Vulnerability News - February 17, 2023

Snapshot

Feb. 10, 2023 - Feb. 17, 2023

CISA Known Exploited Vulnerabilities
CVE	Summary	Severity	Vendor	Date Added
CVE-2022-46169	Cacti contains a command injection vulnerability that allows an unauthenticated user to execute code.	CRITICAL	Cacti	Feb. 16, 2023
CVE-2023-23529	WebKit in Apple iOS, MacOS, Safari and iPadOS contains a type confusion vulnerability that may lead to code execution.	N/A	Apple	Feb. 14, 2023
CVE-2023-23376	Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability which allows for privilege escalation.	HIGH	Microsoft	Feb. 14, 2023
CVE-2023-21823	Microsoft Windows Graphic Component contains an unspecified vulnerability which allows for privilege escalation.	HIGH	Microsoft	Feb. 14, 2023
CVE-2023-21715	Microsoft Office Publisher contains a security feature bypass vulnerability which allows for a local, authenticated attack on a targeted system.	HIGH	Microsoft	Feb. 14, 2023
CVE-2023-0669	Fortra (formerly, HelpSystems) GoAnywhere MFT contains a pre-authentication remote code execution vulnerability in the License Response Servlet due to deserializing an attacker-controlled object.	HIGH	Fortra	Feb. 10, 2023
CVE-2015-2291	Intel ethernet diagnostics driver for Windows IQVW32.sys and IQVW64.sys contain an unspecified vulnerability that allows for a denial-of-service.	HIGH	Intel	Feb. 10, 2023
CVE-2022-24990	TerraMaster OS contains a remote command execution vulnerability that allows an unauthenticated user to execute commands on the target endpoint.	HIGH	TerraMaster	Feb. 10, 2023
Vulnerabilities In The News
CVE	Summary	Severity	Vendor	Risk Context
CVE-2023-21689 (6)	Microsoft Protected Extensible Authentication Protocol Remote Code Execution Vulnerability	CRITICAL		Actively Exploited Remote Code Execution
CVE-2022-45789 (6)	A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause execution of unauthorized Modbus fun...	CRITICAL	Schneider-Electric	Remote Code Execution
CVE-2022-45788 (6)	A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause arbitrary code executio...	CRITICAL	Schneider-Electric	Remote Code Execution
CVE-2023-23376 (18)	Windows Common Log File System Driver Elevation of Privilege Vulnerability	HIGH	Microsoft	CISA Known Exploited Actively Exploited Remote Code Execution
CVE-2023-21823 (17)	Windows Graphics Component Remote Code Execution Vulnerability	HIGH	Microsoft	CISA Known Exploited Actively Exploited Remote Code Execution
CVE-2023-21715 (18)	Microsoft Publisher Security Features Bypass Vulnerability	HIGH	Microsoft	CISA Known Exploited Actively Exploited Remote Code Execution
CVE-2023-0669 (9)	Fortra GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due ...	HIGH	Fortra	CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available

CISA Known Exploited Vulnerabilities

CISA added eight vulnerabilities to the known exploited vulnerabilities list.

Cacti — Cacti

CVE-2022-46169 / Added: Feb. 16, 2023

CRITICAL CVSS 9.80

Cacti contains a command injection vulnerability that allows an unauthenticated user to execute code.

Headlines

Feb. 17, 2023 - CISA adds Cacti, Office, Windows and iOS bugs to its Known Exploited Vulnerabilities Catalog
Feb. 16, 2023 - CISA warns of Windows and iOS bugs exploited as zero-days
Jan. 13, 2023 - Most Cacti Installations Unpatched Against Exploited Vulnerability | SecurityWeek.Com

Apple — Multiple Products

CVE-2023-23529 / Added: Feb. 14, 2023

CVSS Not Assigned

WebKit in Apple iOS, MacOS, Safari and iPadOS contains a type confusion vulnerability that may lead to code execution.

Headlines

Microsoft — Windows

CVE-2023-23376 / Added: Feb. 14, 2023

HIGH CVSS 7.80

Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability which allows for privilege escalation.

