Security Affairs

JANUARY 24, 2025

The vulnerability is a Pre-authentication deserialization of untrusted data issue in the SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC) that has been likely exploited in attacks in the wild as a zero-day. ” reads the advisory. ” concludes the advisory. reads the report published by Mandiant.

Firmware 73

Firmware Malware Authentication Mobile 73

Malwarebytes

MARCH 10, 2023

The malware was likely deployed in 2021, and was able to persist on the appliances tenaciously, even surviving firmware upgrades. It offers a combined single-sign-on (SSO) web portal to authenticate users, so intercepting user credentials would give an attacker that is after sensitive information a huge advantage.

Firmware 98

Firmware Malware Encryption Authentication 98

SecureList

NOVEMBER 14, 2022

We polled our experts from the GReAT team and have gathered a small number of key insights about what APT actors are likely to focus on in 2023. Okta is a widely used authentication services provider, and it is safe to assume that a hacker controlling their network would be able to infect any of their customers.

Firmware 129

Firmware Surveillance Mobile Telecommunications 129

Security Affairs

OCTOBER 4, 2023

Google Threat Analysis Group and Google Project Zero first reported that the CVE-2023-33106, CVE-2023-33107, CVE-2022-22071 and CVE-2023-33063 are actively exploited in targeted attacks. The details of the remaining CVEs will be shared in our December 2023 public bulletin.”

Firmware 126

Firmware Surveillance Authentication Manufacturing 126

SecureList

JANUARY 17, 2025

It performs user authentication, version check, configuration setup, and provides the initial environment to process the upper layer protocol (PDU). As a result, the head unit becomes accessible for a long time, switching between an authenticated state and anti-theft mode. The upper layer protocol has a binary format.

Backups 123

Backups Architecture Firmware Software 123

SecureList

JUNE 11, 2024

A CVE entry has been registered for each of the vulnerability types: CVE-2023-3938 , CVE-2023-3939 , CVE-2023-3940 , CVE-2023-3941 , CVE-2023-3942 , CVE-2023-3943. User ID input interface If a valid (existing) ID is entered, the screen displays available user-specific authentication options.

Firmware 133

Firmware Authentication Passwords Risk 133

Security Affairs

APRIL 28, 2023

A vulnerability impacting Zyxel firewalls, tracked as CVE-2023-28771, can be exploited to execute arbitary code on vulnerable devices. Researchers from TRAPA Security have discovered a critical remote code execution vulnerability, tracked as CVE-2023-28771 (CVSS score 9.8), impacting Zyxel Firewall. through 5.35. through 5.35.

Firewall 98

Firewall Firmware VPN Authentication 98

Security Affairs

JULY 3, 2023

Researchers reported that there are 490,000 Fortinet firewalls exposing SSL VPN interfaces on the internet, and roughly 69% of them are still vulnerable to CVE-2023-27997. For this reason, if the customer has SSL-VPN enabled, Fortinet is advising customers to take immediate action to upgrade to the most recent firmware release.

Firewall 98

Firewall VPN Firmware Internet 98

eSecurity Planet

NOVEMBER 6, 2023

30, 2023 NGINX Ingress Controller for Kubernetes Flaws Can Lead to Credential Theft Type of Attack: Path sanitization bypass and injection vulnerabilities discovered in the NGINX Ingress controller can allow for credential theft, arbitrary command execution, and critical data access. CVE-2023-5044 (Code Injection): This CVSS score 7.6

Software 112

Software Education Ransomware Firmware 112

CyberSecurity Insiders

DECEMBER 6, 2022

Netwrix, a cybersecurity vendor that makes data security easy, today released key IT security trends that will affect organizations of all sizes in 2023. Here are five specific trends for 2023 that you need to be aware of: The business of cybercrime will be further professionalized. Supply chain attacks will intensify.

Cybersecurity 116

Cybersecurity Cybercrime Social Engineering Risk 116

Security Affairs

JANUARY 29, 2025

Named after the Aqua filename, it was first reported in November 2023. In mid-July 2024, Mitel addressed the vulnerability with the release of firmware updates. Akamai researchers spotted a new variant of the Mirai -based botnet Aquabot that is targeting vulnerable Mitel SIP phones. ” reads the report published by Akamai.

DDOS 68

DDOS Firmware Malware Firewall 68

SecureList

SEPTEMBER 21, 2023

We conducted an analysis of the IoT threat landscape for 2023, as well as the products and services offered on the dark web related to hacking connected devices. In the first half of 2023, 97.91% of password brute-force attempts registered by our honeypots targeted Telnet, and only 2.09%, SSH.

IoT 138

IoT DDOS Passwords Malware 138

Krebs on Security

JUNE 15, 2023

The directive applies to any networking devices — such as firewalls, routers and load balancers — that allow remote authentication or administration. “This is reachable pre-authentication, on every SSL VPN appliance,” French vulnerability researcher Charles Fol tweeted. “Patch your #Fortigate.”

