🚨CrushFTP has an active 0-Day with a CVSS score of 9.0

CVE-2025-54309: CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.

https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025

🚨CrushFTP has an active 0-Day with a CVSS score of 9.0

CVE-2025-54309: CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.

https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025

HTTP Parameter Pollution in form-data with PoC.

https://github.com/form-data/form-data/security/advisories/GHSA-fjxv-7rqg-78g4

sev:CRIT 9.4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js. This issue affects form-data: < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.

https://www.cve.org/CVERecord?id=CVE-2025-7783

HTTP Parameter Pollution in form-data with PoC.

https://github.com/form-data/form-data/security/advisories/GHSA-fjxv-7rqg-78g4

sev:CRIT 9.4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js. This issue affects form-data: < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.

https://www.cve.org/CVERecord?id=CVE-2025-7783

Microsoft security updates listing four maximum severity vulnerabilities, as in 'we're competing with Cisco'.

- CVE-2025-53762: Microsoft Purview Elevation of Privilege Vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53762

- CVE-2025-47158: Azure DevOps Server Elevation of Privilege Vulnerability New https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47158

- CVE-2025-47995: Azure Machine Learning Elevation of Privilege Vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47995

- CVE-2025-49746: Azure Machine Learning Elevation of Privilege Vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49746 #Microsoft #cybersecurity #infosec #AI #Azure

There was also an EoP in Purview. Also not exploited, no action required.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53762

Microsoft security updates listing four maximum severity vulnerabilities, as in 'we're competing with Cisco'.

- CVE-2025-53762: Microsoft Purview Elevation of Privilege Vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53762

- CVE-2025-47158: Azure DevOps Server Elevation of Privilege Vulnerability New https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47158

- CVE-2025-47995: Azure Machine Learning Elevation of Privilege Vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47995

- CVE-2025-49746: Azure Machine Learning Elevation of Privilege Vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49746 #Microsoft #cybersecurity #infosec #AI #Azure

There was also an EoP in Purview. Also not exploited, no action required.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53762

Microsoft published two sev:CRIT CVEs in Azure Machine Learning and one sev:CRIT in ADO.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49746

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49747

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47158

All of them are listed as not publicly disclosed and not exploited.

The vulnerability documented by this CVE requires no customer action to resolve

Microsoft published two sev:CRIT CVEs in Azure Machine Learning and one sev:CRIT in ADO.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49746

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49747

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47158

All of them are listed as not publicly disclosed and not exploited.

The vulnerability documented by this CVE requires no customer action to resolve

Microsoft security updates listing four maximum severity vulnerabilities, as in 'we're competing with Cisco'.

- CVE-2025-53762: Microsoft Purview Elevation of Privilege Vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53762

- CVE-2025-47158: Azure DevOps Server Elevation of Privilege Vulnerability New https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47158

- CVE-2025-47995: Azure Machine Learning Elevation of Privilege Vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47995

- CVE-2025-49746: Azure Machine Learning Elevation of Privilege Vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49746 #Microsoft #cybersecurity #infosec #AI #Azure

Microsoft published two sev:CRIT CVEs in Azure Machine Learning and one sev:CRIT in ADO.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49746

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49747

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47158

All of them are listed as not publicly disclosed and not exploited.

The vulnerability documented by this CVE requires no customer action to resolve

Microsoft security updates listing four maximum severity vulnerabilities, as in 'we're competing with Cisco'.

- CVE-2025-53762: Microsoft Purview Elevation of Privilege Vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53762

- CVE-2025-47158: Azure DevOps Server Elevation of Privilege Vulnerability New https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47158

- CVE-2025-47995: Azure Machine Learning Elevation of Privilege Vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47995

- CVE-2025-49746: Azure Machine Learning Elevation of Privilege Vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49746 #Microsoft #cybersecurity #infosec #AI #Azure

Microsoft published two sev:CRIT CVEs in Azure Machine Learning and one sev:CRIT in ADO.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49746

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49747

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47158

All of them are listed as not publicly disclosed and not exploited.

The vulnerability documented by this CVE requires no customer action to resolve

Microsoft security updates listing four maximum severity vulnerabilities, as in 'we're competing with Cisco'.

- CVE-2025-53762: Microsoft Purview Elevation of Privilege Vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53762

- CVE-2025-47158: Azure DevOps Server Elevation of Privilege Vulnerability New https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47158

- CVE-2025-47995: Azure Machine Learning Elevation of Privilege Vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47995

- CVE-2025-49746: Azure Machine Learning Elevation of Privilege Vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49746 #Microsoft #cybersecurity #infosec #AI #Azure

Microsoft security updates listing four maximum severity vulnerabilities, as in 'we're competing with Cisco'.

- CVE-2025-53762: Microsoft Purview Elevation of Privilege Vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53762

- CVE-2025-47158: Azure DevOps Server Elevation of Privilege Vulnerability New https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47158

- CVE-2025-47995: Azure Machine Learning Elevation of Privilege Vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47995

- CVE-2025-49746: Azure Machine Learning Elevation of Privilege Vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49746 #Microsoft #cybersecurity #infosec #AI #Azure

Microsoft security updates listing four maximum severity vulnerabilities, as in 'we're competing with Cisco'.

- CVE-2025-53762: Microsoft Purview Elevation of Privilege Vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53762

- CVE-2025-47158: Azure DevOps Server Elevation of Privilege Vulnerability New https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47158

- CVE-2025-47995: Azure Machine Learning Elevation of Privilege Vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47995

- CVE-2025-49746: Azure Machine Learning Elevation of Privilege Vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49746 #Microsoft #cybersecurity #infosec #AI #Azure

Microsoft published two sev:CRIT CVEs in Azure Machine Learning and one sev:CRIT in ADO.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49746

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49747

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47158

All of them are listed as not publicly disclosed and not exploited.

The vulnerability documented by this CVE requires no customer action to resolve

Microsoft security updates listing four maximum severity vulnerabilities, as in 'we're competing with Cisco'.

- CVE-2025-53762: Microsoft Purview Elevation of Privilege Vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53762

- CVE-2025-47158: Azure DevOps Server Elevation of Privilege Vulnerability New https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47158

- CVE-2025-47995: Azure Machine Learning Elevation of Privilege Vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47995

- CVE-2025-49746: Azure Machine Learning Elevation of Privilege Vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49746 #Microsoft #cybersecurity #infosec #AI #Azure

Microsoft published two sev:CRIT CVEs in Azure Machine Learning and one sev:CRIT in ADO.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49746

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49747

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47158

All of them are listed as not publicly disclosed and not exploited.

The vulnerability documented by this CVE requires no customer action to resolve

Post-auth SQLi in HPE Telco Service Orchestrator.

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04875en_us&docLocale=en_US

https://www.cve.org/CVERecord?id=CVE-2025-37104

XSS and open redirect in Grafana.

https://grafana.com/blog/2025/07/17/grafana-security-release-medium-and-high-severity-fixes-for-cve-2025-6197-and-cve-2025-6023/

XSS and open redirect in Grafana.

https://grafana.com/blog/2025/07/17/grafana-security-release-medium-and-high-severity-fixes-for-cve-2025-6197-and-cve-2025-6023/

XSS and open redirect in Grafana.

https://grafana.com/blog/2025/07/17/grafana-security-release-medium-and-high-severity-fixes-for-cve-2025-6197-and-cve-2025-6023/

XSS and open redirect in Grafana.

https://grafana.com/blog/2025/07/17/grafana-security-release-medium-and-high-severity-fixes-for-cve-2025-6197-and-cve-2025-6023/

🔥 CRITICAL vuln: LoginPress Pro (all versions ≤5.0.1) lets attackers bypass auth with social login token, gaining admin access (CVE-2025-7444, CVSS 9.8). No fix yet—monitor for suspicious logins! https://radar.offseq.com/threat/cve-2025-7444-cwe-288-authentication-bypass-using--4768c321 #OffSeq #WordPress #CVE20257444 #infosec

WIZ, from yesterday: NVIDIAScape - Critical NVIDIA AI Vulnerability: A Three-Line Container Escape in NVIDIA Container Toolkit (CVE-2025-23266)

More:

The Hacker News: Critical NVIDIA Container Toolkit Flaw Allows Privilege Escalation on AI Cloud Services https://thehackernews.com/2025/07/critical-nvidia-container-toolkit-flaw.html @thehackernews #Nvidia #cybersecurity #infosec #AI

The vulnerability, tracked as CVE-2025-23266, carries a CVSS score of 9.0 out of 10.0. It has been codenamed NVIDIAScape by Google-owned cloud security company Wiz. https://thehackernews.com/2025/07/critical-nvidia-container-toolkit-flaw.html

NVIDIA reports container escape vulnerabilities in Container Toolkit

NVIDIA has disclosed two critical vulnerabilities in its Container Toolkit and GPU Operator (CVE-2025-23266, CVE-2025-23267) that enable container escape attacks against AI infrastructure used by major cloud providers. The most severe flaw is dubbed "NVIDIAScape" and is exploitable through a simple three-line Dockerfile.

**If you're running NVIDIA Container Toolkit or GPU Operator for AI workloads, either upgrade to Container Toolkit version 1.17.8 and GPU Operator version 25.3.1 or disable the vulnerable enable-cuda-compat hook by setting the disable-cuda-compat-lib-hook flag to true in your configuration files. The exploit is trivial, and attackers will find your systems, one way or another.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/nvidia-reports-container-escape-vulnerabilities-in-container-toolkit-7-b-j-c-e/gD2P6Ple2L

WIZ, from yesterday: NVIDIAScape - Critical NVIDIA AI Vulnerability: A Three-Line Container Escape in NVIDIA Container Toolkit (CVE-2025-23266)

More:

The Hacker News: Critical NVIDIA Container Toolkit Flaw Allows Privilege Escalation on AI Cloud Services https://thehackernews.com/2025/07/critical-nvidia-container-toolkit-flaw.html @thehackernews #Nvidia #cybersecurity #infosec #AI

The vulnerability, tracked as CVE-2025-23266, carries a CVSS score of 9.0 out of 10.0. It has been codenamed NVIDIAScape by Google-owned cloud security company Wiz. https://thehackernews.com/2025/07/critical-nvidia-container-toolkit-flaw.html

NVIDIA reports container escape vulnerabilities in Container Toolkit

NVIDIA has disclosed two critical vulnerabilities in its Container Toolkit and GPU Operator (CVE-2025-23266, CVE-2025-23267) that enable container escape attacks against AI infrastructure used by major cloud providers. The most severe flaw is dubbed "NVIDIAScape" and is exploitable through a simple three-line Dockerfile.

**If you're running NVIDIA Container Toolkit or GPU Operator for AI workloads, either upgrade to Container Toolkit version 1.17.8 and GPU Operator version 25.3.1 or disable the vulnerable enable-cuda-compat hook by setting the disable-cuda-compat-lib-hook flag to true in your configuration files. The exploit is trivial, and attackers will find your systems, one way or another.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/nvidia-reports-container-escape-vulnerabilities-in-container-toolkit-7-b-j-c-e/gD2P6Ple2L

Go hack the robots!

https://www.ros.org/blog/noetic-eol/

After May 31st, 2025 ROS 1 Noetic users may find themselves exposed to un-patched security vulnerabilities and bugs, with few avenues of support short of fixing these issues themselves and recompiling Noetic from source.

https://www.cve.org/CVERecord?id=CVE-2024-39289

https://www.cve.org/CVERecord?id=CVE-2024-39385

https://www.cve.org/CVERecord?id=CVE-2024-41148

https://www.cve.org/CVERecord?id=CVE-2024-41921

Edit to add a couple more.

https://www.cve.org/CVERecord?id=CVE-2025-23266

https://www.cve.org/CVERecord?id=CVE-2025-3753

Go hack more AI shit please. Now.

https://www.wiz.io/blog/nvidia-ai-vulnerability-cve-2025-23266-nvidiascape

New.

