Vulnerability News - October 20, 2023

Snapshot

Oct. 14, 2023 - Oct. 20, 2023

CISA Known Exploited Vulnerabilities
CVE	Summary	Severity	Vendor	Date Added
CVE-2021-1435	Cisco IOS XE contains a command injection vulnerability in the web user interface that could allow a remote, authenticated attacker to inject commands that can be executed as the root user.	HIGH	Cisco	Oct. 19, 2023
CVE-2023-4966	Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for sensitive information disclosure when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.	HIGH	Citrix	Oct. 18, 2023
CVE-2023-20198	Cisco IOS XE Web UI contains a privilege escalation vulnerability in the web user interface that could allow a remote, unauthenticated attacker to create an account with privilege level 15 access. The attacker can then use that account to gain control of the affected device.	CRITICAL	Cisco	Oct. 16, 2023
Newswires
Massive Cyberattack Targets Cisco IOS XE Devices Through CVE-2023-20198 Exploitation Researchers from LeakIX, using the indicators of compromise (IOCs) released by Cisco Talos, discovered approximately 30,000 Cisco IOS XE devices that have been compromised by exploiting the CVE-2023-20198 vulnerability.				Oct. 20, 2023
North Korean Hacking Groups Exploit TeamCity Vulnerability to Breach Networks Microsoft has reported that North Korean hacking groups Lazarus and Andariel are exploiting a critical flaw, CVE-2023-42793, in TeamCity servers to deploy backdoor malware.				Oct. 18, 2023
Updated MATA Malware Framework Targets Defense and Energy Sectors Between August 2022 and May 2023, an updated version of the MATA backdoor framework was identified in attacks on oil and gas companies, as well as defense firms in Eastern Europe.				Oct. 18, 2023
State-Backed Hackers Exploit WinRAR Vulnerability: A Google TAG Report Google's Threat Analysis Group (TAG) has discovered that multiple state-sponsored hacking groups are taking advantage of a severe vulnerability in WinRAR, a widely-used compression software, to execute arbitrary code on victims' systems.				Oct. 18, 2023
Citrix NetScaler Vulnerability Exploited as Zero-Day since August A critical security flaw identified as CVE-2023-4966 in Citrix NetScaler ADC/Gateway devices has been exploited as a zero-day since late August, according to security researchers.				Oct. 18, 2023
Admin Account Hijack Vulnerability Uncovered in Synology's DiskStation Manager A vulnerability in Synology's DiskStation Manager (DSM), which could be used to decode an administrator's password and remotely take control of the account, has been exposed.				Oct. 18, 2023
Unpatched Zero-Day Vulnerability Compromises Over 10,000 Cisco IOS XE Systems A severe and unpatched vulnerability in the Cisco IOS XE operating system has been exploited, leading to over 10,000 devices being compromised worldwide.				Oct. 17, 2023
Severe Vulnerabilities Detected in Milesight Routers and Titan SFTP Servers Security experts have warned about a significant vulnerability affecting industrial cellular routers from Milesight.				Oct. 17, 2023
Cisco Alerts on Active Exploitation of New IOS XE Zero-Day Vulnerability Cisco has alerted administrators about a severe, unpatched zero-day vulnerability in its IOS XE Software, which is currently being actively exploited.				Oct. 16, 2023
Urgent Call from CISA, FBI to Patch Atlassian Confluence Over Severe Vulnerability The Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the Multi-State Information Sharing and Analysis Center (MS-ISAC) have jointly issued a warning to network administrators.				Oct. 16, 2023
Pro-Russian Cybercriminals Exploit WinRAR Vulnerability in New Phishing Campaign Recently, pro-Russian cybercriminals have been found to be exploiting a newly identified security flaw in the WinRAR archiving utility.				Oct. 16, 2023
ToddyCat's Covert Operations: Asian Telecommunication and Government Bodies under Attack Cybersecurity experts at Check Point have uncovered an extensive campaign, named 'Stayin’ Alive', targeting governmental bodies and telecommunication firms in several Asian nations.				Oct. 14, 2023
Vulnerabilities In The News
CVE	Summary	Severity	Vendor	Risk Context
CVE-2023-20198 (21)	Cisco is aware of active exploitation of a previously unknown vulnerability in the web UI feature of Cisco IOS XE Software wh...	CRITICAL	Cisco	CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available
CVE-2023-22515 (8)	Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a pr...	CRITICAL	Atlassian	CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available
CVE-2023-42793 (8)	In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible	CRITICAL	Jetbrains	CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available
CVE-2023-3519 (4)	Unauthenticated remote code execution	CRITICAL	Citrix	CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available
CVE-2023-38831 (11)	RARLabs WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP...	HIGH	Rarlab	CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available
CVE-2023-4966 (8)	Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway or AAA ?virtual?server.	HIGH	Citrix	CISA Known Exploited Actively Exploited Remote Code Execution
CVE-2023-44487 (5)	The HTTP/2 protocol allows a denial of service because request cancellation can reset many streams quickly, as exploited in ...	HIGH	Grpc, Golang, F5, Amazon, Linkerd, Envoyproxy, Redhat, Traefik, Debian, Netapp, Microsoft, Ietf, Apache, Kazu-Yamamoto	CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available
CVE-2021-26411 (4)	Internet Explorer Memory Corruption Vulnerability	HIGH	Microsoft	CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available
CVE-2021-1435 (9)	A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to inject arbitrary comm...	HIGH	Cisco	CISA Known Exploited

