VULNERA Pulse

CWP — Control Web Panel

CVE-2022-44877 / Added: Jan. 17, 2023

CRITICAL CVSS 9.80

CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command injection vulnerability that allows remote attackers to execute commands via shell metacharacters in the login parameter.

Headlines

• Jan. 13, 2023 - Hackers target and exploit major Control Web Panel security flaw
• Jan. 13, 2023 - Vulnerability With 9.8 Severity in Control Web Panel is Under Active Exploit
• Jan. 13, 2023 - Vulnerability with 9.8 severity in Control Web Panel is under active exploit
• Jan. 12, 2023 - Threat actors actively exploit Control Web Panel RCE following PoC release
• Jan. 12, 2023 - Alert: Hackers Actively Exploiting Critical "Control Web Panel" RCE Vulnerability
• Jan. 6, 2023 - Centos Web Panel 7 Unauthenticated Remote Code Execution - CVE-2022-44877

Back to top ↑

CVE-2022-42475

CRITICAL CVSS 9.80

CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available

Published: Jan. 2, 2023

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.

Vendor Impacted: Fortinet

Products Impacted: Fim-7910e, Fortigate-6501f-Dc, Fortigate-7060e, Fortigate-6500f, Fortigate-6300f-Dc, Fortigate-6500f-Dc, Fortiproxy, Fim-7921f, Fortigate-7121f, Fpm-7620e, Fim-7920e, Fim-7904e, Fpm-7630e, Fortigate-7040e, Fortios, Fortigate-6501f, Fortigate-6601f-Dc, Fortigate-7030e, Fim-7941f, Fortigate-6300f, Fim-7901e, Fpm-7620f, Fortigate-6601f

Quotes

• There is no mechanism to detect malicious processes running on such devices, nor telemetry to proactively hunt for malicious images deployed on them following an exploitation of a vulnerability - BleepingComputer
• We assess with low confidence that this operation has a nexus to the People's Republic of China. China-nexus clusters have historically shown significant interest in targeting networking devices and manipulating the operating system or underlying software which supports these devices - SecurityWeek
• A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests - Security Affairs
• This incident continues China's pattern of exploiting internet facing devices, specifically those used for managed security purposes (e.g., firewalls, IPS\IDS appliances etc.) - The Hacker News
• The implementation of these features shows an in-depth knowledge of the functioning of Fortinet devices - Dark Reading

Headlines

• Jan. 20, 2023 - New Boldmove Linux malware used to backdoor Fortinet devices
• Jan. 20, 2023 - Chinese Hackers Exploited Fortinet VPN Vulnerability as Zero-Day
• Jan. 20, 2023 - Chinese hackers used recently patched FortiOS SSL-VPN flaw as a zero-day in October
• Jan. 20, 2023 - New Chinese Malware Spotted Exploiting Recent Fortinet Firewall Vulnerability
• Jan. 19, 2023 - Attackers Crafted Custom Malware for Fortinet Zero-Day
• Jan. 15, 2023 - Week in review: ChatGPT as an infosec assistant, Google offers help to EU cybersecurity startups

CVE-2022-3236

CRITICAL CVSS 9.80

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: Sept. 23, 2022

A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older.

Vendor Impacted: Sophos

Product Impacted: Firewall

Quotes

• A small set of specific organizations, primarily in the South Asia region - The Register - Security
• More than 99% of Internet-facing Sophos Firewalls haven't upgraded to versions containing the official fix for CVE-2022-3236 - TechRadar - All the latest technology news
• More than 99% of internet-facing Sophos Firewalls haven't upgraded to versions containing the official fix for CVE-2022-3236 - BleepingComputer

