in most scenarios … most instances of exploitation of CVE-2023-50164 will be more one-off custom attacks against impacted applications meeting the required preconditions versus indiscriminate mass-exploitation attempts

Headlines

• Dec. 21, 2023 - 80 percent of Struts 2 downloads include critical flaw
• Dec. 20, 2023 - Apache Struts (CVE-2023-50164) RCE Vulnerability Affects some Cisco Products
• Dec. 19, 2023 - Adobe's Critical Response: Patching the CVE-2023-50164 Vulnerability in AEM Forms
• Dec. 17, 2023 - Week in review: Apache Struts vulnerability exploit attempt, EOL Sophos firewalls get hotfix

CVE-2023-36025

HIGH CVSS 8.80 EPSS Score 0.63 EPSS Percentile 76.76

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: Nov. 14, 2023

Windows SmartScreen Security Feature Bypass Vulnerability

Vendor Impacted: Microsoft

Products Impacted: Windows 10 21h2, Windows 10 1809, Windows 11 22h2, Windows Server 2019, Windows 10 1607, Windows Server 2022, Windows, Windows Server 2016, Windows Server 2012, Windows 10 1507, Windows 11 21h2, Windows 10 22h2, Windows Server 2008, Windows 11 23h2

Quotes

• Proofpoint regularly sees TDSs used by threat actors in attack chains, specifically cybercrime campaigns
• Malware written in uncommon programming languages puts the security community at a disadvantage as researchers and reverse engineers' unfamiliarity can hamper their investigation
• The actor’s use of both email and compromised websites with fake update lures to deliver DarkGate and NetSupport is unique but aligns with the overall trend Proofpoint has observed of cyber criminal threat actors adopting new, varied, and increasingly creative attack chains [...] to enable malware delivery

Headlines

• Dec. 22, 2023 - Decoy Microsoft Word Documents Used to Deliver Nim-Based Malware
• Dec. 22, 2023 - BattleRoyal Cluster: A DarkGate Contender Rises with Devious Tricks and Evolving Tactics
• Dec. 21, 2023 - 'BattleRoyal' Hackers Deliver DarkGate RAT Using Every Trick
• Dec. 21, 2023 - BattleRoyal Cluster Signals DarkGate Surge

CVE-2022-24521

HIGH CVSS 7.80 EPSS Score 0.05 EPSS Percentile 17.23

CISA Known Exploited

Published: April 15, 2022

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Vendor Impacted: Microsoft

Products Impacted: Windows Rt 8.1, Windows Server 2019, Windows Server 2022, Windows, Windows Server 2016, Windows Server 2012, Windows 7, Windows 8.1, Windows 11, Windows Server 2008, Windows 10

Quotes

• Modern Kernel Pool Exploitation: Attacks and Techniques
• Windows Common Log File System Driver Elevation Of Privilege Vulnerability
• Kernel drivers should be very careful when handling files, because if a vulnerability is discovered, attackers can exploit it and gain system privileges

Headlines

• Dec. 22, 2023 - Ransomware Attackers Abuse Multiple Windows CLFS Driver Zero-Days
• Dec. 21, 2023 - Windows CLFS and five exploits used by ransomware operators (Exploit #3 – October 2022)
• Dec. 21, 2023 - Windows CLFS and five exploits used by ransomware operators (Exploit #2 – September 2022)
• Dec. 21, 2023 - Windows CLFS and five exploits used by ransomware operators
• Dec. 21, 2023 - Windows CLFS and five exploits used by ransomware operators (Exploit #1 – CVE-2022-24521)
• Dec. 21, 2023 - Windows CLFS and five exploits used by ransomware operators (Exploit #5 – CVE-2023-28252)

CVE-2023-23376

HIGH CVSS 7.80 EPSS Score 0.06 EPSS Percentile 23.58

CISA Known Exploited

Published: Feb. 14, 2023

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Vendor Impacted: Microsoft

Products Impacted: Windows 10 21h2, Windows 10 1809, Windows 11 22h2, Windows Server 2019, Windows Server 2022, Windows, Windows Server 2016, Windows 10 22h2, Windows Server 2012, Windows 10 20h2, Windows 11 21h2, Windows 10 1607, Windows Server 2008, Windows 10

Quotes

• Windows Common Log File System Driver Elevation Of Privilege Vulnerability
• Kernel drivers should be very careful when handling files, because if a vulnerability is discovered, attackers can exploit it and gain system privileges