Nvidia product advisories:

- NVIDIA Jetson Orin, IGX Orin and Xavier Devices - CVE-2025-23270 and CVE-2025-23269 https://nvidia.custhelp.com/app/answers/detail/a_id/5662

- NVIDIA Container Toolkit - CVE-2025-23266 and CVE-2025-23267 https://nvidia.custhelp.com/app/answers/detail/a_id/5659

- NVIDIA DOCA-Host and Mellanox OFED - CVE-2025-23263 https://nvidia.custhelp.com/app/answers/detail/a_id/5654 #Nvidia #cybersecurity #infosec

Critical Lenovo Driver Flaw Exposes Millions: CVE-2025-4657 Enables Full System Takeover

A Dangerous Threat Hiding in Plain Sight In July 2025, security researchers uncovered a critical buffer overflow vulnerability—CVE-2025-4657—embedded in Lenovo’s lrtp.sys Protection Driver, used widely in Lenovo PC Manager, Browser, and App Store utilities. This vulnerability, if exploited, allows attackers with local access to gain full system privileges on millions of Lenovo…

https://undercodenews.com/critical-lenovo-driver-flaw-exposes-millions-cve-2025-4657-enables-full-system-takeover/

Go hack the robots!

https://www.ros.org/blog/noetic-eol/

After May 31st, 2025 ROS 1 Noetic users may find themselves exposed to un-patched security vulnerabilities and bugs, with few avenues of support short of fixing these issues themselves and recompiling Noetic from source.

https://www.cve.org/CVERecord?id=CVE-2024-39289

https://www.cve.org/CVERecord?id=CVE-2024-39385

https://www.cve.org/CVERecord?id=CVE-2024-41148

https://www.cve.org/CVERecord?id=CVE-2024-41921

Edit to add a couple more.

https://www.cve.org/CVERecord?id=CVE-2025-23266

https://www.cve.org/CVERecord?id=CVE-2025-3753

Three LPEs in Sophos Intercept X for Windows (CVE-2024-13972, CVE-2025-7433, CVE-2025-7472).

https://www.sophos.com/en-us/security-advisories/sophos-sa-20250717-cix-lpe

New.

Nvidia product advisories:

- NVIDIA Jetson Orin, IGX Orin and Xavier Devices - CVE-2025-23270 and CVE-2025-23269 https://nvidia.custhelp.com/app/answers/detail/a_id/5662

- NVIDIA Container Toolkit - CVE-2025-23266 and CVE-2025-23267 https://nvidia.custhelp.com/app/answers/detail/a_id/5659

- NVIDIA DOCA-Host and Mellanox OFED - CVE-2025-23263 https://nvidia.custhelp.com/app/answers/detail/a_id/5654 #Nvidia #cybersecurity #infosec

Go hack the robots!

https://www.ros.org/blog/noetic-eol/

After May 31st, 2025 ROS 1 Noetic users may find themselves exposed to un-patched security vulnerabilities and bugs, with few avenues of support short of fixing these issues themselves and recompiling Noetic from source.

https://www.cve.org/CVERecord?id=CVE-2024-39289

https://www.cve.org/CVERecord?id=CVE-2024-39385

https://www.cve.org/CVERecord?id=CVE-2024-41148

https://www.cve.org/CVERecord?id=CVE-2024-41921

Edit to add a couple more.

https://www.cve.org/CVERecord?id=CVE-2025-23266

https://www.cve.org/CVERecord?id=CVE-2025-3753

Go hack the robots!

https://www.ros.org/blog/noetic-eol/

After May 31st, 2025 ROS 1 Noetic users may find themselves exposed to un-patched security vulnerabilities and bugs, with few avenues of support short of fixing these issues themselves and recompiling Noetic from source.

https://www.cve.org/CVERecord?id=CVE-2024-39289

https://www.cve.org/CVERecord?id=CVE-2024-39385

https://www.cve.org/CVERecord?id=CVE-2024-41148

https://www.cve.org/CVERecord?id=CVE-2024-41921

Edit to add a couple more.

https://www.cve.org/CVERecord?id=CVE-2025-23266

https://www.cve.org/CVERecord?id=CVE-2025-3753

Three LPEs in Sophos Intercept X for Windows (CVE-2024-13972, CVE-2025-7433, CVE-2025-7472).

https://www.sophos.com/en-us/security-advisories/sophos-sa-20250717-cix-lpe

CVE ID: CVE-2025-25257
Vendor: Fortinet
Product: FortiWeb
Date Added: 2025-07-18
Notes: https://fortiguard.fortinet.com/psirt/FG-IR-25-151 ; https://nvd.nist.gov/vuln/detail/CVE-2025-25257
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2025-25257

CISA has added Fortinet FortiWeb SQL Injection Vulnerability to the KEV catalogue. That's CVE-2025-25257 https://www.cve.org/CVERecord?id=CVE-2025-25257

CISA KEV catalogue: https://www.cisa.gov/known-exploited-vulnerabilities-catalog #CISA #cybersecurity #infosec #Fortinet

CVE ID: CVE-2025-25257
Vendor: Fortinet
Product: FortiWeb
Date Added: 2025-07-18
Notes: https://fortiguard.fortinet.com/psirt/FG-IR-25-151 ; https://nvd.nist.gov/vuln/detail/CVE-2025-25257
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2025-25257

CISA has added Fortinet FortiWeb SQL Injection Vulnerability to the KEV catalogue. That's CVE-2025-25257 https://www.cve.org/CVERecord?id=CVE-2025-25257

CISA KEV catalogue: https://www.cisa.gov/known-exploited-vulnerabilities-catalog #CISA #cybersecurity #infosec #Fortinet

@benno @riskybusiness

It gets better. Its into MySQL... running as root. They just INTO OUTFILE, lil bit of fiddling with some python-vs-cgibin into unauth'd RCE. :ablobcatnodfast: so savage 💗

https://labs.watchtowr.com/pre-auth-sql-injection-to-rce-fortinet-fortiweb-fabric-connector-cve-2025-25257/

CVE-2025-25257 Vulnerability: Critical SQL Injection in Fortinet FortiWeb Enables Unauthenticated Remote Code Execution – Source: socprime.com https://ciso2ciso.com/cve-2025-25257-vulnerability-critical-sql-injection-in-fortinet-fortiweb-enables-unauthenticated-remote-code-execution-source-socprime-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #Latestthreats #Vulnerability #socprimecom #socprime #Blog #CVE #rce

Exploits for unauthenticated FortiWeb RCE are public, so patch quickly! (CVE-2025-25257) https://www.helpnetsecurity.com/2025/07/14/exploits-for-unauthenticated-fortiweb-rce-are-public-so-patch-quickly-cve-2025-25257/ #webapplicationsecurity #vulnerability #Don'tmiss #WatchTowr #Hotstuff #Fortinet #exploit #Rapid7 #News #PoC

Critical Vulnerability Exposes Fortinet FortiWeb to Full Takeover (CVE-2025-25257) – Source:hackread.com https://ciso2ciso.com/critical-vulnerability-exposes-fortinet-fortiweb-to-full-takeover-cve-2025-25257-sourcehackread-com/ #1CyberSecurityNewsPost #CyberSecurityNews #cybersecurity #Vulnerability #Fortinet #FortiWeb #Hackread #security #SQL

Critical Vulnerability Exposes Fortinet FortiWeb to Full Takeover (CVE-2025-25257) https://hackread.com/critical-vulnerability-fortinet-fortiweb-cve-2025-25257/

Critical Vulnerability Exposes Fortinet FortiWeb to Full Takeover (CVE-2025-25257) https://hackread.com/critical-vulnerability-fortinet-fortiweb-cve-2025-25257/ #Cybersecurity #Vulnerability #Security #Fortinet #FortiWeb #SQL

Patch immediately: CVE-2025-25257 PoC enables remote code execution on Fortinet FortiWeb https://securityaffairs.com/179874/security/patch-immediately-cve-2025-25257-poc-enables-remote-code-execution-on-fortinet-fortiweb.html

WatchTowr Labs has published a write-up and a PoC for a dangerous pre-auth SQL injection in the web interface of Fortinet devices. The bug is tracked as CVE-2025-25257 and was patched last week.

https://labs.watchtowr.com/pre-auth-sql-injection-to-rce-fortinet-fortiweb-fabric-connector-cve-2025-25257/

Fortinet Releases Patch for Critical SQL Injection Flaw in FortiWeb (CVE-2025-25257) https://thehackernews.com/2025/07/fortinet-releases-patch-for-critical.html

Fortinet Releases Patch for Critical SQL Injection Flaw in FortiWeb (CVE-2025-25257) – Source:thehackernews.com https://ciso2ciso.com/fortinet-releases-patch-for-critical-sql-injection-flaw-in-fortiweb-cve-2025-25257-sourcethehackernews-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #TheHackerNews #Fortinet

🚨 Critical alert: A pre-auth RCE exploit (CVE-2025-25257) targeting Fortinet FortiWeb is now public. Patch to 7.6.4+/7.4.8+ immediately or disable HTTP admin interfaces. Unpatched systems are at high risk. Details: https://redteamnews.com/red-team/cve/critical-pre-auth-rce-exploit-released-for-fortinet-fortiweb-patch-immediately/

🚨CVE-2025-25257: Pre-Auth SQL Injection to RCE - Fortinet FortiWeb Fabric Connector

PoC: https://github.com/watchtowrlabs/watchTowr-vs-FortiWeb-CVE-2025-25257

Write-up: https://labs.watchtowr.com/pre-auth-sql-injection-to-rce-fortinet-fortiweb-fabric-connector-cve-2025-25257/

#FortiWeb Pre-Auth #RCE (CVE-2025-25257)

https://pwner.gg/blog/2025-07-10-fortiweb-fabric-rce

NVIDIA reports container escape vulnerabilities in Container Toolkit

NVIDIA has disclosed two critical vulnerabilities in its Container Toolkit and GPU Operator (CVE-2025-23266, CVE-2025-23267) that enable container escape attacks against AI infrastructure used by major cloud providers. The most severe flaw is dubbed "NVIDIAScape" and is exploitable through a simple three-line Dockerfile.

**If you're running NVIDIA Container Toolkit or GPU Operator for AI workloads, either upgrade to Container Toolkit version 1.17.8 and GPU Operator version 25.3.1 or disable the vulnerable enable-cuda-compat hook by setting the disable-cuda-compat-lib-hook flag to true in your configuration files. The exploit is trivial, and attackers will find your systems, one way or another.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/nvidia-reports-container-escape-vulnerabilities-in-container-toolkit-7-b-j-c-e/gD2P6Ple2L

NVIDIA reports container escape vulnerabilities in Container Toolkit

NVIDIA has disclosed two critical vulnerabilities in its Container Toolkit and GPU Operator (CVE-2025-23266, CVE-2025-23267) that enable container escape attacks against AI infrastructure used by major cloud providers. The most severe flaw is dubbed "NVIDIAScape" and is exploitable through a simple three-line Dockerfile.

**If you're running NVIDIA Container Toolkit or GPU Operator for AI workloads, either upgrade to Container Toolkit version 1.17.8 and GPU Operator version 25.3.1 or disable the vulnerable enable-cuda-compat hook by setting the disable-cuda-compat-lib-hook flag to true in your configuration files. The exploit is trivial, and attackers will find your systems, one way or another.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/nvidia-reports-container-escape-vulnerabilities-in-container-toolkit-7-b-j-c-e/gD2P6Ple2L

New.

