Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label cybersecurity vulnerabilities. Show all posts
Remote Code Execution
Cyber Attacks cybersecurity vulnerabilities Danfoss Refrigeration Systems French Supermarket Cyberattack industrial cybersecurity Operational Technology Security Remote Code Execution

Cyberattack Knocks Out Supermarket Refrigerators Across France


In a number of major French supermarket chains, refrigeration systems were disrupted by a cyberattack, forcing stores to remove fresh and frozen foods from their display units. It is estimated that 250 to 350 retail outlets, including Intermarché, Coopérative U, Carrefour Market, Monoprix, Leclerc, and Super U, were impacted by the incident. 

Several reports indicate that the attackers compromised older versions of Danfoss refrigeration controller software and remotely activated automatic defrosting functions. The process resulted in increased refrigerator temperatures, putting perishable food supplies at risk, resulting in financial losses and food waste. 

A cyberattack reportedly involving a service provider that manages refrigeration systems resulted in the inability to use some fresh and frozen food displays at Intermarché. According to the company, precautionary measures have been taken to remove products from affected units, although a complete list of the stores affected does not yet exist.

Several stores within the Coopérative U network have also experienced disruptions, according to Dominique Schelcher, president of Coopérative U. As part of its investigation into the circumstances surrounding the attack, the company's teams were working with refrigeration specialists to restore normal operations. 

As a result of the incident, concerns have been raised about the security of digital systems supporting essential food retail operations. A sense of urgency was conveyed by the European Union Agriculture and Food Commissioner Christophe Hansen, who emphasized the importance of not targeting equipment responsible for preserving food.


Vulnerabilities in Danfoss Systems Raise Security Concerns 

ANSSI (National Cybersecurity Agency of France) has been directed to assess the risks and determine whether other businesses could be affected by the incident, while French authorities are investigating it. It appears that refrigeration units reached temperatures as high as 50°C, which resulted in extensive food spoilage and fires at several locations. 

Approximately 150 stores in Intermarché's parent group have been disrupted, whereas 80 supermarkets in Carrefour have been affected. Due to previously revealed security vulnerabilities, Danfoss refrigeration management systems have been under scrutiny. It was discovered by Claroty's Team82 in August 2026 that there are flaws in the Danfoss AK-SM 800A platform, which allows operators to monitor and control refrigeration equipment remotely through a web-based interface. 

An authentication bypass vulnerability, CVE-2025-41450, and a command injection vulnerability, CVE-2025-41451, could allow remote code execution. There is also a third flaw, CVE-2025-41452, which could be used for denial of service attacks through the injection of Nginx configuration. To address these issues, Danfoss released firmware version R4.3.1. 

A number of Danfoss systems are accessible through the internet, which raises concerns about unauthorised access to equipment in supermarkets and other commercial establishments. The affected systems were equipped with outdated firmware, according to Danfoss, and customers had previously been advised to upgrade older equipment. Investigators have not yet confirmed whether any of the disclosed vulnerabilities were exploited in the attack at the French supermarket. Moreover, it is unclear how the refrigeration controllers were accessed. 

Connected Refrigeration Systems Present Cyber-Physical Risks

Security experts have stated that this incident illustrates the dangers associated with attacks against operational technology (OT) despite not targeting conventional information systems. It is possible for refrigerator controllers to make unauthorised changes that may disrupt the handling of food, pharmaceuticals, and other supply-chain functions in temperature-sensitive environments. 

Researchers at Claroty warn that security teams can be overlooking refrigeration controllers, particularly when remote maintenance interfaces are accessible via the public internet. Although remote access can assist technicians in maintaining equipment at multiple locations, poorly secured connections can provide attackers with opportunities. 

In order to ensure security, users should install the latest firmware, remove unnecessary internet exposure, restrict administrative access to trusted networks, and utilize virtual private networks to secure remote connections as well as network segmentation. Additionally, organizations should examine exposed devices and verify that appropriate access control measures have been implemented. It is unclear who is responsible for the attack, and the investigation continues. 