Risk 280

Risk VPN Internet Internet 280

Security Affairs

JUNE 13, 2023

Fortinet addressed a new critical flaw, tracked as CVE-2023-27997, in FortiOS and FortiProxy that is likely exploited in a limited number of attacks. Fortinet has finally published an official advisory about the critical vulnerability, tracked as CVE-2023-27997 (CVSS score: 9.2), impacting FortiOS and FortiProxy. through 6.2.13

Firewall 98

Firewall VPN Firmware Manufacturing 98

Security Affairs

MAY 11, 2023

” The vulnerabilities, tracked as CVE-2023-27357 , CVE-2023-27367 , CVE-2023-27368 , CVE-2023-27369 , CVE-2023-27370 , were demonstrated by Claroty researchers during the 2022 Pwn2Own Toronto hacking contest as part of an exploit. The remaining ones are authentication bypass and command injection flaws.

Hacking 98

Hacking Firmware Authentication DNS 98

SecureList

JULY 19, 2023

On March 14, 2023, Microsoft published a blogpost describing an Outlook Client Elevation of Privilege Vulnerability (CVSS: 9.8 While the threat actor infrastructure might request Net-NTLMv2 authentication, Windows will honor the defined internet security zones and will not send (leak) Net-NTLMv2 hashes.

Firmware 98

Firmware Internet Internet Government 98

Security Affairs

JANUARY 14, 2024

Forescout experts questioned the attribution of cyber attacks that targeted the energy sector in Denmark in 2023 to the Russia-linked Sandworm. Forescout experts shared findings from their analysis of the cyber attacks that targeted the energy sector in Denmark in 2023, attributing them to the Russia-linked Sandworm. through 5.35.

Firewall 136

Firewall Firmware Cyber Attacks VPN 136

Security Affairs

MAY 25, 2023

D-Link fixed two critical flaws in its D-View 8 network management suite that could lead to authentication bypass and arbitrary code execution. in its D-View 8 network management suite that could be exploited by remote attackers to bypass authentication and execute arbitrary code. ” reads the advisory published by ZDI.

Firmware 98

Firmware Authentication Software Hacking 98

Security Affairs

NOVEMBER 14, 2023

On April 25, 2023, Zyxel disclosed a critical vulnerability (CVSS score 9.8), tracked as CVE-2023-28771 , in a number of their firewalls. The vulnerability is an improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35. through 5.35.

Cyber Attacks 139

Cyber Attacks Firmware Firewall VPN 139

Security Affairs

JUNE 5, 2024

CVE-2024-29975 : This improper privilege management vulnerability in the SUID executable binary in Zyxel NAS326 and NAS542 devices could allow an authenticated local attacker with administrator privileges to execute some system commands as the “root” user on a vulnerable device. The vulnerabilities affect NAS326 running firmware versions 5.21(AAZF.16)C0

Firmware 127

Firmware Authentication Manufacturing Hacking 127

Security Affairs

MAY 4, 2023

Cisco is warning of a critical remote code execution (RCE) vulnerability, tracked as CVE-2023-20126 (CVSS score of 9.8), impacting SPA112 2-Port phone adapters. “An attacker could exploit this vulnerability by upgrading an affected device to a crafted version of firmware. The company product has reached end-of-life (EoL).

Firmware 98

Firmware Education Media Authentication 98

Security Affairs

AUGUST 14, 2023

The procedures allow administrators to provide device information such as server addresses, account information, and firmware updates. The server is used to provide configurations and firmware updates to the devices. In this scenario, an attacker can act as a rogue server and distribute malicious firmware.

Firmware 98

Firmware Authentication Passwords Hacking 98

eSecurity Planet

MAY 18, 2023

“Cisco has not and will not release firmware updates to address the vulnerabilities described in the advisory for these devices,” the company stated. CVE-2023-20024, CVE-2023-20156, CVE-2023-20157, and CVE-2023-20158 – four vulnerabilities with a high CVSS score of 8.6

Small Business 104

Small Business Firmware Ransomware Software 104

Security Affairs

DECEMBER 3, 2024

The vulnerability is an improper authentication issue that impacts ProjectSend versions before r1720. The vulnerability was published on November 26, the patch has been publicly available since May 16, 2023. The vulnerability CVE-2024-11667 is a directory traversal flaw in Zyxel firmware (V5.00–V5.38)

Firewall 113

Firewall Authentication Accountability Firmware 113

Security Affairs

AUGUST 13, 2023

The nine vulnerabilities have received CVE between CVE-2023-3259 through CVE-2023-3267. Below is the list of flaws discovered by the researchers: CyberPower PowerPanel Enterprise: CVE-2023-3264: Use of Hard-coded Credentials (CVSS 6.7) CVE-2023-3266: Improperly Implemented Security Check for Standard (Auth Bypass; CVSS 7.5)

Hacking 98

Hacking Firmware Authentication Software 98

SecureList

DECEMBER 27, 2023

Today, on December 27, 2023, we ( Boris Larin , Leonid Bezvershenko , and Georgy Kucherin ) delivered a presentation, titled, “Operation Triangulation: What You Get When Attack iPhones of Researchers”, at the 37th Chaos Communication Congress (37C3), held at Congress Center Hamburg. This was mitigated as CVE-2023-38606.