Nvidia product advisories:

- NVIDIA Jetson Orin, IGX Orin and Xavier Devices - CVE-2025-23270 and CVE-2025-23269 https://nvidia.custhelp.com/app/answers/detail/a_id/5662

- NVIDIA Container Toolkit - CVE-2025-23266 and CVE-2025-23267 https://nvidia.custhelp.com/app/answers/detail/a_id/5659

- NVIDIA DOCA-Host and Mellanox OFED - CVE-2025-23263 https://nvidia.custhelp.com/app/answers/detail/a_id/5654 #Nvidia #cybersecurity #infosec

Go hack the robots!

https://www.ros.org/blog/noetic-eol/

After May 31st, 2025 ROS 1 Noetic users may find themselves exposed to un-patched security vulnerabilities and bugs, with few avenues of support short of fixing these issues themselves and recompiling Noetic from source.

https://www.cve.org/CVERecord?id=CVE-2024-39289

https://www.cve.org/CVERecord?id=CVE-2024-39385

https://www.cve.org/CVERecord?id=CVE-2024-41148

https://www.cve.org/CVERecord?id=CVE-2024-41921

Edit to add a couple more.

https://www.cve.org/CVERecord?id=CVE-2025-23266

https://www.cve.org/CVERecord?id=CVE-2025-3753

Three LPEs in Sophos Intercept X for Windows (CVE-2024-13972, CVE-2025-7433, CVE-2025-7472).

https://www.sophos.com/en-us/security-advisories/sophos-sa-20250717-cix-lpe

RCE in Livewire.

https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3

sev:CRIT 9.2 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

In Livewire v3 (≤ 3.6.3), a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire v3 and does not affect prior major versions. Exploitation requires a component to be mounted and configured in a particular way, but does not require authentication or user interaction.

https://www.cve.org/CVERecord?id=CVE-2025-54068

Cisco posted five vulnerability updates yesterday:

- Critical, affects CVE-2025-20281; CVE-2025-20282; and CVE-2025-20337 Cisco Identity Services Engine Unauthenticated Remote Code Execution Vulnerabilities https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6

- High, CVE-2025-20274: Cisco Unified Intelligence Center Arbitrary File Upload Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuis-file-upload-UhNEtStm

- Medium, CVE-2025-20272: Cisco Prime Infrastructure and Evolved Programmable Network Manager Blind SQL Injection Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-piepnm-bsi-25JJqsbb

- CVE-2025-20283; CVE-2025-20284; and CVE-2025-20285: Cisco Identity Services Engine Authenticated Remote Code Execution and Authorization Bypass Vulnerabilities https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-3VpsXOxO

- CVE-2025-20288: Cisco Unified Intelligence Center Server-Side Request Forgery Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuis-ssrf-JSuDjeV @TalosSecurity #cybersecurity #Infosec #Cisco

Cisco posted five vulnerability updates yesterday:

- Critical, affects CVE-2025-20281; CVE-2025-20282; and CVE-2025-20337 Cisco Identity Services Engine Unauthenticated Remote Code Execution Vulnerabilities https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6

- High, CVE-2025-20274: Cisco Unified Intelligence Center Arbitrary File Upload Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuis-file-upload-UhNEtStm

- Medium, CVE-2025-20272: Cisco Prime Infrastructure and Evolved Programmable Network Manager Blind SQL Injection Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-piepnm-bsi-25JJqsbb

- CVE-2025-20283; CVE-2025-20284; and CVE-2025-20285: Cisco Identity Services Engine Authenticated Remote Code Execution and Authorization Bypass Vulnerabilities https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-3VpsXOxO

- CVE-2025-20288: Cisco Unified Intelligence Center Server-Side Request Forgery Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuis-ssrf-JSuDjeV @TalosSecurity #cybersecurity #Infosec #Cisco

CVE isn't published yet but ISC published another advisory for BIND.

https://kb.isc.org/docs/cve-2025-40777

sev:HIGH 7.5 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

If a named caching resolver is configured with serve-stale-enable yes, and with stale-answer-client-timeout set to 0 (the only allowable value other than disabled), and if the resolver, in the process of resolving a query, encounters a CNAME chain involving a specific combination of cached or authoritative records, the daemon will abort with an assertion failure.

https://www.cve.org/CVERecord?id=CVE-2025-40777

Edit: The CVE is now published.

New.

Nvidia product advisories:

- NVIDIA Jetson Orin, IGX Orin and Xavier Devices - CVE-2025-23270 and CVE-2025-23269 https://nvidia.custhelp.com/app/answers/detail/a_id/5662

- NVIDIA Container Toolkit - CVE-2025-23266 and CVE-2025-23267 https://nvidia.custhelp.com/app/answers/detail/a_id/5659

- NVIDIA DOCA-Host and Mellanox OFED - CVE-2025-23263 https://nvidia.custhelp.com/app/answers/detail/a_id/5654 #Nvidia #cybersecurity #infosec

🚨 Third critical Cisco ISE flaw in a month. Another perfect 10 CVSS score, another no-workaround RCE. If you’re still running ISE 3.3 or 3.4 without the latest patches, you’re leaving the door wide open for remote root access via a crafted API request.

TL;DR
⚠️ CVE-2025-20337 = unauthenticated RCE
🚨 Exploit = remote root with no workaround
🛠️ Fix = Patch 3.3.7 or 3.4.2
🔍 No active exploitation... yet

https://www.theregister.com/2025/07/17/critical_cisco_bug/
#Cisco #InfoSec #VulnerabilityManagement #ZeroDay #security #privacy #cloud #infosec #cybersecurity

CVE-2025-20337 is a vulnerability in Cisco's Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) products, which the company said in a security advisory https://www.darkreading.com/application-security/cisco-cvss-10-flaw-ise-ise-pic-patch-now

🚨 Third critical Cisco ISE flaw in a month. Another perfect 10 CVSS score, another no-workaround RCE. If you’re still running ISE 3.3 or 3.4 without the latest patches, you’re leaving the door wide open for remote root access via a crafted API request.

TL;DR
⚠️ CVE-2025-20337 = unauthenticated RCE
🚨 Exploit = remote root with no workaround
🛠️ Fix = Patch 3.3.7 or 3.4.2
🔍 No active exploitation... yet

https://www.theregister.com/2025/07/17/critical_cisco_bug/
#Cisco #InfoSec #VulnerabilityManagement #ZeroDay #security #privacy #cloud #infosec #cybersecurity

CVE-2025-20337 is a vulnerability in Cisco's Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) products, which the company said in a security advisory https://www.darkreading.com/application-security/cisco-cvss-10-flaw-ise-ise-pic-patch-now

New Cisco Bugs Rated CVSS 10.0, Patch Immediately https://thecyberexpress.com/cisco-cve-2025-20337-and-ise-pic-flaws/ #TheCyberExpressNews #Ciscovulnerability #Vulnerabilities #TheCyberExpress #FirewallDaily #CVE202520281 #CVE202520337 #CyberNews #ISE #PIC

Cisco reports another critical vulnerability in Cisco ISE that enable enable unauthenticated root code execution

Cisco has disclosed a third critical vulnerability (CVE-2025-20337) affecting its Identity Services Engine platforms that allows unauthenticated remote attackers to execute arbitrary commands with root privileges. Organizations must upgrade to ISE 3.3 Patch 7 or ISE 3.4 Patch 2 for full protection. Previous patches do not fix this flaw.

**If you haven't patched your Cisco Identity Services Engine (ISE), DO IT NOW! Even if you already patched, you probably need to patch again. There are three maximum severity flaws that will harm your ISE. Cisco ISE usually controls network access to a lot of the infrastructure, so you don't want it to be hacked.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/cisco-reports-another-critical-vulnerability-in-cisco-ise-that-enable-enable-unauthenticated-root-code-execution-8-f-i-p-v/gD2P6Ple2L

🚨CVE-2025-20337: A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root.

CVSS: 10

The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to insufficient validation of user-supplied input.

An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to obtain root privileges on an affected device.

https://www.cvedetails.com/cve/CVE-2025-20337/

Cisco patches critical CVE-2025-20337 bug in Identity Services Engine with CVSS 10 Severity – Source: securityaffairs.com https://ciso2ciso.com/cisco-patches-critical-cve-2025-20337-bug-in-identity-services-engine-with-cvss-10-severity-source-securityaffairs-com/ #CiscoIdentityServicesEngine #rssfeedpostgeneratorecho #informationsecuritynews #ITInformationSecurity #SecurityAffairscom #CyberSecurityNews #PierluigiPaganini #SecurityAffairs #SecurityAffairs #BreakingNews #SecurityNews #hackingnews

Max severity Cisco ISE bug allows pre-auth command execution, patch now

A critical vulnerability (CVE-2025-20337) in Cisco's Identity Services Engine (ISE) could be exploited to let an unauthenticated attacker store...

🔗️ [Bleepingcomputer] https://link.is.it/dI2LDo

Cisco posted five vulnerability updates yesterday:

- Critical, affects CVE-2025-20281; CVE-2025-20282; and CVE-2025-20337 Cisco Identity Services Engine Unauthenticated Remote Code Execution Vulnerabilities https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6

- High, CVE-2025-20274: Cisco Unified Intelligence Center Arbitrary File Upload Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuis-file-upload-UhNEtStm

- Medium, CVE-2025-20272: Cisco Prime Infrastructure and Evolved Programmable Network Manager Blind SQL Injection Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-piepnm-bsi-25JJqsbb

- CVE-2025-20283; CVE-2025-20284; and CVE-2025-20285: Cisco Identity Services Engine Authenticated Remote Code Execution and Authorization Bypass Vulnerabilities https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-3VpsXOxO

- CVE-2025-20288: Cisco Unified Intelligence Center Server-Side Request Forgery Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuis-ssrf-JSuDjeV @TalosSecurity #cybersecurity #Infosec #Cisco

Tracked as CVE-2025-20337, the shortcoming carries a CVSS score of 10.0 and is similar to CVE-2025-20281, which was patched by the networking equipment major late last month. https://thehackernews.com/2025/07/cisco-warns-of-critical-ise-flaw.html

Cisco added a new CVE to that perfect 10 in ISE from a couple weeks ago: CVE-2025-20337

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6

They also published a sev:HIGH in Unified Intelligence Center:

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuis-file-upload-UhNEtStm

And a couple sev:MED advisories:

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-piepnm-bsi-25JJqsbb

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuis-ssrf-JSuDjeV

New.

Nvidia product advisories:

- NVIDIA Jetson Orin, IGX Orin and Xavier Devices - CVE-2025-23270 and CVE-2025-23269 https://nvidia.custhelp.com/app/answers/detail/a_id/5662

- NVIDIA Container Toolkit - CVE-2025-23266 and CVE-2025-23267 https://nvidia.custhelp.com/app/answers/detail/a_id/5659

- NVIDIA DOCA-Host and Mellanox OFED - CVE-2025-23263 https://nvidia.custhelp.com/app/answers/detail/a_id/5654 #Nvidia #cybersecurity #infosec

Cisco posted five vulnerability updates yesterday:

- Critical, affects CVE-2025-20281; CVE-2025-20282; and CVE-2025-20337 Cisco Identity Services Engine Unauthenticated Remote Code Execution Vulnerabilities https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6

- High, CVE-2025-20274: Cisco Unified Intelligence Center Arbitrary File Upload Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuis-file-upload-UhNEtStm

- Medium, CVE-2025-20272: Cisco Prime Infrastructure and Evolved Programmable Network Manager Blind SQL Injection Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-piepnm-bsi-25JJqsbb

- CVE-2025-20283; CVE-2025-20284; and CVE-2025-20285: Cisco Identity Services Engine Authenticated Remote Code Execution and Authorization Bypass Vulnerabilities https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-3VpsXOxO

- CVE-2025-20288: Cisco Unified Intelligence Center Server-Side Request Forgery Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuis-ssrf-JSuDjeV @TalosSecurity #cybersecurity #Infosec #Cisco

Cisco posted five vulnerability updates yesterday:

- Critical, affects CVE-2025-20281; CVE-2025-20282; and CVE-2025-20337 Cisco Identity Services Engine Unauthenticated Remote Code Execution Vulnerabilities https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6

- High, CVE-2025-20274: Cisco Unified Intelligence Center Arbitrary File Upload Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuis-file-upload-UhNEtStm

- Medium, CVE-2025-20272: Cisco Prime Infrastructure and Evolved Programmable Network Manager Blind SQL Injection Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-piepnm-bsi-25JJqsbb

- CVE-2025-20283; CVE-2025-20284; and CVE-2025-20285: Cisco Identity Services Engine Authenticated Remote Code Execution and Authorization Bypass Vulnerabilities https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-3VpsXOxO

- CVE-2025-20288: Cisco Unified Intelligence Center Server-Side Request Forgery Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuis-ssrf-JSuDjeV @TalosSecurity #cybersecurity #Infosec #Cisco

Cisco posted five vulnerability updates yesterday:

- Critical, affects CVE-2025-20281; CVE-2025-20282; and CVE-2025-20337 Cisco Identity Services Engine Unauthenticated Remote Code Execution Vulnerabilities https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6

- High, CVE-2025-20274: Cisco Unified Intelligence Center Arbitrary File Upload Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuis-file-upload-UhNEtStm

- Medium, CVE-2025-20272: Cisco Prime Infrastructure and Evolved Programmable Network Manager Blind SQL Injection Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-piepnm-bsi-25JJqsbb

- CVE-2025-20283; CVE-2025-20284; and CVE-2025-20285: Cisco Identity Services Engine Authenticated Remote Code Execution and Authorization Bypass Vulnerabilities https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-3VpsXOxO

- CVE-2025-20288: Cisco Unified Intelligence Center Server-Side Request Forgery Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuis-ssrf-JSuDjeV @TalosSecurity #cybersecurity #Infosec #Cisco

Cisco posted five vulnerability updates yesterday:

- Critical, affects CVE-2025-20281; CVE-2025-20282; and CVE-2025-20337 Cisco Identity Services Engine Unauthenticated Remote Code Execution Vulnerabilities https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6

- High, CVE-2025-20274: Cisco Unified Intelligence Center Arbitrary File Upload Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuis-file-upload-UhNEtStm

- Medium, CVE-2025-20272: Cisco Prime Infrastructure and Evolved Programmable Network Manager Blind SQL Injection Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-piepnm-bsi-25JJqsbb