Headlines

• Dec. 22, 2023 - Ransomware Attackers Abuse Multiple Windows CLFS Driver Zero-Days
• Dec. 21, 2023 - Windows CLFS and five exploits used by ransomware operators (Exploit #4 – CVE-2023-23376)
• Dec. 21, 2023 - Windows CLFS and five exploits used by ransomware operators
• Dec. 21, 2023 - Windows CLFS and five exploits used by ransomware operators (Exploit #5 – CVE-2023-28252)

CVE-2022-37969

HIGH CVSS 7.80 EPSS Score 0.15 EPSS Percentile 50.51

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: Sept. 13, 2022

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Vendor Impacted: Microsoft

Products Impacted: Windows Server 2019, Windows Server 2022, Windows, Windows Server 2016, Windows Server 2012, Windows 7, Windows 8.1, Windows 11, Windows Server 2008, Windows 10

Quotes

• Windows Common Log File System Driver Elevation Of Privilege Vulnerability
• Kernel drivers should be very careful when handling files, because if a vulnerability is discovered, attackers can exploit it and gain system privileges

Headlines

• Dec. 22, 2023 - Ransomware Attackers Abuse Multiple Windows CLFS Driver Zero-Days
• Dec. 21, 2023 - Windows CLFS and five exploits used by ransomware operators (Exploit #3 – October 2022)
• Dec. 21, 2023 - Windows CLFS and five exploits used by ransomware operators (Exploit #2 – September 2022)
• Dec. 21, 2023 - Windows CLFS and five exploits used by ransomware operators

CVE-2023-4966

HIGH CVSS 7.50 EPSS Score 91.79 EPSS Percentile 98.69

CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available

Published: Oct. 10, 2023

Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA  virtual server. 

Vendor Impacted: Citrix

Products Impacted: Netscaler Application Delivery Controller, Netscaler Adc And Netscaler Gateway, Netscaler Gateway

Quotes

• Promptly patched and mitigated [their] systems
• On November 16, 2023, it was determined that information was likely acquired
• Citrix issued additional mitigation guidance on October 23, 2023. Xfinity promptly patched and mitigated the Citrix vulnerability within its systems
• After additional review of the affected systems and data, Xfinity concluded on December 6, 2023, that the customer information in scope included usernames and hashed passwords
• We are providing notice to customers about a data security incident which exploited a vulnerability previously announced by Citrix, a software provider used by Xfinity and thousands of other companies worldwide. We promptly patched and mitigated the vulnerability. We are not aware of any customer data being leaked anywhere, nor of any attacks on our customers. In addition, we required our customers to reset their passwords and we strongly recommend that they enable two-factor or multi-factor authentication, as many Xfinity customers already do. We take the responsibility to protect our customers very seriously and have our cybersecurity team monitoring 24x7

Headlines

• Dec. 20, 2023 - Citrix Bleed leveraged to steal data of 35+ million Comcast Xfinity customers
• Dec. 20, 2023 - Xfinity Discloses Data Breach Impacting Nearly 36 Million
• Dec. 19, 2023 - Comcast’s Xfinity customer data exposed after CitrixBleed attack
• Dec. 19, 2023 - Comcast Xfinity Breached via CitrixBleed; 35M Customers Affected
• Dec. 19, 2023 - Xfinity discloses data breach after recent Citrix server hack
• Dec. 19, 2023 - Xfinity discloses data breach affecting over 35 million people

CVE-2023-46446

MEDIUM CVSS 6.80 EPSS Score 0.07 EPSS Percentile 30.98

Risk Context N/A

Published: Nov. 14, 2023

An issue in AsyncSSH before 2.14.1 allows attackers to control the remote end of an SSH client session via packet injection/removal and shell emulation, aka a "Rogue Session Attack."