The incident emphasizes the importance of securing connected industrial equipment, particularly systems with the potential to affect public services, food safety, and crucial business functions directly. Despite the incident, the need for securing internet-connected operational technology is growing. Updates to firmware are imperative, as are restrictions on remote access and stronger network controls to prevent cyberattacks from disrupting critical business processes.
Read more »
Linux
Cyber flaws Cyber Security cybersecurity vulnerabilities exploitable flaws Kernel Kernel Flaw Linux

Four Linux Kernel Flaws Expose Systems to Local Root Exploits

 

A security researcher has publicly released working exploit code for four Linux kernel vulnerabilities that can allow local users to escalate their privileges to root, giving them the highest level of access on an affected system. The vulnerabilities, dubbed DirtyAH6, TUNderflow, PPPoEject and DiagSpill, were discovered by researcher Asim Manizada and reported to the Linux kernel security team in mid-July. 

Kernel maintainers have since released fixes for all four flaws, meaning systems running fully updated kernels are not affected. Manizada published his technical analysis and working exploits on September 18 after coordinating with Linux distributions to give developers time to release patches. There are currently no reports of the vulnerabilities being exploited in real-world attacks. The published exploits were developed for specific kernel builds and can crash systems, making them primarily suited for isolated testing environments. 

Despite those limitations, publicly available exploit code increases the risk for systems that have not been patched. Local privilege escalation vulnerabilities are particularly relevant on shared or multi-user systems, where an attacker who has already obtained limited access can potentially use the flaws to gain complete control. Three of the vulnerabilities require unprivileged user namespaces to be enabled. 

This Linux feature allows ordinary users to obtain root-like privileges inside an isolated environment and is enabled by default on many distributions. DirtyAH6, tracked as CVE-2026-80844, affects the IPv6 IPsec Authentication Header code. TUNderflow, CVE-2026-81000, affects TUN/TAP virtual network devices, while PPPoEject, CVE-2026-68121, targets PPP over Ethernet code. DiagSpill, tracked as CVE-2026-74469, differs from the other three because it does not require user namespaces or special privileges. 

Instead, it requires the SCTP networking module to be available. Two vulnerabilities, DirtyAH6 and DiagSpill, can also be triggered remotely in limited circumstances, although the demonstrated remote impact is primarily system crashes. Manizada achieved remote root exploitation with DirtyAH6 in a controlled laboratory environment after first manipulating the target’s memory. He described achieving the same result remotely without that preparation as extremely difficult. He found no path to remote root with DiagSpill.

All four vulnerabilities are memory-safety flaws affecting different areas of Linux networking code. DirtyAH6 involves an out-of-bounds write in IPv6 IPsec handling, TUNderflow results from an integer wraparound in virtual networking code, PPPoEject is a use-after-free vulnerability, and DiagSpill involves a counter overflow that can result in a large out-of-bounds memory write. The researcher said the flaws were discovered using an AI-assisted process designed to map kernel memory handling and reason about memory layouts. 

The Linux fix for DirtyAH6 credits his custom AI tooling in its commit record. Manizada also previously disclosed another Linux kernel privilege-escalation flaw, OVSwrap, in July. Administrators should update to a kernel containing all four fixes. The first stable Linux kernel releases containing the complete set are 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50 and 7.2.4. Distribution kernels use their own versioning, however, so users should check security advisories from their Linux distributor to confirm the fixes have been included. 