- CVE-2025-20283; CVE-2025-20284; and CVE-2025-20285: Cisco Identity Services Engine Authenticated Remote Code Execution and Authorization Bypass Vulnerabilities https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-3VpsXOxO

- CVE-2025-20288: Cisco Unified Intelligence Center Server-Side Request Forgery Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuis-ssrf-JSuDjeV @TalosSecurity #cybersecurity #Infosec #Cisco

We have reproduced "ToolShell", the unauthenticated exploit chain for CVE-2025-49706 + CVE-2025-49704 used by @_l0gg to pop SharePoint at #Pwn2Own Berlin 2025, it's really just one request! Kudos to @mwulftange

Looks like unbound was also impacted by this.

https://nlnetlabs.nl/downloads/unbound/CVE-2025-5994.txt

Haven't heard about a birthday attack for a while. This one impacts BIND versions with ECS.

https://kb.isc.org/docs/cve-2025-40776

sev:HIGH 8.6 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

A resolver configured to send ECS options to authoritative servers can be compelled to make queries that slightly increase the odds of guessing the source port and other details necessary to bypass the original birthday cache poisoning attack mitigations. As a result of this weakness, a resolver with ECS enabled is more vulnerable to successful cache poisoning via spoofed query responses than one that does not implement this feature.

https://www.cve.org/CVERecord?id=CVE-2025-40776

Weird DoS in Fortra GoAnywhere.

https://www.fortra.com/security/advisories/product-security/fi-2025-009

Broken access control in Fortra's GoAnywhere MFT prior to 7.8.1 allows an attacker to create a denial of service situation when configured to use GoAnywhere One-Time Password (GOTP) email two-factor authentication (2FA) and the user has not set an email address. In this scenario, the attacker may enter the email address of a known user when prompted and the user will be disabled if that user has configured GOTP.

https://www.cve.org/CVERecord?id=CVE-2025-3871

Auth bypass and command injection in Alcatel-Lucent WAPs.

https://github.com/UltimateHG/CVE-2025-52689-PoC

https://jro.sg/CVEs/CVE-2025-52690/

cc: @Dio9sys @da_667

#internetOfShit

Auth bypass and command injection in Alcatel-Lucent WAPs.

https://github.com/UltimateHG/CVE-2025-52689-PoC

https://jro.sg/CVEs/CVE-2025-52690/

cc: @Dio9sys @da_667

#internetOfShit

Perfect 10 template injection in Sawtooth Lighthouse Studio. 🥳

https://slcyber.io/assetnote-security-research-center/rce-in-the-most-popular-survey-software-youve-never-heard-of/

sev:CRIT 10.0 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

A template injection vulnerability exists in Sawtooth Software’s Lighthouse Studio versions prior to 9.16.14 via the ciwweb.pl http://ciwweb.pl/ Perl web application. Exploitation allows an unauthenticated attacker can execute arbitrary commands.

https://www.cve.org/CVERecord?id=CVE-2025-34300

Post-auth RCE in CyberArk Conjur.

https://github.com/cyberark/conjur/security/advisories/GHSA-93hx-v9pv-qrm4

sev:HIGH 8.6 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

An authenticated attacker who can inject secrets or templates into the Secrets Manager, Self-Hosted database could take advantage of an exposed API endpoint to execute arbitrary Ruby code within the Secrets Manager process. This issue affects both Secrets Manager, Self-Hosted (formerly Conjur Enterprise) and Conjur OSS. CyberArk thanks Yarden Porat and Shahar Tal of Cyata Security for responsibly disclosing this issue.

https://www.cve.org/CVERecord?id=CVE-2025-49828

EUVD: Critical WPBookit plugin for WP vulnerability CVE-2025-6058 https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-21201 @enisa_eu #cybersecurity #infosec #WordPress

Microsoft listed three vulnerabilities yesterday, all affecting Chromium-based Edge.

Microsoft security guide:

- Chromium: CVE-2025-7657 Use after free in WebRTC https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-7657

- Chromium: CVE-2025-7656 Integer overflow in V8 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-7656

- Chromium: CVE-2025-6558 Incorrect validation of untrusted input in ANGLE and GPU https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-6558 #Microsoft #Chromium #cybersecurity #infosec

WordPress Security Alert: CVE-2025-6043 Enables Remote File Deletion via Malcure Plugin https://thecyberexpress.com/malcure-vulnerability-cve-2025-6043/ #MalcureMalwareScanner #TheCyberExpressNews #Vulnerabilities #TheCyberExpress #FirewallDaily #CVE20256043 #CyberNews #Wordfence #WordPress

DoS via DNS. Nice.

https://www.ruby-lang.org/en/news/2025/07/08/dos-resolv-cve-2025-24294/

PoCs for Nexxt Solutions NCM-X1800 Mesh Router Vulnerabilities (CVE-2025-52379) - (CVE-2025-52378) - (CVE-2025-52377) - (CVE-2025-52376)

https://github.com/Vagebondcur/nexxt-solutions-NCM-X1800-exploits

cc: @Dio9sys @da_667

#internetOfShit

@AAKL FYI: CVE-2025-6558 is EITW.

Microsoft listed three vulnerabilities yesterday, all affecting Chromium-based Edge.

Microsoft security guide:

- Chromium: CVE-2025-7657 Use after free in WebRTC https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-7657

- Chromium: CVE-2025-7656 Integer overflow in V8 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-7656

- Chromium: CVE-2025-6558 Incorrect validation of untrusted input in ANGLE and GPU https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-6558 #Microsoft #Chromium #cybersecurity #infosec

The vulnerability is identified as CVE-2025-6558 and received a high-severity rating of 8.8. It was discovered by researchers at Google’s Threat Analysis Group (TAG) on June 23. https://www.bleepingcomputer.com/news/security/google-fixes-actively-exploited-sandbox-escape-zero-day-in-chrome/

CVE-2025-6558 Vulnerability: Google Chrome Zero-Day Under Active Exploitation – Source: socprime.com https://ciso2ciso.com/cve-2025-6558-vulnerability-google-chrome-zero-day-under-active-exploitation-source-socprime-com/ #GoogleChromeVulnerability #rssfeedpostgeneratorecho #CyberSecurityNews #CVE-2025-6558 #Latestthreats #Vulnerability #GoogleChrome #socprimecom #socprime #Blog #CVE

Update Google Chrome to fix actively exploited zero-day (CVE-2025-6558) https://www.helpnetsecurity.com/2025/07/16/update-google-chrome-to-fix-actively-exploited-zero-day-cve-2025-6558/ #securityupdate #MicrosoftEdge #Don'tmiss #Hotstuff #Chrome #0-day #News

Google releases urgent patch for Chrome, fixes actively exploited flaw

Google has released an urgent Chrome security update addressing six vulnerabilities, including a critical zero-day sandbox escape flaw (CVE-2025-6558) that is being actively exploited in the wild. The flaw is discovered by Google's Threat Analysis Group, suggesting potential nation-state involvement.

**Once again - an urgent patch for Chrome - Google is patching an actively exploited flaw in Chrome, and exploitation is just a visit to a malicious site. DONT WAIT! Update all your Chrome and Chromium browsers (Edge, Opera, Brave, Vivaldi...). Updating the browser is easy, all your tabs reopen after the patch.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/google-releases-urgent-patch-for-chrome-fixes-actively-exploited-flaw-d-g-f-0-h/gD2P6Ple2L

Urgent: Google Releases Critical Chrome Update for CVE-2025-6558 Exploit Active in the Wild – Source:thehackernews.com https://ciso2ciso.com/urgent-google-releases-critical-chrome-update-for-cve-2025-6558-exploit-active-in-the-wild-sourcethehackernews-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #TheHackerNews #Urgent

Urgent: Google Releases Critical Chrome Update for CVE-2025-6558 Exploit Active in the Wild https://thehackernews.com/2025/07/urgent-google-releases-critical-chrome.html

Urgent: Google Releases Critical Chrome Update for CVE-2025-6558 Exploit Active in the Wild https://thehackernews.com/2025/07/urgent-google-releases-critical-chrome.html

Siehe auch

https://www.deskmodder.de/blog/2025/07/16/google-chrome-138-0-7204-157-158-schliesst-sicherheitsluecke-cve-2025-6558-als-exploit-in-freier-wildbahn/

Patch your Chrome. Three sev:HIGH fixes released today for Chrome Desktop and Android, including CVE-2025-6558 which Google says has an ITW exploit.

https://chromereleases.googleblog.com/2025/07/stable-channel-update-for-desktop_15.html

Microsoft listed three vulnerabilities yesterday, all affecting Chromium-based Edge.

Microsoft security guide:

- Chromium: CVE-2025-7657 Use after free in WebRTC https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-7657

- Chromium: CVE-2025-7656 Integer overflow in V8 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-7656

- Chromium: CVE-2025-6558 Incorrect validation of untrusted input in ANGLE and GPU https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-6558 #Microsoft #Chromium #cybersecurity #infosec

PoCs for Nexxt Solutions NCM-X1800 Mesh Router Vulnerabilities (CVE-2025-52379) - (CVE-2025-52378) - (CVE-2025-52377) - (CVE-2025-52376)

https://github.com/Vagebondcur/nexxt-solutions-NCM-X1800-exploits

cc: @Dio9sys @da_667

#internetOfShit

CSA Issues Alert on Critical VMware Vulnerabilities: Patch Now, Experts Warn

Broadcom and CSA warn of critical VMware Vulnerabilities ilties flaws, including CVE-2025-41236 and CVE-2025-41237. Update ESXi, Workstation, and...

🔗️ [Cyble] https://link.is.it/TPjvMC

CSA Issues Alert on Critical VMware Vulnerabilities: Patch Now, Experts Warn

Broadcom and CSA warn of critical VMware Vulnerabilities ilties flaws, including CVE-2025-41236 and CVE-2025-41237. Update ESXi, Workstation, and...

🔗️ [Cyble] https://link.is.it/TPjvMC

There are bunch of critical vulnerabilities in #VMWare - "VMSA-2025-0013: VMware ESXi, Workstation, Fusion, and Tools updates address multiple vulnerabilities (CVE-2025-41236, CVE-2025-41237, CVE-2025-41238, CVE-2025-41239)" https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/35877

The best part? softwareupdate.broadcom.com is still down, so for example VMWare Workstation or Fusion are blissfully ignorant of any update being available.

#enshittification

sev:CRIT advisory from VMWare in a bunch of their stuff. Probably worth checking out the impact matrix in the advisory.

VMSA-2025-0013: VMware ESXi, Workstation, Fusion, and Tools updates address multiple vulnerabilities (CVE-2025-41236, CVE-2025-41237, CVE-2025-41238, CVE-2025-41239)

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/35877

CSA Issues Alert on Critical VMware Vulnerabilities: Patch Now, Experts Warn

Broadcom and CSA warn of critical VMware Vulnerabilities ilties flaws, including CVE-2025-41236 and CVE-2025-41237. Update ESXi, Workstation, and...

🔗️ [Cyble] https://link.is.it/TPjvMC

CSA Issues Alert on Critical VMware Vulnerabilities: Patch Now, Experts Warn

Broadcom and CSA warn of critical VMware Vulnerabilities ilties flaws, including CVE-2025-41236 and CVE-2025-41237. Update ESXi, Workstation, and...

🔗️ [Cyble] https://link.is.it/TPjvMC

There are bunch of critical vulnerabilities in #VMWare - "VMSA-2025-0013: VMware ESXi, Workstation, Fusion, and Tools updates address multiple vulnerabilities (CVE-2025-41236, CVE-2025-41237, CVE-2025-41238, CVE-2025-41239)" https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/35877

The best part? softwareupdate.broadcom.com is still down, so for example VMWare Workstation or Fusion are blissfully ignorant of any update being available.

#enshittification

sev:CRIT advisory from VMWare in a bunch of their stuff. Probably worth checking out the impact matrix in the advisory.

VMSA-2025-0013: VMware ESXi, Workstation, Fusion, and Tools updates address multiple vulnerabilities (CVE-2025-41236, CVE-2025-41237, CVE-2025-41238, CVE-2025-41239)

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/35877

There are bunch of critical vulnerabilities in #VMWare - "VMSA-2025-0013: VMware ESXi, Workstation, Fusion, and Tools updates address multiple vulnerabilities (CVE-2025-41236, CVE-2025-41237, CVE-2025-41238, CVE-2025-41239)" https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/35877

The best part? softwareupdate.broadcom.com is still down, so for example VMWare Workstation or Fusion are blissfully ignorant of any update being available.