Headlines

• Jan. 19, 2023 - A Vulnerability in Sophos Firewall Could Allow for Remote Code Execution
• Jan. 18, 2023 - Thousands of Sophos firewalls still vulnerable out there to hijacking
• Jan. 18, 2023 - Thousands of Sophos servers are vulnerable to this dangerous exploit
• Jan. 18, 2023 - More Than 4,400 Sophos Firewall Servers Remain Vulnerable To Critical Exploits
• Jan. 18, 2023 - More than 4,400 Sophos firewall servers remain vulnerable to critical exploits
• Jan. 17, 2023 - Over 4,000 Sophos Firewall devices vulnerable to RCE attacks

CVE-2022-4873

CRITICAL CVSS 9.80

Remote Code Execution

Published: Jan. 11, 2023

On Netcomm router models NF20MESH, NF20, and NL1902 a stack based buffer overflow affects the sessionKey parameter. By providing a specific number of bytes, the instruction pointer is able to be overwritten on the stack and crashes the application at a known location.

Vendor Impacted: Netcommwireless

Products Impacted: Nl1902 Firmware, Nf20 Firmware, Nl1902, Nf20mesh Firmware, Nf20mesh, Nf20

Quotes

• Netcomm router models NF20MESH, NF20, and NL1902 running software versions earlier than R6B035 contain two vulnerabilities - Security Affairs
• These SOHO devices are sold by TP-Link and their latest firmware available as of January 11, 2023, have two vulnerabilities - SecurityWeek
• The two vulnerabilities, when chained together, permit a remote, unauthenticated attacker to execute arbitrary code - The Hacker News

Headlines

• Jan. 18, 2023 - A couple of bugs can be chained to hack Netcomm routers
• Jan. 18, 2023 - Remote Code Execution Vulnerabilities Found in TP-Link, NetComm Routers
• Jan. 18, 2023 - Critical Security Vulnerabilities Discovered in Netcomm and TP-Link Routers
• Jan. 17, 2023 - VU#986018: New Netcomm router models NF20MESH, NF20, and NL1902 vulnerabilities

CVE-2022-46169

CRITICAL CVSS 9.80

Actively Exploited Remote Code Execution Public Exploits Available

Published: Dec. 5, 2022

Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In affected versions a command injection vulnerability allows an unauthenticated user to execute arbitrary code on a server running Cacti, if a specific data source was selected for any monitored device. The vulnerability resides in the `remote_agent.php` file. This file can be accessed without authentication. This function retrieves the IP address of the client via `get_client_addr` and resolves this IP address to the corresponding hostname via `gethostbyaddr`. After this, it is verified that an entry within the `poller` table exists, where the hostname corresponds to the resolved hostname. If such an entry was found, the function returns `true` and the client is authorized. This authorization can be bypassed due to the implementation of the `get_client_addr` function. The function is defined in the file `lib/functions.php` and checks serval `$_SERVER` variables to determine the IP address of the client. The variables beginning with `HTTP_` can be arbitrarily set by an attacker. Since there is a default entry in the `poller` table with the hostname of the server running Cacti, an attacker can bypass the authentication e.g. by providing the header `Forwarded-For: `. This way the function `get_client_addr` returns the IP address of the server running Cacti. The following call to `gethostbyaddr` will resolve this IP address to the hostname of the server, which will pass the `poller` hostname check because of the default entry. After the authorization of the `remote_agent.php` file is bypassed, an attacker can trigger different actions. One of these actions is called `polldata...
Please see the NVD entry for the full description.

Quotes

• Censys has observed 6,427 hosts on the internet running a version of Cacti. Unfortunately, we can only see the exact running software version when a specific theme (sunrise) is enabled on the web application - TechRadar - All the latest technology news
• A command injection vulnerability allows an unauthenticated user to execute arbitrary code on a server running Cacti, if a specific data source was selected for any monitored device - Security Affairs
• A hostname-based authorization check is not implemented safely for most installations of Cacti - The Hacker News