CISA Known Exploited Vulnerabilities

CISA added three vulnerabilities to the known exploited vulnerabilities list.

Cisco — Cisco IOS XE Web UI

CVE-2021-1435 / Added: Oct. 19, 2023

HIGH CVSS 7.20 EPSS Score 6.62 EPSS Percentile 92.98

Cisco IOS XE contains a command injection vulnerability in the web user interface that could allow a remote, authenticated attacker to inject commands that can be executed as the root user.

Headlines

Oct. 20, 2023 - CISA adds Cisco IOS XE flaw to its Known Exploited Vulnerabilities catalog
Oct. 19, 2023 - Number of Cisco Devices Hacked via Unpatched Vulnerability Increases to 40,000
Oct. 18, 2023 - Tens of Thousands of Cisco Devices Hacked via Zero-Day Vulnerability
Oct. 17, 2023 - Zero-Day Alert: Ten Thousand Cisco IOS XE Systems Now Compromised
Oct. 17, 2023 - Cisco Devices Hacked via IOS XE Zero-Day Vulnerability
Oct. 17, 2023 - Warning: Unpatched Cisco Zero-Day Vulnerability Actively Targeted in the Wild
Oct. 16, 2023 - Critical, Unpatched Cisco Zero-Day Bug Is Under Active Exploit
Oct. 16, 2023 - Cisco IOS XE zero-day exploited by attackers to deliver implant (CVE-2023-20198)
Oct. 16, 2023 - Active exploitation of Cisco IOS XE Software Web Management User Interface vulnerability

Citrix — NetScaler ADC and NetScaler Gateway

CVE-2023-4966 / Added: Oct. 18, 2023

HIGH CVSS 7.50 EPSS Score 0.75 EPSS Percentile 78.91

Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for sensitive information disclosure when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.

Headlines

Cisco — IOS XE Web UI

CVE-2023-20198 / Added: Oct. 16, 2023

CRITICAL CVSS 10.00 EPSS Score 1.25 EPSS Percentile 84.04

Cisco IOS XE Web UI contains a privilege escalation vulnerability in the web user interface that could allow a remote, unauthenticated attacker to create an account with privilege level 15 access. The attacker can then use that account to gain control of the affected device.

Headlines

In The News

Vulnerabilities receiving the most attention in traditional news media.