#enshittification

sev:CRIT advisory from VMWare in a bunch of their stuff. Probably worth checking out the impact matrix in the advisory.

VMSA-2025-0013: VMware ESXi, Workstation, Fusion, and Tools updates address multiple vulnerabilities (CVE-2025-41236, CVE-2025-41237, CVE-2025-41238, CVE-2025-41239)

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/35877

Good write-up on CVE-2025-53020 above.

https://github.com/icing/blog/blob/main/hpack-bombing-apache.md

A detailed description of CVE-2025-53020, a DoS vulnerability in the HTTP/2 implementation of Apache httpd. Fixed in 2.4.64.
#apache #httpd #http2

https://github.com/icing/blog/blob/main/hpack-bombing-apache.md

Dokploy Preview Deployments are vulnerable to Remote Code Execution. PoC in the advisory.

https://github.com/Dokploy/dokploy/security/advisories/GHSA-h67g-mpq5-6ph5

sev:CRIT 9.4 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

An unauthenticated preview deployment vulnerability in Dokploy allows any user to execute arbitrary code and access sensitive environment variables by simply opening a pull request on a public repository. This exposes secrets and potentially enables remote code execution, putting all public Dokploy users using these preview deployments at risk.

https://www.cve.org/CVERecord?id=CVE-2025-53825

There are bunch of critical vulnerabilities in #VMWare - "VMSA-2025-0013: VMware ESXi, Workstation, Fusion, and Tools updates address multiple vulnerabilities (CVE-2025-41236, CVE-2025-41237, CVE-2025-41238, CVE-2025-41239)" https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/35877

The best part? softwareupdate.broadcom.com is still down, so for example VMWare Workstation or Fusion are blissfully ignorant of any update being available.

#enshittification

sev:CRIT advisory from VMWare in a bunch of their stuff. Probably worth checking out the impact matrix in the advisory.

VMSA-2025-0013: VMware ESXi, Workstation, Fusion, and Tools updates address multiple vulnerabilities (CVE-2025-41236, CVE-2025-41237, CVE-2025-41238, CVE-2025-41239)

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/35877

But wait, there's more.

https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6971

https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6972

https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6973

https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6974

https://www.3ds.com/trust-center/security/security-advisories/cve-2025-7042

PoCs for Nexxt Solutions NCM-X1800 Mesh Router Vulnerabilities (CVE-2025-52379) - (CVE-2025-52378) - (CVE-2025-52377) - (CVE-2025-52376)

https://github.com/Vagebondcur/nexxt-solutions-NCM-X1800-exploits

cc: @Dio9sys @da_667

#internetOfShit

Remote code execution through js2py onCaptchaResult

https://github.com/pyload/pyload/security/advisories/GHSA-8w3f-4r8f-pf53

sev:CRIT 9.8 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

pyload is an open-source Download Manager written in pure Python. An unsafe JavaScript evaluation vulnerability in pyLoad’s CAPTCHA processing code allows unauthenticated remote attackers to execute arbitrary code in the client browser and potentially the backend server. Exploitation requires no user interaction or authentication and can result in session hijacking, credential theft, and full system remote code execution. Commit 909e5c97885237530d1264cfceb5555870eb9546, the patch for the issue, is included in version 0.5.0b3.dev89.

https://www.cve.org/CVERecord?id=CVE-2025-53890

Google says ‘Big Sleep’ AI tool found bug hackers planned to use

On Tuesday, Google said Big Sleep managed to discover CVE-2025-6965 — a critical security flaw that Google said was “only known to threat actors...

🔗️ [Therecord] https://link.is.it/NuePCK

Google said its LLM known as Big Sleep managed to discover CVE-2025-6965 — a critical security flaw that was “only known to threat actors and was at risk of being exploited.”

https://therecord.media/google-big-sleep-ai-tool-found-bug

SQLite isn't used in very many systems, is it?

https://www.sqlite.org/src/info/5508b56fd24016c13981ec280ecdd833007c9d8dd595edb295b984c2b487b5c8

sev:HIGH 7.2 - CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/S:N/AU:N/R:U/V:D/RE:L/U:Green

There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above.

https://www.cve.org/CVERecord?id=CVE-2025-6965

But wait, there's more.

https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6971

https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6972

https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6973

https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6974

https://www.3ds.com/trust-center/security/security-advisories/cve-2025-7042

But wait, there's more.

https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6971

https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6972

https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6973

https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6974

https://www.3ds.com/trust-center/security/security-advisories/cve-2025-7042

But wait, there's more.

https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6971

https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6972

https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6973

https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6974

https://www.3ds.com/trust-center/security/security-advisories/cve-2025-7042

But wait, there's more.

https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6971

https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6972

https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6973

https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6974

https://www.3ds.com/trust-center/security/security-advisories/cve-2025-7042

Isn't SOLIDWORKS one of those things a bunch of you nerds like to put random Internet downloads into?

https://www.3ds.com/trust-center/security/security-advisories/cve-2025-0831

PoCs for Nexxt Solutions NCM-X1800 Mesh Router Vulnerabilities (CVE-2025-52379) - (CVE-2025-52378) - (CVE-2025-52377) - (CVE-2025-52376)

https://github.com/Vagebondcur/nexxt-solutions-NCM-X1800-exploits

cc: @Dio9sys @da_667

#internetOfShit

Multiple flaws in Schneider Electric EcoStruxure IT Data Center Expert, at least one critical

Schneider Electric reports multiple vulnerabilities in its EcoStruxure IT Data Center Expert platform, including a CVSS 10.0 flaw (CVE-2025-50121) that enables unauthenticated remote code execution. The company released version 9.0 to patch all vulnerabilities.

**If you have Schneider Electric EcoStruxure IT Data Center Expert, make sure it's isolated from the internet and accesible from trusted networks only. Then plan an update cycle to version 9.0 available through Schneider's Customer Care Center with proper testing.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/multiple-flaws-in-schneider-electric-ecostruxure-it-data-center-expert-at-least-one-critical-f-7-2-q-w/gD2P6Ple2L

A Friday advisory from Facebook? Nice.

https://www.facebook.com/security/advisories/cve-2025-30402

Description: A heap-buffer-overflow vulnerability in the loading of ExecuTorch methods can cause the runtime to crash and potentially result in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit 93b1a0c15f7eda49b2bc46b5b4c49557b4e9810f

LB-LINK routers (BL-AC1900 & more, ≤20250702) face CRITICAL risk: CVE-2025-7574 allows remote, unauthenticated reboot/restore via /cgi-bin/lighttpd.cgi. Public exploit, no patch yet. Restrict access & monitor! https://radar.offseq.com/threat/cve-2025-7574-improper-authentication-in-lb-link-b-84743308 #OffSeq #RouterSecurity #CVE20257574

LPE in Cato Linux client.

https://support.catonetworks.com/hc/en-us/articles/28552501717405-CVE-2025-7012-Linux-Client-Local-Privilege-Escalation-via-Symbolic-Link-Handling

sev:HIGH 8.6 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:Y/R:U/RE:M/U:Green

An issue in Cato Networks' CatoClient for Linux, before version 5.5, allows a local attacker to escalate privileges to root by exploiting improper symbolic link handling.

https://www.cve.org/CVERecord?id=CVE-2025-7012

../ in Zyxel access points.

https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-path-traversal-vulnerability-in-aps-07-15-2025

sev:HIGH 7.2 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

The path traversal vulnerability in the file_upload-cgi CGI program of certain AP firmware versions could allow an authenticated attacker with administrator privileges to access specific directories and delete files—such as the configuration file—on a vulnerable device. It is important to note that AP management interfaces are typically accessed within a LAN environment, and this attack would only be successful if strong, unique administrator passwords had already been compromised.

https://www.cve.org/CVERecord?id=CVE-2025-6265

cc: @Dio9sys @da_667

Critical template Injection flaw in LaRecipe Documentation Package enables remote code execution

A critical Server-Side Template Injection (SSTI) vulnerability (CVE-2025-53833) in LaRecipe PHP documentation package allows attackers to execute arbitrary code with minimal technical expertise by injecting malicious template syntax into user-controlled data.

**If you're using LaRecipe PHP documentation package, it's time to update. Isolation of the web application may help but usually these systems are built to have a lot of users. So don't delay, patch to version 2.8.1 or later. Aheck your access logs for exploitation attempts and consider adding a Web Application Firewall (WAF) for additional protection.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/critical-template-injection-flaw-in-larecipe-documentation-package-enables-remote-code-execution-g-a-g-7-h/gD2P6Ple2L

Updated #CitrixBleed2 scans https://github.com/GossiTheDog/scanning/blob/main/CVE-2025-5777-CitrixBleed2-ElectricBoogaloo-patching.txt

Fields - IP, SSL certification hostnames, Netscaler firmware, if vulnerable to CVE-2025-5777

I've had a few orgs contest that they're not vulnerable and the scan is wrong. I've assisted each org, and in each case they've been wrong - they'd patched the wrong Netscaler, the passive HA node etc.

Updated #CitrixBleed2 scans https://github.com/GossiTheDog/scanning/blob/main/CVE-2025-5777-CitrixBleed2-ElectricBoogaloo-patching.txt

Fields - IP, SSL certification hostnames, Netscaler firmware, if vulnerable to CVE-2025-5777

I've had a few orgs contest that they're not vulnerable and the scan is wrong. I've assisted each org, and in each case they've been wrong - they'd patched the wrong Netscaler, the passive HA node etc.

“A critical Citrix NetScaler vulnerability, tracked as CVE-2025-5777 and dubbed "CitrixBleed 2," was actively exploited nearly two weeks before proof-of-concept (PoC) exploits were made public, despite Citrix stating that there was no evidence of attacks.”

https://www.bleepingcomputer.com/news/security/citrix-bleed-2-exploited-weeks-before-pocs-as-citrix-denied-attacks/

Citrix Bleed 2 exploited weeks before PoCs as Citrix denied attacks

A critical Citrix NetScaler vulnerability, tracked as CVE-2025-5777 and dubbed "CitrixBleed 2," was actively exploited nearly two weeks before...

🔗️ [Bleepingcomputer] https://link.is.it/eX1RbT

Citrix have a blog out about hunting for #CitrixBleed2

https://www.netscaler.com/blog/news/evaluating-netscaler-logs-for-indicators-of-attempted-exploitation-of-cve-2025-5777/

It's what was in my earlier blog - look for invalid characters in the username field and duplicate sessions with different IPs

I've created a pull request to detect CitrixBleed 2 into Burp's Bcheck repository: https://github.com/PortSwigger/BChecks/pull/253

The code is here if you want to give it a try:
https://github.com/felmoltor/BChecks/blob/main/vulnerabilities-CVEd/CVE-2025-5777%20-%20CitrixBleed%202.bcheck

GreyNoise blog just out about #CitrixBleed2, they see exploitation from IPs in China from June 23rd targeting specifically Netscaler appliances https://www.greynoise.io/blog/exploitation-citrixbleed-2-cve-2025-5777-before-public-poc

🩸& #threatintel | We (@greynoise) just published a quick note (https://www.greynoise.io/blog/exploitation-citrixbleed-2-cve-2025-5777-before-public-poc) regarding CVE-2025-5777 - CitrixBleed 2

The main takeaway is we, first hand, observed exploitation almost two weeks before the POC was released, so ensure all retro threat hunting goes back at LEAST a month, but ideally further.
1/2

@GossiTheDog 🧐 are you referring to CVE-2025-5777 or did I miss yet another? We hadn’t planned on it but what are you thinking?

New CitrixBleed 2 scan data:

https://raw.githubusercontent.com/GossiTheDog/scanning/refs/heads/main/CVE-2025-5777-CitrixBleed2-ElectricBoogaloo-patching.txt

+7000 extra hosts added this round, host list is so large you need to use the raw view to see it.

Next set of data publication likely Friday, a month since the patch became available.

3832 orgs/hosts still unpatched.

Updated CitrixBleed 2 scan results: https://github.com/GossiTheDog/scanning/blob/main/CVE-2025-5777-CitrixBleed2-ElectricBoogaloo-patching.txt

It's down from 24% unpatched to 17% unpatched

The results are partial still, the actual numbers still vuln will be higher.

Citrix NetScaler Memory Leak Exploit https://github.com/bughuntar/CVE-2025-5777

If you ask Citrix support for IOCs for CVE-2025-5777 and they send you a script to run that looks for .php files - they’ve sent you an unrelated script, which has nothing to do with session hijacking or memory overread.