Vendor Impacted: Asyncssh Project

Product Impacted: Asyncssh

Quotes

• Lead to using less secure client authentication algorithms and deactivating specific countermeasures against keystroke timing attacks in OpenSSH 9.5
• The Terrapin attack exploits weaknesses in the SSH transport layer protocol in combination with newer cryptographic algorithms and encryption modes introduced by OpenSSH over 10 years ago
• By carefully adjusting the sequence numbers during the handshake, an attacker can remove an arbitrary amount of messages sent by the client or server at the beginning of the secure channel without the client or server noticing it

Headlines

• Dec. 20, 2023 - SSH shaken, not stirred by Terrapin downgrade vulnerability
• Dec. 19, 2023 - Terrapin attacks can downgrade security of OpenSSH connections
• Dec. 19, 2023 - SSH vulnerability exploitable in Terrapin attacks (CVE-2023-48795)
• Dec. 19, 2023 - CVE-2023-48795: SSH Flaw Lets Hackers Strip Secrets From Your Connection

CVE-2023-46445

MEDIUM CVSS 5.90 EPSS Score 0.06 EPSS Percentile 23.89

Risk Context N/A

Published: Nov. 14, 2023

An issue in AsyncSSH before 2.14.1 allows attackers to control the extension info message (RFC 8308) via a man-in-the-middle attack, aka a "Rogue Extension Negotiation."

Vendor Impacted: Asyncssh Project

Product Impacted: Asyncssh

Quotes

• Lead to using less secure client authentication algorithms and deactivating specific countermeasures against keystroke timing attacks in OpenSSH 9.5
• The Terrapin attack exploits weaknesses in the SSH transport layer protocol in combination with newer cryptographic algorithms and encryption modes introduced by OpenSSH over 10 years ago
• By carefully adjusting the sequence numbers during the handshake, an attacker can remove an arbitrary amount of messages sent by the client or server at the beginning of the secure channel without the client or server noticing it

Headlines

• Dec. 20, 2023 - SSH shaken, not stirred by Terrapin downgrade vulnerability
• Dec. 19, 2023 - Terrapin attacks can downgrade security of OpenSSH connections
• Dec. 19, 2023 - SSH vulnerability exploitable in Terrapin attacks (CVE-2023-48795)
• Dec. 19, 2023 - CVE-2023-48795: SSH Flaw Lets Hackers Strip Secrets From Your Connection

CVE-2023-7024

CVSS Not Assigned EPSS Score 0.11 EPSS Percentile 43.22

Actively Exploited Remote Code Execution

Published: Dec. 21, 2023

Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Quotes

• An exploit for CVE-2023-7024 exists in the wild
• Google is aware that an exploit for CVE-2023-7024 exists in the wild
• This code is still sandboxed due to the multiprocess architecture of Chrome though
• CVE-2023-7024: Heap buffer overflow in WebRTC. Reported by Clément Lecigne and Vlad Stolyarov of Google’s Threat Analysis Group on 2023-12-19

Headlines

• Dec. 22, 2023 - Google Releases Eighth Zero-Day Patch of 2023 for Chrome
• Dec. 21, 2023 - Don’t fall prey to this worrying Google Chrome exploit – update your browser now
• Dec. 21, 2023 - A Vulnerability in Google Chrome Could Allow for Arbitrary Code Execution
• Dec. 21, 2023 - Urgent: New Chrome Zero-Day Vulnerability Exploited in the Wild - Update ASAP
• Dec. 21, 2023 - CVE-2023-7024: Zero-Day Vulnerability Threatens Chrome Web Browser
• Dec. 20, 2023 - Google addressed a new actively exploited Chrome zero-day
• Dec. 20, 2023 - Google fixes 8th Chrome zero-day exploited in attacks this year

CVE-2023-48795

CVSS Not Assigned EPSS Score 0.90 EPSS Percentile 80.88

Risk Context N/A

Published: Dec. 18, 2023

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Client befor...
Please see the NVD entry for the full description.

Quotes

• Lead to using less secure client authentication algorithms and deactivating specific countermeasures against keystroke timing attacks in OpenSSH 9.5
• The Terrapin attack exploits weaknesses in the SSH transport layer protocol in combination with newer cryptographic algorithms and encryption modes introduced by OpenSSH over 10 years ago
• By carefully adjusting the sequence numbers during the handshake, an attacker can remove an arbitrary amount of messages sent by the client or server at the beginning of the secure channel without the client or server noticing it

Headlines

• Dec. 20, 2023 - SSH shaken, not stirred by Terrapin downgrade vulnerability
• Dec. 19, 2023 - Terrapin attacks can downgrade security of OpenSSH connections
• Dec. 19, 2023 - SSH vulnerability exploitable in Terrapin attacks (CVE-2023-48795)
• Dec. 19, 2023 - CVE-2023-48795: SSH Flaw Lets Hackers Strip Secrets From Your Connection