If immediate patching is not possible, disabling unprivileged user namespaces can reduce exposure to DirtyAH6, TUNderflow and PPPoEject. Administrators can also disable AH6, TUN/TAP, PPPoE or SCTP features when they are not required. Manizada recommends patching rather than relying on feature restrictions because alternative exploitation paths may exist.
Read more »
data security
AI coding tools Consumer Data Exposure Corporate Data Breach cybersecurity vulnerabilities Data Breach data security

AI Coding Tools Expose Thousands of Apps With Sensitive Corporate Data Online

 

Thousands of web applications built using AI coding tools have been found publicly accessible online without proper security protections. Researchers at RedAccess identified more than 5,000 exposed apps tied to companies, many revealing private information to anyone with the correct URL. Employee records, customer conversations, system plans, and financial files were among the exposed materials. The problem wasn’t faulty code but missing security setup steps that many users overlooked. 

In many cases, public access remained enabled long after deployment, creating silent data leaks that went unnoticed for months. Many of the vulnerable apps were created using platforms like Replit, Netlify, Base44 owned by Wix, and Lovable. Nearly 2,000 apps appeared to contain genuine sensitive information, including advertising spending reports, company strategy documents, chatbot logs, customer contact details, hospital personnel records, and financial summaries. 

According to RedAccess researcher Dor Zvi, the issue is linked to the rise of “vibe coding,” where non-technical employees use AI tools to rapidly build and publish web applications. Since these platforms make development extremely simple, apps can go live within minutes without any review from engineering or cybersecurity teams. Researchers found the exposed apps through basic Google and Bing searches because many AI coding services host projects publicly on shared domains by default. 

Some applications exposed private information without requiring logins, while others reportedly allowed outsiders to gain administrative control over backend systems. The exposed data covered multiple industries. Hospital staff schedules listing doctors’ identities appeared alongside marketing strategy presentations, shipping records, retailer chatbot conversations, and detailed advertising campaign budgets. Such leaks could expose sensitive competitive information, including business planning timelines and financial allocations. 

The investigation also uncovered phishing websites hosted directly on AI coding platform domains. These fake pages impersonated major companies including Bank of America, Costco, FedEx, Trader Joe’s, and McDonald’s. The platforms disputed parts of the findings while acknowledging that publicly accessible apps existed. Amjad Masad said users choose whether apps remain public or private. Lovable emphasized that creators are responsible for configuring security correctly, while Wix stated weakening protections requires deliberate user actions. 

Security experts argue the broader issue remains serious because AI coding tools rarely enforce strong safeguards automatically. Many employees using them lack training in authentication systems or permission controls, allowing insecure deployments to slip through unnoticed. Researchers say the situation resembles earlier waves of exposed Amazon S3 cloud storage buckets, where confusing defaults and user mistakes left sensitive files publicly accessible. 

AI-powered coding platforms may now be accelerating similar risks on a larger scale as businesses increasingly rely on AI tools for internal dashboards, marketing systems, client portals, and reporting applications. Experts also warn the true scale may be far larger. The 5,000 discovered apps only included projects hosted directly on AI platform domains. Thousands more could exist on privately owned domains that standard searches cannot easily detect. 

As AI-generated development grows rapidly, companies are now under pressure to strengthen oversight, improve employee training, and introduce stricter security reviews. Without stronger safeguards, fast AI-assisted app creation could continue exposing confidential corporate and personal information online.
Read more »
malicious PDF files
Adobe Adobe Reader Cyber Security Cyberattacks cybersecurity vulnerabilities data security Hacker attack Malicious Files Malicious PDF Attachment malicious PDF files

Adobe Reader Zero-Day PDF Exploit Actively Used in Attacks to Steal Data

 

A fresh security flaw in Adobe Reader - unknown until now - is under attack by hackers wielding manipulated PDFs, sparking alarm across global user bases. Since December, activity has persisted without pause; findings come from analyst Haifei Li, who traced repeated intrusions back months. 

What stands out is the method: an intricate exploit resembling digital fingerprinting, effective despite up-to-date installations. Even patched systems fall vulnerable to this quietly spreading technique. Open a single infected PDF, then the damage begins - little else matters after that. This method spreads quietly because it leans on normal software behaviors instead of obvious malware tricks. 