I've created a passive detection script to detect instances that are vulnerable to critical RCE tagged as CVE-2025-47812:
https://github.com/rxerium/CVE-2025-47812/tree/main

Around ~4000 instances exposed to the internet as of 25.07.16
`http.favicon.hash:963565804`

🟥𝐋𝐂𝐒𝐂-𝐈𝐄 𝐃𝐚𝐢𝐥𝐲 𝐂𝐲𝐛𝐞𝐫 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐅𝐢𝐧𝐝𝐢𝐧𝐠𝐬-𝟏𝟓 𝐉𝐮𝐥𝐲 𝟐𝟎𝟐𝟓🟥

News:

1. Ireland's National Treasury Management Agency to review security protocols after losing 5 million euros in phishing attack

https://www.reuters.com/markets/europe/irish-debt-office-review-security-protocols-after-losing-5-million-euros-2025-07-14/

2. Ransomware in Italy, strike at the Diskstation gang: hacker group leader arrested in Milan

https://decripto.org/en/ransomware-in-italy-strike-at-the-diskstation-gang-hacker-group-leader-arrested-in-milan/

3. Federal IT Contractor Pays $14.75 Million Fine to Settle Cyber Fraud Charges

https://thecyberexpress.com/federal-contractor-pays-14m-to-settle-fraud/

4. How Trump's Cyber Cuts Dismantle Federal Information Sharing

https://www.bankinfosecurity.com/how-trumps-cyber-cuts-dismantle-federal-information-sharing-a-28964

5. New White House cyber executive order pushes rules as code

https://cyberscoop.com/new-white-house-cyber-executive-order-pushes-rules-as-code-op-ed/

6. PoC Released for High-Severity Git CLI Vulnerability Allowing Arbitrary File Writes

https://securitylabs.datadoghq.com/articles/git-arbitrary-file-write/

---

Global Breaches and Data Leaks:

1. Flutter Entertainment (Paddy Power and Betfair) users warned of 'email danger' after breach

https://www.bbc.com/news/articles/cz7l29zved9o

---

Tactical Reports with IOCs:

1. Heavy metal: the new group of Telemancon attacks industrial organizations

https://www.f6.ru/blog/telemancon/

2. GLOBAL GROUP: Emerging Ransomware-as-a-Service, Supporting AI Driven Negotiation and Mobile Control Panel for Their Affiliates

https://blog.eclecticiq.com/global-group-emerging-ransomware-as-a-service

3. KongTuke FileFix Leads to New Interlock RAT Variant

https://thedfirreport.com/2025/07/14/kongtuke-filefix-leads-to-new-interlock-rat-variant/

4. BlackSuit: A Hybrid Approach with Data Exfiltration and Encryption

https://www.cybereason.com/blog/blacksuit-data-exfil

5. Likely Belarus-Nexus Threat Actor Delivers Downloader to Poland

https://dmpdump.github.io/posts/Belarus-nexus_Threat_Actor_Target_Poland/

6. OCTALYN Stealer

https://www.cyfirma.com/research/octalyn-stealer-unmasked/

7. Finding Fake/Phishing Domains with HTML Features in Validin

https://www.validin.com/blog/http_feature_pivoting/

8. Crypto Wallets Continue to be Drained in Elaborate Social Media Scam

https://www.darktrace.com/blog/crypto-wallets-continue-to-be-drained-in-elaborate-social-media-scam

9. Behind the Clouds: Attackers Targeting Governments in Southeast Asia Implement Novel Covert C2 Communication

https://unit42.paloaltonetworks.com/windows-backdoor-for-novel-c2-communication/

10. Evolving Tactics of SLOW#TEMPEST: A Deep Dive Into Advanced Malware Techniques

https://unit42.paloaltonetworks.com/slow-tempest-malware-obfuscation/

11. Contagious Interview Campaign Escalates With 67 Malicious npm Packages and New Malware Loader

https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages

12. Wing FTP Server Remote Code Execution (CVE-2025-47812) Exploited in the Wild

https://www.huntress.com/blog/wing-ftp-server-remote-code-execution-cve-2025-47812-exploited-in-wild

13. Matanbuchus 3.0 Loader

https://github.com/prodaft/malware-ioc/tree/master/Matanbuchus

14. CoreSecThree Framework

https://github.com/prodaft/malware-ioc/tree/master/CoreSecThree

15. Malware Found in Official GravityForms Plugin Indicating Supply Chain Breach

https://patchstack.com/articles/critical-malware-found-in-gravityforms-official-plugin-site/

---

APT IOCs:

1. Possible Scattered Spider

cca039482a104d5d9b04bd2e20f6bb64[.]apm[.]us-west-2[.]aws[.]msicrosoft[.]com
outlook[.]msicrosoft[.]com
usa[.]msicrosoft[.]com
ftp[.]msicrosoft[.]com
logincdn[.]msicrosoft[.]com
ulgroup[.]msicrosoft[.]com
login1[.]msicrosoft[.]com
img6[.]msicrosoft[.]com
vn3hg[.]msicrosoft[.]com
msalaunch[.]msicrosoft[.]com
dotfoods[.]msicrosoft[.]com
sso4[.]msicrosoft[.]com
login[.]msicrosoft[.]com
js[.]msicrosoft[.]com
browser[.]msicrosoft[.]com
o[.]msicrosoft[.]com
help[.]msicrosoft[.]com
img1[.]msicrosoft[.]com
fpt2[.]msicrosoft[.]com
authh[.]msicrosoft[.]com
secure[.]msicrosoft[.]com
msfed[.]msicrosoft[.]com
sp[.]authpoint[.]usa1[.]msicrosoft[.]com
res[.]msicrosoft[.]com
mmcapi[.]msicrosoft[.]com
wcpstatic[.]msicrosoft[.]com
account[.]msicrosoft[.]com
ssoo[.]msicrosoft[.]com
gui[.]msicrosoft[.]com
office[.]msicrosoft[.]com
ads[.]msicrosoft[.]com
sso3[.]msicrosoft[.]com
sci[.]msicrosoft[.]com
winsscp[.]org
146.70.87[.]184
www-mlcrosoft[.]com
account.www-mlcrosoft[.]com
sso.www-mlcrosoft[.]com
ssoo.www-mlcrosoft[.]com
18.219.115[.]252
18.117.173[.]7
188.166.149[.]50
kennedywilsoninc[.]com

2. Kimsuky

144[.]172[.]104[.]10
docsdeliver[.]mydns[.]jp
hometxdoc[.]mydns[.]bz
userinfoblg[.]o-r[.]kr
binfo[.]userinfoblg[.]o-r[.]kr
docinfo[.]docsdeliver[.]mydns[.]jp
usr[.]hometxdoc[.]mydns[.]bz
a-info[.]userinfoblg[.]o-r[.]kr
b-info[.]userinfoblg[.]o-r[.]kr
c-info[.]userinfoblg[.]o-r[.]kr
d-info[.]userinfoblg[.]o-r[.]kr
e-info[.]userinfoblg[.]o-r[.]kr
f-info[.]userinfoblg[.]o-r[.]kr
g-info[.]userinfoblg[.]o-r[.]kr
h-info[.]userinfoblg[.]o-r[.]kr
i-info[.]userinfoblg[.]o-r[.]kr
j-info[.]userinfoblg[.]o-r[.]kr
k-info[.]userinfoblg[.]o-r[.]kr
l-info[.]userinfoblg[.]o-r[.]kr
m-info[.]userinfoblg[.]o-r[.]kr
n-info[.]userinfoblg[.]o-r[.]kr
o-info[.]userinfoblg[.]o-r[.]kr
p-info[.]userinfoblg[.]o-r[.]kr
q-info[.]userinfoblg[.]o-r[.]kr
r-info[.]userinfoblg[.]o-r[.]kr
s-info[.]userinfoblg[.]o-r[.]kr
t-info[.]userinfoblg[.]o-r[.]kr
u-info[.]userinfoblg[.]o-r[.]kr
v-info[.]userinfoblg[.]o-r[.]kr
w-info[.]userinfoblg[.]o-r[.]kr
x-info[.]userinfoblg[.]o-r[.]kr
y-info[.]userinfoblg[.]o-r[.]kr
z-info[.]userinfoblg[.]o-r[.]kr

2. bluenoroff

us05zoom[.]com
us05zoom[.]us[.]com

---

Threat Hunting / DFIR/ Malware:

1. Researchers foil $10M DeFi backdoor in thousands of smart contracts

https://x.com/deeberiroz/status/1943041785476894996

2. Chasing Ghosts Over RDP: Lateral Movement in Tiny Bitmaps

https://medium.com/@mathias.fuchs/chasing-ghosts-over-rdp-lateral-movement-in-tiny-bitmaps-328d2babd8ec

3. Threat Actor Intelligence Report: 1ucif3r / Lucifer

https://www.notion.so/stealthmole-intelligence-hub/Threat-Actor-Intelligence-Report-1ucif3r-Lucifer-230e52810ca980b0ba3bde25c1fb5e14

4. Breaking down the UserAssist artifact structure

https://securelist.com/userassist-artifact-forensic-value-for-incident-response/116911/

5. Unlocking Advanced Android Capabilities Without Root

https://www.mobile-hacker.com/2025/07/14/shizuku-unlocking-advanced-android-capabilities-without-root/?utm_source=rss&utm_medium=rss&utm_campaign=shizuku-unlocking-advanced-android-capabilities-without-root

6. ClickFix Chaos: A Deep Dive into Rhadamanthys Infostealer’s Stealth and Steal Tactics

https://darkatlas.io/blog/clickfix-chaos-a-deep-dive-into-rhadamanthys-infostealers-stealth-and-steal-tactics

7. Threat Actor Spotlight: Pryx

https://www.morado.io/blog-posts/threat-actor-spotlight-pryx

8. Phishing For Gemini

https://0din.ai/blog/phishing-for-gemini

9. Exploiting Public APP_KEY Leaks to Achieve RCE in Hundreds of Laravel Applications

https://blog.gitguardian.com/exploiting-public-app_key-leaks/

10. [Project 001] Operation Wall Breach: Sysmon Threat Hunt — A Scout Regiment Case File

https://medium.com/@BeyondTheWalls/operation-wall-breach-sysmon-threat-hunt-a-scout-regiment-case-file-e8e71672de55

11. 195. Hunting for Interlock RAT PHP Based Variant

https://www.knowyouradversary.ru/2025/07/195-hunting-for-interlock-rat-php-based.html

12. Brewing Trouble — Dissecting a macOS Malware Campaign

https://medium.com/deriv-tech/brewing-trouble-dissecting-a-macos-malware-campaign-90c2c24de5dc

---

Light Reading:

1. Russia-linked group spoofing European journalists to spread disinformation

https://substack.com/@gnidaproject/p-167032916

2. Can identity systems survive geopolitical cyberwar? Israel’s security test

https://www.intelligentciso.com/2025/07/09/can-identity-systems-survive-geopolitical-cyberwar-israels-security-test/

3. From Tanks to TikTok: Adapting Article 5 for Graduated Responses to Hybrid Warfare

https://smallwarsjournal.com/2025/07/15/adapting-article-5-responses-to-hybrid-warfare/

4. Russia Uses Slovak Cyber Firm to Expose Ukrainian Soldiers Online

https://thedefensepost.com/2025/07/15/russia-slovakia-ukrainian-soldiers/

https://www.icjk.sk/405/Rodiny-ukrajinskych-vojakov-dostavaju-vyhrazne-spravy-aj-vdaka-ruskym-firmam-operujucim-zo-Slovenska

---

New.

CISA has added to the KEV catalogue.

- CVE-2025-47812: Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability https://www.cve.org/CVERecord?id=CVE-2025-47812 #CISA #cybersecurity #infosec

CVE ID: CVE-2025-47812
Vendor: Wing FTP Server
Product: Wing FTP Server
Date Added: 2025-07-14
Notes: https://www.wftpserver.com/serverhistory.htm ; https://nvd.nist.gov/vuln/detail/CVE-2025-47812
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2025-47812

Twas nice of KEV to catch up to us in caring about the Wing FTP RCE

https://viz.greynoise.io/tags/wing-ftp-server-loginok-html-cve-2025-47812-remote-code-execution-attempt?days=30

Critical remote code execution flaw in Wing FTP Server actively exploited

Huntress researchers report active exploitation of a critical perfect 10 CVSS vulnerability (CVE-2025-47812) in Wing FTP Server that allows attackers to execute arbitrary system commands with highest privileges through Lua code injection via malicious HTTP POST requests to the web interface. The exploitation campaign, observed since July 1, 2025, targets approximately 5,000 internet-accessible Wing FTP servers with exposed web interfaces, with attackers creating persistence, downloading malicious files, and installing remote access tools.