Headlines

Microsoft — Windows

CVE-2023-21823 / Added: Feb. 14, 2023

HIGH CVSS 7.80

Microsoft Windows Graphic Component contains an unspecified vulnerability which allows for privilege escalation.

Headlines

Microsoft — Office

CVE-2023-21715 / Added: Feb. 14, 2023

HIGH CVSS 7.30

Microsoft Office Publisher contains a security feature bypass vulnerability which allows for a local, authenticated attack on a targeted system.

Headlines

Fortra — GoAnywhere MFT

CVE-2023-0669 / Added: Feb. 10, 2023

HIGH CVSS 7.20

Fortra (formerly, HelpSystems) GoAnywhere MFT contains a pre-authentication remote code execution vulnerability in the License Response Servlet due to deserializing an attacker-controlled object.

Headlines

Intel — Ethernet Diagnostics Driver for Windows

CVE-2015-2291 / Added: Feb. 10, 2023

HIGH CVSS 7.20

Intel ethernet diagnostics driver for Windows IQVW32.sys and IQVW64.sys contain an unspecified vulnerability that allows for a denial-of-service.

Headlines

TerraMaster — TerraMaster OS

CVE-2022-24990 / Added: Feb. 10, 2023

HIGH CVSS 7.50

TerraMaster OS contains a remote command execution vulnerability that allows an unauthenticated user to execute commands on the target endpoint.

Headlines

In The News

Vulnerabilities receiving the most attention in traditional news media.

CVE-2023-21689

CRITICAL CVSS 9.80

Actively Exploited Remote Code Execution

Published: Feb. 14, 2023

Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability

Quotes

An account with the same name exists in Active Directory. Re-using the account was blocked by security policy
An unauthenticated attacker could send a malicious e-mail containing an RTF payload that would allow them to gain access to execute commands within the application used to open the malicious file

Headlines

CVE-2022-45789

CRITICAL CVSS 9.80

Remote Code Execution

Published: Jan. 31, 2023

A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause execution of unauthorized Modbus functions on the controller when hijacking an authenticated Modbus session. Affected Products: EcoStruxure™ Control Expert (All Versions), EcoStruxure™ Process Expert (Versions prior to V2020), Modicon M340 CPU - part numbers BMXP34* (All Versions), Modicon M580 CPU - part numbers BMEP* and BMEH* (All Versions), Modicon M580 CPU Safety - part numbers BMEP58*S and BMEH58*S (All Versions)

Vendor Impacted: Schneider-Electric

Products Impacted: Ecostruxure Control Expert, Ecostruxure Process Expert, Modicon M340 Bmxp342010

Quotes

Deep lateral movement lets attackers gain deep access to industrial control systems and cross often overlooked security perimeters, allowing them to perform highly granular and stealthy manipulations as well as override functional and safety limitations
We are trying to dispel the notion that you hear among asset owners and other parties that Level 1 devices and Level 1 networks are somehow different from regular Ethernet networks and Windows [machines] and that you cannot move through them in very similar ways
When investigating the patched EnhancedCyberReserve mechanism, we observed that it is still fundamentally broken

Headlines

CVE-2022-45788

CRITICAL CVSS 9.80

Remote Code Execution

Published: Jan. 30, 2023

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause arbitrary code execution, denial of service and loss of confidentiality & integrity when a malicious project file is loaded onto the controller. Affected Products: EcoStruxure™ Control Expert (All Versions), EcoStruxure™ Process Expert (Versions prior to V2020), Modicon M340 CPU - part numbers BMXP34* (All Versions), Modicon M580 CPU - part numbers BMEP* and BMEH* (All Versions), Modicon M580 CPU Safety - part numbers BMEP58*S and BMEH58*S (All Versions), Modicon Momentum Unity M1E Processor - 171CBU* (All Versions), Modicon MC80 - BMKC80 (All Versions), Legacy Modicon Quantum - 140CPU65* and Premium CPUs - TSXP57* (All Versions)