Instead of complex setups, it taps into built-in functions like util.readFileIntoStream and RSS.addFeed, tools meant for routine tasks. Because these actions look ordinary, alarms rarely sound. Information slips out before anyone notices anything wrong. What makes this flaw especially risky isn’t just stolen information. As Li points out, it might allow further intrusions - such as running unauthorized code from afar or breaking out of restricted environments. Control over the affected device could then shift entirely into an attacker’s hands, turning a minor leak into something far worse. 

Examining deeper, threat analyst Gi7w0rm noticed fake PDFs in these operations frequently include bait written in Russian. With topics tied to current oil and gas industry shifts, the material appears shaped deliberately - aimed at certain professionals to seem believable. Though subtle, the choice of subject matter reflects an effort to mirror real-world events closely. 

Still waiting, Li notified Adobe about the flaw earlier - yet when details emerged, a fix wasn’t available. Without an update out yet, anyone opening PDFs from outside channels stays at risk. For now, while waiting for a solution, specialists urge care with PDFs - especially ones arriving by email or unknown sources. 

Watch network activity closely; odd patterns like strange HTTP or HTTPS calls may point to the vulnerability being used. Unusual user-agent labels in web requests could mean trouble already started. One more zero-day surfaces, revealing how hackers now lean on familiar file types and common programs to slip past security walls. 

While the flaw stays open, sharp attention and careful handling of digital files become necessary tools for staying protected. Though fixes lag behind, cautious behavior offers some shield against unseen threats waiting in plain sight. 
Read more »
data security
Authentication Bypass authentication bypass flaw Compromised Passwords Cyber Security Cyber Vulnerabilities cybersecurity vulnerabilities data security

HPE Patches Critical Aruba AOS-CX Vulnerabilities Including Authentication Bypass Flaw

 

Hewlett Packard Enterprise (HPE) has released security updates to address multiple vulnerabilities in its Aruba AOS-CX network operating system, including a critical flaw that could allow attackers to bypass authentication and gain administrative control. 

AOS-CX comes from Aruba Networks, a part of HPE, built specifically for cloud-based networking needs. These systems run on CX-series switches found in big company campuses and data centers. Because so many rely on them, any flaws present serious concerns when discovered. 

What stands out is CVE-2026-23813 - a severe flaw tied to how AOS-CX switches handle login security via their web portal. HPE confirms that hackers could abuse this weakness from afar, needing no prior access nor advanced skills. Control over compromised devices might follow, including forced changes to admin credentials. Though simple to trigger, the outcome carries heavy risk. Such exposure emerges solely through network interaction. Little effort may yield full system override. 

Security hinges on timely updates, yet patch details remain sparse. Remote manipulation becomes feasible once entry points open. Without safeguards, unintended access escalates quickly. This condition persists until corrective measures apply. Come mid-advisory, the firm stated they’d seen no signs of real-world attacks nor any public tools built to exploit these flaws. Still, given how serious the weakness happens to be, rolling out fixes quickly becomes a top priority for most teams. 

When updates cannot happen right away, HPE suggests ways to lower exposure. One path involves isolating management ports inside private network zones. Access rules should be tightly defined, minimizing who can connect. Unneeded web-based entry points over HTTP or HTTPS ought to be turned off completely. Trust boundaries may also tighten by using ACLs that allow only known devices to interact. 

Watching system logs closely adds another layer - unexpected login efforts often show up there first. Security weaknesses fit into a wider trend of issues HPE has tackled lately. Back in July 2025, hidden login details emerged in Aruba Instant On wireless units, opening doors for unauthorized access. Before that, fixes rolled out for several problems in the StoreOnce data protection system - some let intruders skip verification steps entirely. Remote control exploits also surfaced, giving hackers potential command over affected machines. 