Headlines

• Jan. 17, 2023 - Hackers are using device monitoring software Cacti to install malware
• Jan. 16, 2023 - Hackers exploit Cacti critical bug to install malware, open reverse shells
• Jan. 14, 2023 - Most internet-exposed Cacti servers exposed to hacking
• Jan. 14, 2023 - Cacti Servers Under Attack as Majority Fail to Patch Critical Vulnerability

CVE-2022-4874

HIGH CVSS 7.50

Risk Context N/A

Published: Jan. 11, 2023

Authentication bypass in Netcomm router models NF20MESH, NF20, and NL1902 allows an unauthenticated user to access content. In order to serve static content, the application performs a check for the existence of specific characters in the URL (.css, .png etc). If it exists, it performs a "fake login" to give the request an active session to load the file and not redirect to the login page.

Quotes

• Netcomm router models NF20MESH, NF20, and NL1902 running software versions earlier than R6B035 contain two vulnerabilities - Security Affairs
• These SOHO devices are sold by TP-Link and their latest firmware available as of January 11, 2023, have two vulnerabilities - SecurityWeek
• The two vulnerabilities, when chained together, permit a remote, unauthenticated attacker to execute arbitrary code - The Hacker News

Headlines

• Jan. 18, 2023 - A couple of bugs can be chained to hack Netcomm routers
• Jan. 18, 2023 - Remote Code Execution Vulnerabilities Found in TP-Link, NetComm Routers
• Jan. 18, 2023 - Critical Security Vulnerabilities Discovered in Netcomm and TP-Link Routers
• Jan. 17, 2023 - VU#986018: New Netcomm router models NF20MESH, NF20, and NL1902 vulnerabilities

CVE-2022-47966

CVSS Not Assigned

Actively Exploited Remote Code Execution Public Exploits Available

Published: Jan. 18, 2023

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections.

Quotes

• Because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections - SecurityWeek
• This vulnerability allows an unauthenticated adversary to execute arbitrary code when the above SAML SSO criteria is met - Security Affairs
• The vulnerability allows an attacker to gain remote code execution by issuing a HTTP POST request containing a malicious SAML response - BleepingComputer
• ... an outdated third party dependence, Apache Santuario - Dark Reading
• Once an attacker has SYSTEM-level access to the endpoint, attackers are likely to begin dumping credentials via LSASS or leverage existing public tooling to access stored application credentials to conduct lateral movement - infosecurity-magazine.com
• The vulnerability is easy to exploit and a good candidate for attackers to 'spray and pray' across the Internet. This vulnerability allows for remote code execution as NT AUTHORITY\SYSTEM, essentially giving an attacker complete control over the system - TechRadar - All the latest technology news
• This vulnerability allows an unauthenticated adversary to execute arbitrary code - The Hacker News
• Once an attacker has SYSTEM level access to the endpoint, attackers are likely to begin dumping credentials via LSASS or leverage existing public tooling to access stored application credentials to conduct lateral movement - SecurityWeek

Headlines

• Jan. 20, 2023 - This Week in Security: Git Deep Dive, Mailchimp, and SPF
• Jan. 20, 2023 - In-the-Wild Exploitation of Recent ManageEngine Vulnerability Commences
• Jan. 19, 2023 - Experts released PoC exploit for critical Zoho ManageEngine RCE flaw
• Jan. 19, 2023 - Exploit released for critical ManageEngine RCE bug, patch now
• Jan. 17, 2023 - Unpatched Zoho MangeEngine Products Under Active Cyberattack
• Jan. 17, 2023 - Researchers Warn Against Zoho ManageEngine Exploit Attacks
• Jan. 17, 2023 - Patch your Zoho ManageEngine instance immediately! PoC Exploit for CVE-2022-47966 will be released soon
• Jan. 17, 2023 - These VMware products can remotely execute code, so update now
• Jan. 17, 2023 - Zoho ManageEngine PoC Exploit to be Released Soon - Patch Before It's Too Late!
• Jan. 16, 2023 - Researchers to release PoC exploit for critical ManageEngine RCE bug, patch now
• Jan. 16, 2023 - Researchers to release PoC exploit for critical Zoho RCE bug, patch now
• Jan. 16, 2023 - Researchers: Brace for Zoho ManageEngine 'Spray and Pray' Attacks