Vendor Impacted: Schneider-Electric

Products Impacted: Modicon M580 Bmep586040 Firmware, Modicon M580 Bmep582020 Firmware, Modicon M580 Bmep585040c Firmware, Modicon M580 Bmeh586040c Firmware, Modicon M580 Bmeh584040s Firmware, Modicon M580 Bmeh582040 Firmware, Modicon M580 Bmep584040 Firmware, Modicon M580 Bmep581020h Firmware, Modicon M580 Bmeh586040s Firmware, Modicon M580 Bmep585040 Firmware, Modicon M580 Bmep582040h Firmware, Modicon M580 Bmep582040s Firmware, Modicon Mc80 Bmkc8020301 Firmware, Modicon Mc80 Bmkc8020310 Firmware, Modicon Mc80 Bmkc8030311 Firmware, Modicon M580 Bmep582020h Firmware, Ecostruxure Process Expert, Modicon M580 Bmeh586040 Firmware, Modicon M580 Bmep584040s Firmware, Modicon M580 Bmep586040c Firmware, Modicon M580 Bmep582040 Firmware, Modicon M580 Bmep581020 Firmware, Modicon M580 Bmep584020 Firmware, Ecostruxure Control Expert, Modicon M580 Bmeh582040s Firmware, Modicon M580 Bmep583040 Firmware, Modicon M580 Bmep583020 Firmware, Modicon M580 Bmeh584040c Firmware, Modicon M580 Bmeh584040 Firmware, Modicon M580 Bmeh582040c Firmware

Quotes

Deep lateral movement lets attackers gain deep access to industrial control systems and cross often overlooked security perimeters, allowing them to perform highly granular and stealthy manipulations as well as override functional and safety limitations
We are trying to dispel the notion that you hear among asset owners and other parties that Level 1 devices and Level 1 networks are somehow different from regular Ethernet networks and Windows [machines] and that you cannot move through them in very similar ways
When investigating the patched EnhancedCyberReserve mechanism, we observed that it is still fundamentally broken

Headlines

CVE-2023-23376

HIGH CVSS 7.80

CISA Known Exploited Actively Exploited Remote Code Execution

Published: Feb. 14, 2023

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Vendor Impacted: Microsoft

Product Impacted: Windows

Quotes

An account with the same name exists in Active Directory. Re-using the account was blocked by security policy
All organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of Catalog vulnerabilities as part of their vulnerability management practice
Microsoft Office Publisher contains a security feature bypass vulnerability which allows for a local, authenticated attack on a targeted system
These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise
Sophisticated and highly targeted phishing attack
The attack itself is carried out locally by a user with authentication to the targeted system
Attack itself is carried out locally by a user with authentication to the targeted system
Being able to elevate privileges once on a target system is important for attackers seeking to do more damage
This vulnerability is relatively simple to exploit, utilizes local vectors, and requires low levels of access
An unauthenticated attacker could send a malicious e-mail containing an RTF payload that would allow them to gain access to execute commands within the application used to open the malicious file
Sadly, there’s just a little solid information about this privilege escalation

Headlines

CVE-2023-21823

HIGH CVSS 7.80

CISA Known Exploited Actively Exploited Remote Code Execution

Published: Feb. 14, 2023

Windows Graphics Component Remote Code Execution Vulnerability

Vendor Impacted: Microsoft

Product Impacted: Windows

Quotes

An account with the same name exists in Active Directory. Re-using the account was blocked by security policy
All organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of Catalog vulnerabilities as part of their vulnerability management practice
Microsoft Office Publisher contains a security feature bypass vulnerability which allows for a local, authenticated attack on a targeted system
These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise
Sophisticated and highly targeted phishing attack
The attack itself is carried out locally by a user with authentication to the targeted system
Attack itself is carried out locally by a user with authentication to the targeted system
Being able to elevate privileges once on a target system is important for attackers seeking to do more damage
This vulnerability is relatively simple to exploit, utilizes local vectors, and requires low levels of access
An unauthenticated attacker could send a malicious e-mail containing an RTF payload that would allow them to gain access to execute commands within the application used to open the malicious file
The Graphics Component bug (CVE-2023-21823) makes me worry on two accounts
Sadly, there’s just a little solid information about this privilege escalation