More recently, the Cybersecurity and Infrastructure Security Agency (CISA) flagged a high-severity vulnerability in HPE OneView as actively exploited in the wild, underscoring the growing focus of threat actors on enterprise infrastructure tools. With more than 55,000 enterprise clients worldwide, HPE points out that timely updates and stronger network defenses help reduce risks. Many of these clients appear on the Fortune 500 list, highlighting the scale of exposure when security lapses occur. Because threats evolve quickly, waiting is rarely an option. 

Instead, consistent maintenance becomes a quiet but steady shield. Even small delays can widen vulnerabilities across complex systems. When flaws appear in network management tools, specialists warn these often pose high risk - attackers might gain extensive access across company systems. Without immediate fixes, even unused weaknesses invite trouble down the line. 

Updates applied quickly, combined with multiple protective layers, help reduce potential harm before incidents occur. When companies depend heavily on unified network systems, events such as these reveal how crucial it is to maintain constant oversight while reacting quickly when new risks appear.
Read more »
Linux RootKit
Cyber Hacking Cyber Security cybersecurity vulnerabilities data access Hacking Attack Linux Linux RootKit

CRIL Uncovers ShadowHS: Fileless Linux Post-Exploitation Framework Built for Stealthy Long-Term Access

 

Operating entirely in system memory, Cyble Research & Intelligence Labs (CRIL) uncovered ShadowHS, a Linux post-exploitation toolkit built for covert persistence after an initial breach. Instead of dropping binaries on disk, it runs filelessly, helping it bypass standard security checks and leaving minimal forensic traces. ShadowHS relies on a weaponized version of hackshell, enabling attackers to maintain long-term remote control through interactive sessions. This fileless approach makes detection harder because many traditional tools focus on scanning stored files rather than memory-resident activity. 

CRIL found that ShadowHS is delivered using an encrypted shell loader that deploys a heavily modified hackshell component. During execution, the loader reconstructs the payload in memory using AES-256-CBC decryption, along with Perl byte skipping routines and gzip decompression. After rebuilding, the payload is executed via /proc//fd/ with a spoofed argv[0], a method designed to avoid leaving artifacts on disk and evade signature-based detection tools. 

Once active, ShadowHS begins with reconnaissance, mapping system defenses and identifying installed security tools. It checks for evidence of prior compromise and keeps background activity intentionally low, allowing operators to selectively activate functions such as credential theft, lateral movement, privilege escalation, cryptomining, and covert data exfiltration. CRIL noted that this behavior reflects disciplined operator tradecraft rather than opportunistic attacks. 

ShadowHS also performs extensive fingerprinting for commercial endpoint tools such as CrowdStrike, Tanium, Sophos, and Microsoft Defender, as well as monitoring agents tied to cloud platforms and industrial control environments. While runtime activity appears restrained, CRIL emphasized the framework contains a wider set of dormant capabilities that can be triggered when needed. 

A key feature highlighted by CRIL is ShadowHS’s stealthy data exfiltration method. Instead of using standard network channels, it leverages user-space tunneling over GSocket, replacing rsync’s default transport to move data through firewalls and restrictive environments. Researchers observed two variants: one using DBus-based tunneling and another using netcat-style GSocket tunnels, both designed to preserve file metadata such as timestamps, permissions, and partial transfer state. 

The framework also includes dormant modules for memory dumping to steal credentials, SSH-based lateral movement and brute-force scanning, and privilege escalation using kernel exploits. Cryptomining support is included through tools such as XMRig, GMiner, and lolMiner. ShadowHS further contains anti-competition routines to detect and terminate rival malware like Rondo and Kinsing, as well as credential-stealing backdoors such as Ebury, while checking kernel integrity and loaded modules to assess whether the host is already compromised or under surveillance.