**One more reminder that this is an URGENT patch! If you're running Wing FTP Server (any version up to 7.4.3), update NOW, because hackers are already attacking your Wing FTP Server.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/critical-remote-code-execution-flaw-in-wing-ftp-server-actively-exploited-n-m-3-i-c/gD2P6Ple2L

Critical Wing FTP Server Vulnerability (CVE-2025-47812) Actively Being Exploited in the Wild https://thehackernews.com/2025/07/critical-wing-ftp-server-vulnerability.html

We're seeing the opportunistic exploitation attempts hitting the WingFTP bug that the fine folks over at @huntress discovered.

Small # of IPs for now. All with malicious intent.

https://viz.greynoise.io/tags/wing-ftp-server-loginok-html-cve-2025-47812-remote-code-execution-attempt?days=90

Critical Wing FTP Server Vulnerability (CVE-2025-47812) Actively Being Exploited in the Wild – Source:thehackernews.com https://ciso2ciso.com/critical-wing-ftp-server-vulnerability-cve-2025-47812-actively-being-exploited-in-the-wild-sourcethehackernews-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #TheHackerNews #Critical

This looks like an older disclosure of some vulns in Avid Nexis Agent but it includes a ../ that, at least at the time, was undocumented in gSOAP. That CVE was just published today.

https://raeph123.github.io/BlogPosts/Avid_Nexis/Advisory_Avid_Nexus_Agent_Multiple_Vulnerabilities_en.html

https://www.cve.org/CVERecord?id=CVE-2024-26293

[CVE-2024-58258] SugarCRM <= 14.0.0 (css/preview) LESS Code Injection Vulnerability https://karmainsecurity.com/KIS-2025-04

Obscure kernel bug use-after-free and then the VLAI severity told me "maybe important" before I read the drama https://syst3mfailure.io/rbtree-family-drama/

#kernel #linux #exploitation #vulnerability

🔗 https://vulnerability.circl.lu/vuln/CVE-2025-38001#sightings

[CVE-2025-38001] #Exploiting All Google #kernelCTF Instances And Debian 12 With A #0Day For $82k: A RBTree Family Drama (Part One: LTS & COS)

https://syst3mfailure.io/rbtree-family-drama/

And another one.

https://www.facebook.com/security/advisories/cve-2025-30403

A heap-buffer-overflow vulnerability is possible in mvfst via a specially crafted message during a QUIC session. This issue affects mvfst versions prior to v2025.07.07.00.

SureForms WordPress Plugin flaw enables unauthenticated file deletion, potential site takeover

A vulnerabilityin the SureForms WordPress plugin (CVE-2025-6691) allows unauthenticated attackers to delete arbitrary files, including the wp-config.php file, which can force sites into setup mode and enable complete website takeover. Patches are available in multiple updated versions.

**If you have the SureForms WordPress plugin installed, immediately check your version and update to the latest patched release (1.7.4 or appropriate version for your branch). Don't delay this one, because you can't really hide the form, and updating the plugin is nearly trivial.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/sureforms-wordpress-plugin-flaw-enables-unauthenticated-file-deletion-potential-site-takeover-e-k-3-m-q/gD2P6Ple2L

Ahn Lab: Linux libblockdev Package Security Update Advisory (CVE-2025-6019) https://asec.ahnlab.com/en/89042/ #Linux #cybersecurity #infosec

From yesterday. Promo toward the end.

Arctic Wolf: PoC Available for High-Severity Arbitrary File Write in Git CLI (CVE-2025-48384) https://arcticwolf.com/resources/blog/poc-available-for-high-severity-arbitrary-file-write-in-git-cli-cve-2025-48384/ #cybersecurity #infosec

DoS in Apache Commons FileUpload. It impacts some F5 gear. And other things, I'm sure.

https://my.f5.com/manage/s/article/K000152614

Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload. This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4. Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.

https://www.cve.org/CVERecord?id=CVE-2025-48976

Critical RCE Vulnerability in mcp-remote: CVE-2025-6514 Threatens LLM Clients https://jfrog.com/blog/2025-6514-critical-mcp-remote-rce-vulnerability/

Critical RCE Vulnerability in mcp-remote: CVE-2025-6514 Threatens LLM Clients https://jfrog.com/blog/2025-6514-critical-mcp-remote-rce-vulnerability/

Critical RCE Vulnerability in mcp-remote: CVE-2025-6514 Threatens LLM Clients https://jfrog.com/blog/2025-6514-critical-mcp-remote-rce-vulnerability/

Critical remote code execution flaw in mcp-remote exposes AI Systems to compromise

JFrog Security Research discovered a critical vulnerability (CVE-2025-6514) in the widely-used mcp-remote project that allows attackers to execute arbitrary operating system commands through OAuth authentication manipulation.

**If you use the mcp-remote npm package for connecting local LLM hosts to remote MCP servers, plan an urgent update to version 0.1.16. The flaw allows malicious MCP servers can push back commands to your computer and hack you. Also, make sure to only connect to trusted MCP servers using HTTPS connections.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/critical-remote-code-execution-flaw-in-mcp-remote-exposes-ai-systems-to-compromise-g-r-q-n-e/gD2P6Ple2L

We have reproduced "ToolShell", the unauthenticated exploit chain for CVE-2025-49706 + CVE-2025-49704 used by @_l0gg to pop SharePoint at #Pwn2Own Berlin 2025, it's really just one request! Kudos to @mwulftange

The weekly Cyber Intel Brief by AJ Nash is out! ⚠️

A suspected North American APT, NightEagle, targets Chinese tech sectors. Meanwhile, AI-powered impersonation attacks hit high-profile U.S. figures like Secretary of State Marco Rubio.

🔧 Microsoft patches 137 vulnerabilities including a wormable SPNEGO flaw (CVE-2025-47981).
🛡️ CISA adds 6 more to the KEV catalog—compliance due July 28–31.

Dive into the full brief ⬇️
https://bit.ly/4lKU9M9

The Varonis team has published a write-up on a ServiceNow bug they found and got patched last week. Tracked as CVE-2025-3648, the vulnerability allows threat actors to infer data from the Now Platform without authentication.

https://www.varonis.com/blog/counter-strike-servicenow

ServiceNow Flaw CVE-2025-3648 Could Lead to Data Exposure via Misconfigured ACLs https://thehackernews.com/2025/07/servicenow-flaw-cve-2025-3648-could.html

CVE-2025-5333 - CVSS 9.5: Remote Code Execution in Broadcom Symantec Endpoint Management Suite (Altiris) https://www.lrqa.com/en/cyber-labs/remote-code-execution-in-broadcom-altiris-irm/

@GossiTheDog this one is for CVE-2025-6543

CVE-2025-6554 marks the fifth actively exploited Chrome Zero-Day patched by Google in 2025 – Source: securityaffairs.com https://ciso2ciso.com/cve-2025-6554-marks-the-fifth-actively-exploited-chrome-zero-day-patched-by-google-in-2025-source-securityaffairs-com/ #rssfeedpostgeneratorecho #informationsecuritynews #ITInformationSecurity #SecurityAffairscom #CyberSecurityNews #PierluigiPaganini #SecurityAffairs #SecurityAffairs #BreakingNews #SecurityNews #hackingnews #Security #hacking #zeroday

CVE-2025-6554 marks the fifth actively exploited Chrome Zero-Day patched by Google in 2025 https://securityaffairs.com/180001/hacking/cve-2025-6554-marks-the-fifth-actively-exploited-chrome-zero-day-patched-by-google-in-2025.html

#cyberseurity #chrome #Zeroday

Google posted this yesterday. It affects critical CVE-2025-6192 and CVE-2025-5068, CVE-2025-5281, CVE-2025-6554.

Long Term Support Channel Update for ChromeOS https://chromereleases.googleblog.com/2025/07/long-term-support-channel-update-for.html #Google #cybersecurity #infosec #Chrome

Yet another perfect 10 from Cisco!

The vulnerability was added via an update to the security bulletin for CVE-2025-20281 and CVE-2025-20282, two similar RCE vulnerabilities that also received the maximum severity score, that impact ISE and ISE-PIC versions 3.4 and 3.3.

https://www.bleepingcomputer.com/news/security/max-severity-cisco-ise-bug-allows-pre-auth-command-execution-patch-now/

Cisco posted five vulnerability updates yesterday:

- Critical, affects CVE-2025-20281; CVE-2025-20282; and CVE-2025-20337 Cisco Identity Services Engine Unauthenticated Remote Code Execution Vulnerabilities https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6

- High, CVE-2025-20274: Cisco Unified Intelligence Center Arbitrary File Upload Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuis-file-upload-UhNEtStm

- Medium, CVE-2025-20272: Cisco Prime Infrastructure and Evolved Programmable Network Manager Blind SQL Injection Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-piepnm-bsi-25JJqsbb

- CVE-2025-20283; CVE-2025-20284; and CVE-2025-20285: Cisco Identity Services Engine Authenticated Remote Code Execution and Authorization Bypass Vulnerabilities https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-3VpsXOxO

- CVE-2025-20288: Cisco Unified Intelligence Center Server-Side Request Forgery Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuis-ssrf-JSuDjeV @TalosSecurity #cybersecurity #Infosec #Cisco

Tracked as CVE-2025-20337, the shortcoming carries a CVSS score of 10.0 and is similar to CVE-2025-20281, which was patched by the networking equipment major late last month. https://thehackernews.com/2025/07/cisco-warns-of-critical-ise-flaw.html

Yet another perfect 10 from Cisco!

The vulnerability was added via an update to the security bulletin for CVE-2025-20281 and CVE-2025-20282, two similar RCE vulnerabilities that also received the maximum severity score, that impact ISE and ISE-PIC versions 3.4 and 3.3.

https://www.bleepingcomputer.com/news/security/max-severity-cisco-ise-bug-allows-pre-auth-command-execution-patch-now/

Cisco posted five vulnerability updates yesterday:

- Critical, affects CVE-2025-20281; CVE-2025-20282; and CVE-2025-20337 Cisco Identity Services Engine Unauthenticated Remote Code Execution Vulnerabilities https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6

- High, CVE-2025-20274: Cisco Unified Intelligence Center Arbitrary File Upload Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuis-file-upload-UhNEtStm

- Medium, CVE-2025-20272: Cisco Prime Infrastructure and Evolved Programmable Network Manager Blind SQL Injection Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-piepnm-bsi-25JJqsbb

- CVE-2025-20283; CVE-2025-20284; and CVE-2025-20285: Cisco Identity Services Engine Authenticated Remote Code Execution and Authorization Bypass Vulnerabilities https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-3VpsXOxO

- CVE-2025-20288: Cisco Unified Intelligence Center Server-Side Request Forgery Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuis-ssrf-JSuDjeV @TalosSecurity #cybersecurity #Infosec #Cisco

Am I reading this right in that it took PAN a year and a half to determine that PAN-OS 10.1 is impacted by Terrapin?

https://security.paloaltonetworks.com/CVE-2023-48795

🔥 CVE-2025-49132 (Pterodactyl Panel RCE) (10/10 RCE)

Active exploitation observed within days of disclosure.

https://viz.greynoise.io/tags/pterodactyl-panel-remote-code-execution-cve-2025-49132-attempt?days=10
2/4

🫖 & #threatintel - noticing a few other spikes orgs should be mindful of:
🔥 CVE-2025-49132 (Pterodactyl Panel RCE) (10/10 RCE)
⚡ CVE-2024-20439 (Cisco Smart Licensing Utility) (9.8/10, KEV)
📝 CVE-2017-18370 (Zyxel P660HN)
1/4

New. AMD security advisories:

- TPM Reference Implementation - CVE-2025-2884 https://www.amd.com/en/resources/product-security/bulletin/amd-sb-4011.html

- Uninitialized GPU Register Access - CVE-2024-21969 https://www.amd.com/en/resources/product-security/bulletin/amd-sb-6013.html

- GPU Memory Leaks - CVE-2023-4969 https://www.amd.com/en/resources/product-security/bulletin/amd-sb-6010.html #AMD #cybersecurity #infosec

New. AMD security advisories:

- TPM Reference Implementation - CVE-2025-2884 https://www.amd.com/en/resources/product-security/bulletin/amd-sb-4011.html

- Uninitialized GPU Register Access - CVE-2024-21969 https://www.amd.com/en/resources/product-security/bulletin/amd-sb-6013.html

- GPU Memory Leaks - CVE-2023-4969 https://www.amd.com/en/resources/product-security/bulletin/amd-sb-6010.html #AMD #cybersecurity #infosec

Google posted this yesterday. It affects critical CVE-2025-6192 and CVE-2025-5068, CVE-2025-5281, CVE-2025-6554.