CVE-2022-41903

CVSS Not Assigned

Remote Code Execution

Published: Jan. 17, 2023

Git is distributed revision control system. `git log` can display commits in an arbitrary format using its `--format` specifiers. This functionality is also exposed to `git archive` via the `export-subst` gitattribute. When processing the padding operators, there is a integer overflow in `pretty.c::format_and_pad_commit()` where a `size_t` is stored improperly as an `int`, and then added as an offset to a `memcpy()`. This overflow can be triggered directly by a user running a command which invokes the commit formatting machinery (e.g., `git log --format=...`). It may also be triggered indirectly through git archive via the export-subst mechanism, which expands format specifiers inside of files within the repository during a git archive. This integer overflow can result in arbitrary heap writes, which may result in arbitrary code execution. The problem has been patched in the versions published on 2023-01-17, going back to v2.30.7. Users are advised to upgrade. Users who are unable to upgrade should disable `git archive` in untrusted repositories. If you expose git archive via `git daemon`, disable it by running `git config --global daemon.uploadArch false`.

Quotes

• When processing the padding operators, there is an integer overflow in `pretty.c::format_and_pad_commit()` where a `size_t` is stored improperly as an `int`, and then added as an offset to a `memcpy()` - iTnews - Security
• The most severe issue discovered allows an attacker to trigger a heap-based memory corruption during clone or pull operations, which might result in code execution. Another critical issue allows code execution during an archive operation, which is commonly performed by Git forges - TechRadar - All the latest technology news
• Git is distributed revision control system. `git log` can display commits in an arbitrary format using its `-format` specifiers. This functionality is also exposed to `git archive` via the `export-subst` gitattribute. When processing the padding operators, there is a integer overflow in `pretty.c::format_and_pad_commit()` where a `size_t` is stored improperly as an `int`, and then added as an offset to a `memcpy()` - Security Affairs
• The Git codebase shows several security issues and the sheer size of the codebase makes it challenging to address all potential instances of these issues - SecurityWeek
• The most severe issue discovered allows an attacker to trigger a heap-based memory corruption during clone or pull operations, which might result in code execution - The Hacker News

Headlines

• Jan. 20, 2023 - This Week in Security: Git Deep Dive, Mailchimp, and SPF
• Jan. 20, 2023 - GitLab pushes patches for critical bugs
• Jan. 19, 2023 - Git patches two critical remote code execution security flaws
• Jan. 19, 2023 - Critical RCE vulnerabilities found in git (CVE-2022-41903, CVE-2022-23251)
• Jan. 18, 2023 - Two critical flaws discovered in Git source code version control system
• Jan. 18, 2023 - Critical Git Vulnerabilities Discovered in Source Code Security Audit
• Jan. 18, 2023 - Git Users Urged to Update Software to Prevent Remote Code Execution Attacks
• Jan. 17, 2023 - Git security vulnerabilities announced
• Jan. 17, 2023 - Git 2.39.1 and friends

CVE-2022-23521

CVSS Not Assigned

Remote Code Execution Public Exploits Available

Published: Jan. 17, 2023

Git is distributed revision control system. gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by adding a `.gitattributes` file to the repository, which contains a set of file patterns and the attributes that should be set for paths matching this pattern. When parsing gitattributes, multiple integer overflows can occur when there is a huge number of path patterns, a huge number of attributes for a single pattern, or when the declared attribute names are huge. These overflows can be triggered via a crafted `.gitattributes` file that may be part of the commit history. Git silently splits lines longer than 2KB when parsing gitattributes from a file, but not when parsing them from the index. Consequentially, the failure mode depends on whether the file exists in the working tree, the index or both. This integer overflow can result in arbitrary heap reads and writes, which may result in remote code execution. The problem has been patched in the versions published on 2023-01-17, going back to v2.30.7. Users are advised to upgrade. There are no known workarounds for this issue.