CRIL concluded that ShadowHS highlights growing challenges in securing Linux environments against fileless threats. Since these attacks avoid disk artifacts, traditional antivirus and file-based detection fall short. Effective defense requires monitoring process behavior, kernel telemetry, and memory-resident activity, focusing on live system behavior rather than static indicators.
Read more »
IT Industry
Cyber Security Cybersecurity Precautions cybersecurity research cybersecurity risks cybersecurity vulnerabilities Global Supply-Chain Attack IT Industry

Global Supply Chains at Risk as Indian Third-Party Suppliers Face Rising Cybersecurity Breaches

 

Global supply chains face growing cybersecurity risks as research highlights vulnerabilities in Indian third-party suppliers. According to a recent report by risk management firm SecurityScorecard, more than half of surveyed suppliers in India experienced breaches last year, raising concerns about cascading effects on international businesses. The study examined security postures across multiple sectors, including manufacturing for aerospace and pharmaceuticals, as well as IT service providers. 

The findings suggest that security weaknesses among Indian suppliers are both more widespread and severe than analysts initially anticipated. These vulnerabilities could create a domino effect, exposing global companies that rely on Indian vendors to significant cyber threats. Despite the generally strong security posture of Indian IT service providers, they recorded the highest number of breaches in the study, underscoring their position as prime targets for attackers. 

SecurityScorecard noted that IT service providers worldwide face heightened cyber risks due to their central role in enabling third-party access, their expansive attack surfaces, and their value as high-profile targets. In India, IT companies were found to be particularly vulnerable to typosquatting domains, compromised credentials, and infected devices. The research further revealed that suppliers of outsourced IT operations and managed services were linked to 62.5% of all documented third-party breaches in the country—the highest proportion the company has ever recorded. 

Given India’s dominant role in the global IT services market, the implications are profound. Multinational corporations across industries rely heavily on Indian IT vendors, making them critical nodes in the international digital economy. “India is a cornerstone of the global digital economy,” said Ryan Sherstobitoff, Field Chief Threat Intelligence Officer at SecurityScorecard. “Our findings highlight both strong performance and areas where resilience must improve. Supply chain security is now an operational requirement.” 

The report also emphasized the risks of “fourth-party” vulnerabilities, where the suppliers of Indian companies themselves create additional points of weakness. A single ransomware attack or disruptive incident against an Indian vendor, the researchers warned, could halt manufacturing, delay service delivery, or disrupt logistics across multiple countries. 

The risks are not limited to India. A separate SecurityScorecard study revealed that 96% of Europe’s largest financial institutions have been affected by a breach at a third-party supplier, while 97% reported breaches stemming from fourth-party partners, a sharp increase from 84% two years earlier. 

As global supply chains become increasingly interconnected, these findings highlight the urgent need for businesses to strengthen third-party risk management and enforce stricter cybersecurity practices across their vendor ecosystems. Without stronger safeguards, both direct and indirect supplier vulnerabilities could leave multinational enterprises exposed to significant financial and operational disruptions.
Read more »
Remote Code Execution
Authentication Bypass CVE CVE exploits CVE vulnerability CVEs Cyber Security cybersecurity vulnerabilities Endpoint patch fixes Remote Code Execution

Trend Micro Patches Critical Remote Code Execution and Authentication Bypass Flaws in Apex Central and PolicyServer

Trend Micro has rolled out essential security updates to address a series of high-impact vulnerabilities discovered in two of its enterprise security solutions: Apex Central and the Endpoint Encryption (TMEE) PolicyServer. These newly disclosed issues, which include critical remote code execution (RCE) and authentication bypass bugs, could allow attackers to compromise systems without needing login credentials. 

Although there have been no confirmed cases of exploitation so far, Trend Micro strongly recommends immediate patching to mitigate any potential threats. The vulnerabilities are especially concerning for organizations operating in sensitive sectors, where data privacy and regulatory compliance are paramount. 

The Endpoint Encryption PolicyServer is a key management solution used to centrally control full disk and media encryption across Windows-based systems. Following the recent update, four critical issues in this product were fixed. Among them is CVE-2025-49212, a remote code execution bug that stems from insecure deserialization within PolicyValue Table Serialization Binder class. This flaw enables threat actors to run code with SYSTEM-level privileges without any authentication. 

