CISA adds 8 vulnerabilities to list of actively exploited bugs

The US Cybersecurity & Infrastructure Security Agency (CISA) has added eight more flaws to its catalog of exploited vulnerabilities that are known to be used in attacks, and they're a mix of old and new.

The goal of publishing these vulnerabilities is to raise awareness and remind federal organizations of their obligation to apply security updates by a specified strict deadline.

As all of the vulnerabilities in the catalog are leveraged in active threats and current cyber-attacks, they carry a significant risk to organizations, allowing the takeover of mobile devices, network access, the ability to execute commands remotely.

The eight flaws added by CISA last week are listed below:

CVE ID	Description	Patch Deadline
CVE-2022-22587	Apple IOMobileFrameBuffer Memory Corruption Vulnerability	2/11/2022
CVE-2021-20038	SonicWall SMA 100 Appliances Stack-Based Buffer Overflow Vulnerability	2/11/2022
CVE-2014-7169	GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability	7/28/2022
CVE-2014-6271	GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability	7/28/2022
CVE-2020-0787	Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability	7/28/2022
CVE-2014-1776	Microsoft Internet Explorer Use-After-Free Vulnerability	7/28/2022
CVE-2020-5722	Grandstream Networks UCM6200 Series SQL Injection Vulnerability	7/28/2022
CVE-2017-5689	Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability Privilege Escalation Vulnerability	7/28/2022

The most recent vulnerability, CVE-2022-22587, was discovered in 2022 and is a memory corruption flaw in the IOMobileFrameBuffer affecting iOS, iPadOS, and macOS "Monterey."

Apple released a security update to fix the zero-day last Wednesday, warning that it is actively exploited in attacks. Due to the potential impact of this vulnerability on devices with wide circulation, CISA has given federal agencies until February 11, 2022, to apply the security updates.

CISA also added the CVE-2021-20038 vulnerability affecting SonicWall SMA 100 Appliances after it was discovered that threat actors were actively scanning for and attempting to exploit the vulnerability. As a result, CISA also requires agencies to patch this bug by February 11, 2022.

Some attempts itw on CVE-2021-20038 (SonicWall SMA RCE). Also some password spraying of default passwords from the past few days

Remember to update AND change default passwords :) pic.twitter.com/WyDIXVKb4m

— Rich Warren (@buffaloverflow) January 24, 2022

Of the older flaws, CVE-2013-6271 holds special significance for being a reliable long-term intrusion channel for adversaries.

It surfaced again via the 'Sea Turtle' campaign, which took place between 2017 and 2019, being among a set of flaws exploited in the context of global-scale sophisticated DNS hijacking attacks.

It appears that many system administrators still find it practically challenging to apply the fixing updates after almost eight years since they were first made publicly available.

With the addition of these eight vulnerabilities, there is now a total of 351 exploited vulnerabilities listed in CISA's Known Exploited Vulnerabilities Catalog.