Quotes

• When processing the padding operators, there is an integer overflow in `pretty.c::format_and_pad_commit()` where a `size_t` is stored improperly as an `int`, and then added as an offset to a `memcpy()` - iTnews - Security
• The most severe issue discovered allows an attacker to trigger a heap-based memory corruption during clone or pull operations, which might result in code execution. Another critical issue allows code execution during an archive operation, which is commonly performed by Git forges - TechRadar - All the latest technology news
• Git is distributed revision control system. `git log` can display commits in an arbitrary format using its `-format` specifiers. This functionality is also exposed to `git archive` via the `export-subst` gitattribute. When processing the padding operators, there is a integer overflow in `pretty.c::format_and_pad_commit()` where a `size_t` is stored improperly as an `int`, and then added as an offset to a `memcpy()` - Security Affairs
• The Git codebase shows several security issues and the sheer size of the codebase makes it challenging to address all potential instances of these issues - SecurityWeek
• The most severe issue discovered allows an attacker to trigger a heap-based memory corruption during clone or pull operations, which might result in code execution - The Hacker News

Headlines

• Jan. 20, 2023 - This Week in Security: Git Deep Dive, Mailchimp, and SPF
• Jan. 20, 2023 - GitLab pushes patches for critical bugs
• Jan. 19, 2023 - Git patches two critical remote code execution security flaws
• Jan. 18, 2023 - Two critical flaws discovered in Git source code version control system
• Jan. 18, 2023 - Critical Git Vulnerabilities Discovered in Source Code Security Audit
• Jan. 18, 2023 - Git Users Urged to Update Software to Prevent Remote Code Execution Attacks
• Jan. 17, 2023 - Git security vulnerabilities announced

CVE-2023-20010

CVSS Not Assigned

Risk Context N/A

Published: Jan. 20, 2023

A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This vulnerability exists because the web-based management interface inadequately validates user input. An attacker could exploit this vulnerability by authenticating to the application as a low-privileged user and sending crafted SQL queries to an affected system. A successful exploit could allow the attacker to read or modify any data on the underlying database or elevate their privileges.

Quotes

• This vulnerability exists because the web-based management interface inadequately validates user input. An attacker could exploit this vulnerability by authenticating to the application as a low-privileged user and sending crafted SQL queries to an affected system - Security Affairs
• An attacker could exploit this vulnerability by authenticating to the application as a low-privileged user and sending crafted SQL queries to an affected system. A successful exploit could allow the attacker to read or modify any data on the underlying database or elevate their privileges - SecurityWeek

Headlines

• Jan. 20, 2023 - Cisco fixes SQL Injection flaw in Unified CM
• Jan. 19, 2023 - Cisco Patches High-Severity SQL Injection Vulnerability in Unified CM
• Jan. 18, 2023 - Cisco Unified Communications Manager SQL Injection Vulnerability

CVE-2022-46732

CVSS Not Assigned

Risk Context N/A

Published: Jan. 18, 2023

Even if the authentication fails for local service authentication, the requested command could still execute regardless of authentication status.

Quotes

• Attackers may target ICS historians in order to gain access to this data, either for financial gain or for the purpose of gathering intelligence about an industrial process - SecurityWeek
• An attacker can take advantage of this fact and bypass the historian authentication by impersonating a local service - The Hacker News

Headlines

• Jan. 18, 2023 - Hackers Can Exploit GE Historian Vulnerabilities for ICS Espionage, Disruption
• Jan. 18, 2023 - CISA Warns of Flaws in Siemens, GE Digital, and Contec Industrial Control Systems
• Jan. 17, 2023 - GE Digital Proficy Historian