CVE-2023-20198

CRITICAL CVSS 10.00 EPSS Score 1.25 EPSS Percentile 84.04

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: Oct. 16, 2023

Cisco is aware of active exploitation of a previously unknown vulnerability in the web UI feature of Cisco IOS XE Software when exposed to the internet or to untrusted networks. This vulnerability allows a remote, unauthenticated attacker to create an account on an affected system with privilege level 15 access. The attacker can then use that account to gain control of the affected system. For steps to close the attack vector for this vulnerability, see the Recommendations section of this advisory Cisco will provide updates on the status of this investigation and when a software patch is available.

Vendor Impacted: Cisco

Product Impacted: Ios Xe Web Ui

Quotes

Nothing but a war crime
Cisco is aware of active exploitation of this vulnerability
From what we can tell, it doesn’t not appear to be localized
Disable the HTTP Server feature on all internet-facing systems
On October 19th, the number of compromised Cisco devices has ebbed to 36,541, over 5,000 less than 24 hours ago
Allows a remote, unauthenticated attacker to create an account on an affected system with privilege level 15 access
The vulnerability allows a remote, unauthenticated attacker to create an account on an affected system with privilege level 15 access
This vulnerability allows a remote, unauthenticated attacker to create an account on an affected system with privilege level 15 access
With this level of access, an attacker can modify network routing rules as well as open ports for access to attacker controlled servers for data exfiltration
Cisco is aware of active exploitation of a previously unknown vulnerability in the web UI feature of Cisco IOS XE Software when exposed to the internet or to untrusted networks
Cisco has identified active exploitation of a previously unknown vulnerability in the Web User Interface (Web UI) feature of Cisco IOS XE software (CVE-2023-20198) when exposed to the internet or untrusted networks
Cisco buried the lede by not mentioning thousands of internet-facing IOS XE systems have been implanted. This is a bad situation, as privileged access on the IOS XE likely allows attackers to monitor network traffic, pivot into protected networks, and perform any number of man-in-the-middle attacks
The configuration file defines the new web server endpoint (URI path) used to interact with the implant. That endpoint receives certain parameters (…) that allows the actor to execute arbitrary commands at the system level or IOS level. For the implant to become active, the web server must be restarted; in at least one observed case the server was not restarted so the implant never became active despite being installed

Headlines

CVE-2023-22515

CRITICAL CVSS 9.80 EPSS Score 94.32 EPSS Percentile 98.93

CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available

Published: Oct. 4, 2023

Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

Vendor Impacted: Atlassian

Products Impacted: Confluence Data Center And Server, Confluence Server, Confluence Data Center

Quotes

CISA, FBI, and MS-ISAC strongly encourage network administrators to immediately apply the upgrades provided by Atlassian
On October 5, 2023, CISA added this vulnerability to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation
Threat actors can change the Confluence server’s configuration to indicate the setup is not complete and use the /setup/setupadministrator.action endpoint to create a new administrator user
This recently disclosed vulnerability affects certain versions of Atlassian Confluence Data Center and Server, enabling malicious cyber threat actors to obtain initial access to Confluence instances by creating unauthorized Confluence administrator accounts

Headlines

CVE-2023-42793

CRITICAL CVSS 9.80 EPSS Score 97.21 EPSS Percentile 99.76

CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available

Published: Sept. 19, 2023

In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible

Vendor Impacted: Jetbrains

Product Impacted: Teamcity

Quotes

After creating the account, the threat actor adds it to the Local Administrators Group through net use
In past operations, Diamond Sleet and other North Korean threat actors have successfully carried out software supply chain attacks by infiltrating build environments
While the two threat actors are exploiting the same vulnerability, Microsoft observed Diamond Sleet and Onyx Sleet utilizing unique sets of tools and techniques following successful exploitation
Based on the profile of victim organizations affected by these intrusions, Microsoft assesses that the threat actors may be opportunistically compromising vulnerable servers. However, both actors have deployed malware and tools and utilized techniques that may enable persistent access to victim environments

Headlines

CVE-2023-3519

CRITICAL CVSS 9.80 EPSS Score 88.98 EPSS Percentile 98.37

CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available

Published: July 19, 2023

Unauthenticated remote code execution

Vendor Impacted: Citrix

Products Impacted: Netscaler Gateway, Netscaler Application Delivery Contr, Netscaler Adc And Netscaler Gateway