Another serious issue, CVE-2025-49213, was found in the PolicyServerWindowsService class, also involving unsafe deserialization. This vulnerability similarly allows arbitrary code execution without requiring user credentials. An additional bug, CVE-2025-49216, enables attackers to bypass authentication entirely due to faulty logic in the DbAppDomain service. Lastly, CVE-2025-49217 presents another RCE risk, though slightly more complex to exploit, allowing code execution via the ValidateToken method. 

While Trend Micro categorized all four as critical, third-party advisory firm ZDI classified CVE-2025-49217 as high-severity. Besides these, the latest PolicyServer release also fixes multiple other high-severity vulnerabilities, such as SQL injection and privilege escalation flaws. The update applies to version 6.0.0.4013 (Patch 1 Update 6), and all earlier versions are affected. Notably, there are no workarounds available, making the patch essential for risk mitigation. 

Trend Micro also addressed separate issues in Apex Central, the company’s centralized console for managing its security tools. Two pre-authentication RCE vulnerabilities—CVE-2025-49219 and CVE-2025-49220—were identified and patched. Both flaws are caused by insecure deserialization and could allow attackers to execute code remotely as NETWORK SERVICE without authentication. 

These Apex Central vulnerabilities were resolved in Patch B7007 for the 2019 on-premise version. Customers using Apex Central as a Service will receive fixes automatically on the backend. 

Given the severity of these cybersecurity vulnerabilities, organizations using these Trend Micro products should prioritize updating their systems to maintain security and operational integrity.
Read more »
Tesla Vulnerabilities and Exploits
authentication bypass flaw cybersecurity vulnerabilities firewall exploits Palo Alto firewalls PAN-OS attacks privilege escalation vulnerability Tesla Vulnerabilities and Exploits

Thousands of Palo Alto Firewalls Hacked Through Recently Patched Vulnerabilities

 

 
Hackers have successfully breached thousands of Palo Alto Networks firewalls by exploiting two critical vulnerabilities recently addressed by the company.

The flaws include an authentication bypass (CVE-2024-0012) in the PAN-OS management web interface, allowing remote attackers to gain admin privileges, and a privilege escalation vulnerability (CVE-2024-9474) enabling execution of commands on firewalls with root access.

CVE-2024-9474 was disclosed earlier this week, while Palo Alto Networks initially alerted users on November 8 about a potential remote code execution flaw, now identified as CVE-2024-0012. The company continues to investigate attacks leveraging these flaws and has confirmed instances of malware deployment and command execution on compromised firewalls.

"This original activity reported on Nov. 18, 2024 primarily originated from IP addresses known to proxy/tunnel traffic for anonymous VPN services," the company stated on Wednesday.

Unit 42, Palo Alto’s threat intelligence team, added, "At this time, Unit 42 assesses with moderate to high confidence that a functional exploit chaining CVE-2024-0012 and CVE-2024-9474 is publicly available, which will enable broader threat activity."

While Palo Alto claims the impact is limited to "a very small number" of PAN-OS devices, the Shadowserver Foundation reported over 2,700 vulnerable systems globally, with approximately 2,000 already compromised.

In response, the Cybersecurity and Infrastructure Security Agency (CISA) added these vulnerabilities to its Known Exploited Vulnerabilities Catalog, requiring federal agencies to patch their systems by December 9.

Additionally, CISA flagged another severe vulnerability (CVE-2024-5910) in the Palo Alto Networks Expedition tool, exploited in November, as well as a previous critical flaw (CVE-2024-3400) impacting over 82,000 devices earlier this year.

Palo Alto Networks has urged customers to secure management interfaces:
"Risk of these issues are greatly reduced if you secure access to the management web interface by restricting access to only trusted internal IP addresses according to our recommended best practice deployment guidelines," the company advised.
Read more »
Subscribe to: Posts (Atom)