Firmware 145

Firmware Engineering Spyware Retail 145

eSecurity Planet

JANUARY 16, 2024

Potential results of the exploits include authentication bypass and command injection. The vulnerability can be tracked as CVE-2023-29357. The problem: Technology company Bosch has a thermostat, the BCC100, that’s vulnerable to firmware replacement from a threat actor. versions earlier than 21.2R3-S7 Junos OS 21.3

Firewall 109

Firewall Firmware IoT Authentication 109

SecureList

JUNE 20, 2023

The findings of the study reveal a number of serious security issues, including the use of hard-coded credentials, and an insecure firmware update process. We later managed to extract the firmware from the EEPROM for further static reverse engineering. Further hardware analysis of the circuit board helped us identify chips.

Firmware 106

Firmware Passwords Manufacturing Mobile 106

SecureWorld News

NOVEMBER 2, 2023

Citrix Bleed, officially identified as CVE-2023-4966, is a sensitive information disclosure vulnerability affecting NetScaler ADC and NetScaler Gateway appliances. Exploiting this flaw allows threat actors to hijack legitimate user sessions, bypassing authentication protocols such as passwords and multi-factor authentication.

Authentication 108

Authentication Data breaches Passwords Firmware 108

eSecurity Planet

SEPTEMBER 9, 2024

The problem: RansomHub, a ransomware-as-a-service group, targeted security vulnerabilities in Apache ActiveMQ ( CVE-2023-46604 ), Atlassian Confluence ( CVE-2023-22515 ), Citrix ADC ( CVE-2023-3519 ), and Fortinet devices ( CVE-2023-27997 ). Manage your organization’s endpoint security through EDR solutions.

Firmware 109

Firmware Backups Firewall Risk 109

Security Affairs

MARCH 3, 2023

“An authenticated, local attacker could send maliciously crafted commands to a vulnerable TPM allowing access to sensitive data. In some cases, the attacker can also overwrite protected data in the TPM firmware. ” The first issue, tracked as CVE-2023-1017, is an out-of-bounds write. . ” states Quarkslab.

Firmware 98

Firmware IoT Authentication Hacking 98

Security Affairs

FEBRUARY 28, 2024

In April 2023, FortiGuard Labs researchers observed a hacking campaign targeting Cacti ( CVE-2022-46169 ) and Realtek ( CVE-2021-35394 ) vulnerabilities to spread ShellBot and Moobot malware. Attackers replaced binaries on compromised EdgeRouters with trojanized OpenSSH server binaries allowing remote attackers to bypass authentication.

Energy and Utilities 133

Energy and Utilities Government Firewall Malware 133

Jane Frankland

MAY 3, 2025

While details remain sparse, reports suggest social engineering tactics like phishing, SIM swapping, and multi-factor authentication (MFA) fatigue attacks may have been used to infiltrate systems. Using strong, unique passwords and enabling multi-factor authentication (MFA) or preferably passkeys wherever possible remains vital.

Cyber Attacks 100

Cyber Attacks Retail Cyber threats Backups 100

Security Affairs

MARCH 22, 2023

. “An attacker can make an authenticated HTTP request to trigger this vulnerability.” The user needs to authenticate into the mesh system first, meaning they’d need to access an unprotected network or the login credentials of a password-protected network, for this attack to be successful. on January 19, 2023.

Wireless 98

Wireless Firmware Authentication Passwords 98

eSecurity Planet

JANUARY 22, 2024

The problem: The Unified Extensible Firmware Interface (UEFI) specification has an open-source network implementation, EDK II, with nine discovered vulnerabilities. The vulnerability also exists on GitHub Enterprise Server, but it can only be exploited by an authenticated user with an organization owner role. EPMM versions 11.10, 11.9

Authentication 113

Authentication Malware VPN Mobile 113

Pen Test Partners

OCTOBER 31, 2023

With the default configuration of these printers, it’s possible to retrieve these credentials in an encrypted format without authenticating to the printer. This has been given the ID CVE-2023-46327. This led him to reverse engineering the firmware to identify how the CipherValue (AKA the password) was derived. Medium) CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Encryption 124

Encryption Passwords Firmware Engineering 124

Security Affairs

MAY 8, 2023

The Money Message group initially threatened to publish the stolen files by April 12, 2023, if the company will not pay the ransom. The authenticity of the leaked private key was confirmed by Alex Matrosov, founder of firmware security firm Binarly. Previously we already described the BG pkeys leak impact.

Data breaches 98

Data breaches Ransomware Firmware Manufacturing 98