Quotes

Organizations should ... terminate all active sessions
Mandiant has identified zero-day exploitation of this vulnerability in the wild beginning in late August 2023

Headlines

CVE-2023-38831

HIGH CVSS 7.80 EPSS Score 23.40 EPSS Percentile 96.01

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: Aug. 23, 2023

RARLabs WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file (such as an ordinary .JPG file) and also a folder that has the same name as the benign file, and the contents of the folder (which may include executable content) are processed during an attempt to access only the benign file. This was exploited in the wild in April through October 2023.

Vendor Impacted: Rarlab

Product Impacted: Winrar

Quotes

.pif, .com, .exe, .bat, .lnk, .cmd
TAG has observed government-backed actors from a number of countries exploiting the WinRAR vulnerability as part of their operations
The widespread exploitation of the WinRAR bug highlights that exploits for known vulnerabilities can be highly effective, despite a patch being available
Cybercrime groups began exploiting the vulnerability in early 2023, when the bug was still unknown to defenders. A patch is now available, but many users still seem to be vulnerable
The attack involves the use of malicious archive files that exploit the recently discovered vulnerability affecting the WinRAR compression software versions prior to 6.23 and traced as CVE-2023-38831
In recent weeks, Google's Threat Analysis Group's (TAG) has observed multiple government-backed hacking groups exploiting the known vulnerability, CVE-2023-38831, in WinRAR, which is a popular file archiver tool for Windows
As detailed in a blog post from Group-IB, the vulnerability had been exploited as 0-day by cybercrime actors in-the-wild since at least April 2023 for campaigns targeting financial traders to deliver various commodity malware families

Headlines

CVE-2023-4966

HIGH CVSS 7.50 EPSS Score 0.75 EPSS Percentile 78.91

CISA Known Exploited Actively Exploited Remote Code Execution

Published: Oct. 10, 2023

Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA ?virtual?server.

Vendor Impacted: Citrix

Products Impacted: Netscaler Gateway, Netscaler Application Delivery Contr, Netscaler Adc And Netscaler Gateway

Quotes

Organizations should ... terminate all active sessions
Exploits of CVE-2023-4966 on unmitigated appliances have been observed
Mandiant has identified zero-day exploitation of this vulnerability in the wild beginning in late August 2023
The ability to hijack existing authenticated sessions, therefore bypassing multifactor authentication or other strong authentication requirements
These sessions may persist after the update to mitigate CVE-2023-4966 has been deployed. Additionally, we have observed session hijacking where session data was stolen prior to the patch deployment, and subsequently used by a threat actor

Headlines

CVE-2023-44487

HIGH CVSS 7.50 EPSS Score 52.53 EPSS Percentile 97.20

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: Oct. 10, 2023

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

Vendors Impacted: Grpc, Golang, F5, Amazon, Linkerd, Envoyproxy, Redhat, Traefik, Debian, Netapp, Microsoft, Ietf, Apache, Kazu-Yamamoto

Products Impacted: Integration Service Registry, Jboss A-Mq Streams, Openshift Container Platform, Openshift, Openshift Data Science, Jboss Fuse, Advanced Cluster Security, 3scale Api Management Platform, Jboss Core Services, Nginx, Big-Ip Application Visibility And Re, Openshift Pipelines, Networking, Ceph Storage, Openshift Api For Data Protection, Machine Deletion Remediation Operato, Big-Ip Local Traffic Manager, Openshift Virtualization, Windows 11 21h2, Cbl-Mariner, Cost Management, Openstack Platform, Enterprise Linux, Big-Ip Access Policy Manager, Openshift Sandboxed Containers, Support For Spring Boot, Apisix, Windows Server 2022, Quay, Big-Ip Websafe, Visual Studio 2022, Big-Ip Ssl Orchestrator, Big-Ip Webaccelerator, Openshift Secondary Scheduler Operat, Linkerd, Advanced Cluster Management For Kube, Big-Ip Carrier-Grade Nat, Logging Subsystem For Red Hat Opensh, Big-Ip Link Controller, Openshift Distributed Tracing, Windows Server 2016, Service Telemetry Framework, Nginx Ingress Controller, Single Sign-On,...