Headlines

CVE-2023-21715

HIGH CVSS 7.30

CISA Known Exploited Actively Exploited Remote Code Execution

Published: Feb. 14, 2023

Microsoft Publisher Security Features Bypass Vulnerability

Vendor Impacted: Microsoft

Product Impacted: Office

Quotes

An account with the same name exists in Active Directory. Re-using the account was blocked by security policy
All organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of Catalog vulnerabilities as part of their vulnerability management practice
Microsoft Office Publisher contains a security feature bypass vulnerability which allows for a local, authenticated attack on a targeted system
These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise
Sophisticated and highly targeted phishing attack
The attack itself is carried out locally by a user with authentication to the targeted system
Attack itself is carried out locally by a user with authentication to the targeted system
Being able to elevate privileges once on a target system is important for attackers seeking to do more damage
This vulnerability is relatively simple to exploit, utilizes local vectors, and requires low levels of access
An unauthenticated attacker could send a malicious e-mail containing an RTF payload that would allow them to gain access to execute commands within the application used to open the malicious file
Sadly, there’s just a little solid information about this privilege escalation

Headlines

CVE-2023-0669

HIGH CVSS 7.20

CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available

Published: Feb. 6, 2023

Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.

Vendor Impacted: Fortra

Products Impacted: Goanywhere Managed File Transfer, Goanywhere Mft

Quotes

The Clop ransomware group exploited this vulnerability and after authenticating the administrative console, declared they stole documents from 130 companies through administrator ports
As a result of the security breach experienced by Fortra, protected health information and personal information of certain patients of the company’s affiliates were exposed by Fortra’s attacker
Upon receiving notification of the security breach, the Company promptly launched an investigation, including to determine whether any Company information systems were affected, whether there was any impact to ongoing operations, and whether and to what extent PHI or PI had been unlawfully accessed by the attacker
While that investigation is still ongoing, the Company believes that the Fortra breach has not had any impact on any of the Company's information systems and that there has not been any material interruption of the Company's business operations, including the delivery of patient care

Headlines

Vulnerability and threat intelligence direct to your inbox every week.

Subscribe to Pulse

Ready to Offload Vulnerability Management?

Schedule a free consultation with a vulnerability expert to discuss your use cases and to see a demo.

Request a Demo

Solutions

By Solution

By Feature

I Want To…

Security Assessment Buyers Guide

Who It’s For

CISO’s

IT & Security Teams

Risk & Compliance

Vulnerability Management Cost Calculator

Resources

Resources

Blog

Pulse Threat Intelligence

I Want To…

Vulnerability Intelligence

About

About

Partners

I Want To…

We Do The Heavy Lifting

VULNERA Pulse

A digest of noteworthy issues being discussed in the information security industry.

February 17, 2023

Subscribe

Ready to Offload Vulnerability Management?

Quick Menu

Solutions

Features

CISO Challenges

IT Challenges

Compliance

Subscribe

By Solution

By Feature

I Want To…

Security Assessment Buyers Guide

Who It’s For

Vulnerability Management Cost Calculator

Resources

Resources

Blog

Pulse Threat Intelligence

I Want To…

Vulnerability Intelligence

About

Partners

I Want To…

We Do The Heavy Lifting

VULNERA Pulse

A digest of noteworthy issues being discussed in the information security industry.

February 17, 2023

Snapshot

CISA Known Exploited Vulnerabilities

Vulnerabilities In The News

CISA Known Exploited Vulnerabilities

Cacti — Cacti

Apple — Multiple Products

Microsoft — Windows

Microsoft — Windows

Microsoft — Office

Fortra — GoAnywhere MFT

Intel — Ethernet Diagnostics Driver for Windows

TerraMaster — TerraMaster OS

In The News

Subscribe

Ready to Offload Vulnerability Management?

Quick Menu

Features

Subscribe