Headlines

CVE-2021-26411

HIGH CVSS 7.50 EPSS Score 93.28 EPSS Percentile 98.78

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: March 11, 2021

Internet Explorer Memory Corruption Vulnerability

Vendor Impacted: Microsoft

Products Impacted: Internet Explorer, Windows Rt 8.1, Windows 8.1, Windows Server 2019, Windows 7, Windows Server 2008, Windows Server 2012, Windows Server 2016, Windows 10

Quotes

Updated MATA attacks industrial companies in Eastern Europe
The actors behind the attack used spear-phishing mails to target several victims, some were infected with Windows executable malware by downloading files through an internet browser

Headlines

CVE-2021-1435

HIGH CVSS 7.20 EPSS Score 6.62 EPSS Percentile 92.98

CISA Known Exploited

Published: March 24, 2021

A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to inject arbitrary commands that can be executed as the root user. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted request to the web UI of an affected device with arbitrary commands injected into a portion of the request. A successful exploit could allow the attacker to execute arbitrary commands as the root user.

Vendor Impacted: Cisco

Products Impacted: Cisco Ios Xe Web Ui, Ios Xe

Quotes

From what we can tell, it doesn’t not appear to be localized
The vulnerability allows a remote, unauthenticated attacker to create an account on an affected system with privilege level 15 access
This vulnerability allows a remote, unauthenticated attacker to create an account on an affected system with privilege level 15 access
With this level of access, an attacker can modify network routing rules as well as open ports for access to attacker controlled servers for data exfiltration
Leveraging existing detections, we observed the actor exploiting CVE-2021-1435, for which Cisco provided a patch in 2021, to install the implant after gaining access to the device
The configuration file defines the new web server endpoint (URI path) used to interact with the implant. That endpoint receives certain parameters (…) that allows the actor to execute arbitrary commands at the system level or IOS level. For the implant to become active, the web server must be restarted; in at least one observed case the server was not restarted so the implant never became active despite being installed

Headlines

Vulnerability and threat intelligence direct to your inbox every week.

Subscribe to Pulse

Accelerate Security Teams

Schedule a free consultation with a vulnerability expert to discuss your use cases and to see a demo.

Request a Demo

Solutions

By Solution

By Feature

I Want To…

Learn More

VULNERA vs Vulnerability Scanners

Who It’s For

CISO’s

IT & Security Teams

Risk & Compliance

Security Assessment Buyers Guide

Resources

Resources

Blog

Threat Intelligence

I Want To…

Learn More

Top 10 Vulnerability Management Questions Answered

About

About

Partners

I Want To…

Learn More

Simplifying Vulnerability Management

VULNERA Pulse

A digest of noteworthy issues being discussed in the information security industry.

October 20, 2023

Subscribe

Accelerate Security Teams

Quick Menu

Solutions

Features

CISO Challenges

IT Challenges

Compliance

Subscribe

By Solution

By Feature

I Want To…

Learn More

VULNERA vs Vulnerability Scanners

Security Assessment Buyers Guide

Resources

Resources

Blog

Threat Intelligence

I Want To…

Learn More

Top 10 Vulnerability Management Questions Answered

About

About

Partners

I Want To…

Learn More

Simplifying Vulnerability Management

VULNERA Pulse

A digest of noteworthy issues being discussed in the information security industry.

October 20, 2023

Snapshot

CISA Known Exploited Vulnerabilities

Newswires

Vulnerabilities In The News

CISA Known Exploited Vulnerabilities

Cisco — Cisco IOS XE Web UI

Citrix — NetScaler ADC and NetScaler Gateway

Cisco — IOS XE Web UI

In The News

Subscribe

Accelerate Security Teams

Quick Menu

Features

Subscribe