Long Term Support Channel Update for ChromeOS https://chromereleases.googleblog.com/2025/07/long-term-support-channel-update-for.html #Google #cybersecurity #infosec #Chrome

New. AMD security advisories:

- TPM Reference Implementation - CVE-2025-2884 https://www.amd.com/en/resources/product-security/bulletin/amd-sb-4011.html

- Uninitialized GPU Register Access - CVE-2024-21969 https://www.amd.com/en/resources/product-security/bulletin/amd-sb-6013.html

- GPU Memory Leaks - CVE-2023-4969 https://www.amd.com/en/resources/product-security/bulletin/amd-sb-6010.html #AMD #cybersecurity #infosec

New. AMD security advisories:

- TPM Reference Implementation - CVE-2025-2884 https://www.amd.com/en/resources/product-security/bulletin/amd-sb-4011.html

- Uninitialized GPU Register Access - CVE-2024-21969 https://www.amd.com/en/resources/product-security/bulletin/amd-sb-6013.html

- GPU Memory Leaks - CVE-2023-4969 https://www.amd.com/en/resources/product-security/bulletin/amd-sb-6010.html #AMD #cybersecurity #infosec

Remote code execution flaw reported in Kafbat UI

A vulnerability in Kafbat UI version 1.0.0 (CVE-2025-49127) allows unauthenticated attackers to execute arbitrary code by exploiting the dynamic cluster configuration feature that fails to properly validate user-provided JMX endpoints. Organizations should immediately upgrade to version 1.1.0 or disable the dynamic configuration feature by setting DYNAMIC_CONFIG_ENABLED: 'false' to prevent exploitation through malicious HTTP PUT requests to the /api/config endpoint.

**If you're using Kafbat UI version 1.0.0, be aware that there's an attack vector that allows attackers to execute code without authentication. Isolate the API endpoints to only be accesible from trusted networks and communicate only with known servers. Disable the dynamic configuration feature by setting DYNAMIC_CONFIG_ENABLED: 'false' in your application configuration and then plan a patch.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/remote-code-execution-flaw-reported-in-kafbat-ui-p-3-3-y-l/gD2P6Ple2L

Google posted this yesterday. It affects critical CVE-2025-6192 and CVE-2025-5068, CVE-2025-5281, CVE-2025-6554.

Long Term Support Channel Update for ChromeOS https://chromereleases.googleblog.com/2025/07/long-term-support-channel-update-for.html #Google #cybersecurity #infosec #Chrome

Multiple vulnerabilities reported in Hitachi Energy Asset Suite, at least one critical

Hitachi Energy has disclosed multiple vulnerabilities in its Asset Suite platform affecting critical energy infrastructure, including a critical plaintext password storage flaw (CVE-2025-2500) that could enable unauthorized access and system compromise.

**If you're using Hitachi Energy Asset Suite, make sure the systems are isolated from the internet and used only for the dedicated purpose (no web browsing, email, or instant messaging.). Then contact the vendor for patches.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/multiple-vulnerabilities-reported-in-hitachi-energy-asset-suite-at-least-one-critical-u-e-h-o-t/gD2P6Ple2L

Signal Clone App Under Attack: TeleMessage SGNL Vulnerability Exposes Sensitive Data in Massive Cybersecurity Breach

Hidden Dangers in Secure Messaging: The TeleMessage SGNL Vulnerability Unmasked In a world increasingly reliant on encrypted messaging, the discovery of a serious vulnerability in TeleMessage SGNL — a clone of the widely used Signal platform — is raising alarms across the cybersecurity landscape. Known officially as CVE-2025-48927, this flaw allows…

https://undercodenews.com/signal-clone-app-under-attack-telemessage-sgnl-vulnerability-exposes-sensitive-data-in-massive-cybersecurity-breach/

Hackers scanning for TeleMessage Signal clone flaw exposing passwords

Researchers are seeing exploitation attempts for the CVE-2025-48927 vulnerability in the TeleMessage SGNL app, which allows retrieving usernames,...

🔗️ [Bleepingcomputer] https://link.is.it/p3UBhM

Hackers scanning for TeleMessage Signal clone flaw exposing passwords

Researchers are seeing exploitation attempts for the CVE-2025-48927 vulnerability in the TeleMessage SGNL app, which allows retrieving usernames,...

🔗️ [Bleepingcomputer] https://link.is.it/p3UBhM

Google posted this yesterday. It affects critical CVE-2025-6192 and CVE-2025-5068, CVE-2025-5281, CVE-2025-6554.

Long Term Support Channel Update for ChromeOS https://chromereleases.googleblog.com/2025/07/long-term-support-channel-update-for.html #Google #cybersecurity #infosec #Chrome

"Convergence" around SAP NetWeaver vulnerabilities as entry specifically CVE-2025-31324 sometimes chained with CVE-2025-42999.

2025-07-14: (kudelskisecurity.com) SAP NetWeaver Visual Composer Zero-Day Exploitation: Infrastructure Analysis and Ransomware Attribution

Reference: https://research.kudelskisecurity.com/2025/07/14/adversary-infrastructure-and-indicators-behind-the-sap-netweaver-0-day-exploitation/

2025-06-16: (darktrace.com) Critical SAP NetWeaver Zero-Day Exploitation: Comprehensive Analysis of CVE-2025-31324 Attacks and Detection Strategies

Reference: https://www.darktrace.com/blog/tracking-cve-2025-31324-darktraces-detection-of-sap-netweaver-exploitation-before-and-after-disclosure

2025-06-13: (cyfirma.com) Ransomware Landscape Evolution: Advanced Evasion Techniques and Emerging Threat Groups Drive Global Attack Surge

Reference: https://www.cyfirma.com/research/tracking-ransomware-may-2025/

2025-05-27: (trendmicro.com) Earth Lamia APT Group Deploys Custom PULSEPACK Backdoor in Multi-Industry Campaign Targeting Brazil, India, and Southeast Asia

Reference: https://www.trendmicro.com/en_us/research/25/e/earth-lamia.html

#ThreatIntel #Cybersecurity #Infosec

Ivanti VPNs Under Siege: Cobalt Strike, Vshell RAT and a New Sophisticated Attacks

A Rising Wave of Silent Infiltrations An alarming new cyber threat campaign is sweeping across enterprise networks, using unpatched Ivanti Connect Secure VPN appliances as the primary gateway. Security experts are sounding the alarm over the active exploitation of two recently disclosed vulnerabilities — CVE-2025-0282 and CVE-2025-22457 — which are enabling attackers to infiltrate…

https://undercodenews.com/ivanti-vpns-under-siege-cobalt-strike-vshell-rat-and-a-new-sophisticated-attacks/

JPCERT/CC's 増渕 維摩 (Yuma Masubuchi) looks into malware identified in attacks exploiting Ivanti Connect Secure vulnerabilities CVE-2025-0282 and CVE-2025-22457 from December 2024 to the present. https://blogs.jpcert.or.jp/en/2025/07/ivanti_cs.html

JPCERT/CC's 増渕 維摩 (Yuma Masubuchi) looks into malware identified in attacks exploiting Ivanti Connect Secure vulnerabilities CVE-2025-0282 and CVE-2025-22457 from December 2024 to the present. https://blogs.jpcert.or.jp/en/2025/07/ivanti_cs.html

"Convergence" around SAP NetWeaver vulnerabilities as entry specifically CVE-2025-31324 sometimes chained with CVE-2025-42999.

2025-07-14: (kudelskisecurity.com) SAP NetWeaver Visual Composer Zero-Day Exploitation: Infrastructure Analysis and Ransomware Attribution

Reference: https://research.kudelskisecurity.com/2025/07/14/adversary-infrastructure-and-indicators-behind-the-sap-netweaver-0-day-exploitation/

2025-06-16: (darktrace.com) Critical SAP NetWeaver Zero-Day Exploitation: Comprehensive Analysis of CVE-2025-31324 Attacks and Detection Strategies

Reference: https://www.darktrace.com/blog/tracking-cve-2025-31324-darktraces-detection-of-sap-netweaver-exploitation-before-and-after-disclosure

2025-06-13: (cyfirma.com) Ransomware Landscape Evolution: Advanced Evasion Techniques and Emerging Threat Groups Drive Global Attack Surge

Reference: https://www.cyfirma.com/research/tracking-ransomware-may-2025/

2025-05-27: (trendmicro.com) Earth Lamia APT Group Deploys Custom PULSEPACK Backdoor in Multi-Industry Campaign Targeting Brazil, India, and Southeast Asia

Reference: https://www.trendmicro.com/en_us/research/25/e/earth-lamia.html

#ThreatIntel #Cybersecurity #Infosec

Unverified exploit for that Wazuh RCE vuln in February: CVE-2025-24016

https://attackerkb.com/topics/piW0q4r5Uy/cve-2025-24016

@mimir

* 0x20000000 = start of RAM on most ARM MCUs
* 0xbfc00000 = MIPS reset vector
* 0x00007fffffffffff = last valid address in amd64 (see CVE-2012-0217 et al)
* 0x00 = indirect memory addressing register on 8-bit PIC (not null)
* 0x41414141 = no explanation needed

[CVE-2025-32461] Tiki Wiki CMS Groupware <= 28.3 Two SSTI Vulnerabilities https://karmainsecurity.com/KIS-2025-03

CVE-2024-4577: payload analysis

As I mentioned in a previous post, I’ve started using the data collected by our honeypot to analyze some exploitation attempts, and a few days ago,...

🔗️ [Roccosicilia] https://link.is.it/kqWMt9

NoBooze1 Malware Targets TP-Link Routers via CVE-2019-9082 https://www.f5.com/labs/articles/threat-intelligence/nobooze1-malware-targets-tp-link-routers-via-cve-2019-9082

Ivanti VPNs Under Siege: Cobalt Strike, Vshell RAT and a New Sophisticated Attacks

A Rising Wave of Silent Infiltrations An alarming new cyber threat campaign is sweeping across enterprise networks, using unpatched Ivanti Connect Secure VPN appliances as the primary gateway. Security experts are sounding the alarm over the active exploitation of two recently disclosed vulnerabilities — CVE-2025-0282 and CVE-2025-22457 — which are enabling attackers to infiltrate…

https://undercodenews.com/ivanti-vpns-under-siege-cobalt-strike-vshell-rat-and-a-new-sophisticated-attacks/

JPCERT/CC's 増渕 維摩 (Yuma Masubuchi) looks into malware identified in attacks exploiting Ivanti Connect Secure vulnerabilities CVE-2025-0282 and CVE-2025-22457 from December 2024 to the present. https://blogs.jpcert.or.jp/en/2025/07/ivanti_cs.html

JPCERT/CC's 増渕 維摩 (Yuma Masubuchi) looks into malware identified in attacks exploiting Ivanti Connect Secure vulnerabilities CVE-2025-0282 and CVE-2025-22457 from December 2024 to the present. https://blogs.jpcert.or.jp/en/2025/07/ivanti_cs.html

Fortinet Outbreak Alert: TBK DVRs Botnet Attack (High-severity, exploiting CVE-2024-3721): https://fortiguard.fortinet.com/outbreak-alert/tbk-dvrs-botnet-attack @fortinet #cybersecurity #infosec #IoT

From yesterday: SimpleHelp Support Software Attack (high-severity, exploiting CVE-2024-57727) https://fortiguard.fortinet.com/outbreak-alert/simplehelp-ransomware-attack

⚡ CVE-2024-20439 (Cisco Smart Licensing Utility) (9.8/10, KEV)

Hardcoded credentials have been known since late last year.

https://viz.greynoise.io/tags/cisco-smart-licensing-cve-2024-20439-hardcoded-credentials-attempt?days=30
3/4

🫖 & #threatintel - noticing a few other spikes orgs should be mindful of:
🔥 CVE-2025-49132 (Pterodactyl Panel RCE) (10/10 RCE)
⚡ CVE-2024-20439 (Cisco Smart Licensing Utility) (9.8/10, KEV)
📝 CVE-2017-18370 (Zyxel P660HN)
1/4

Go hack the robots!

https://www.ros.org/blog/noetic-eol/

After May 31st, 2025 ROS 1 Noetic users may find themselves exposed to un-patched security vulnerabilities and bugs, with few avenues of support short of fixing these issues themselves and recompiling Noetic from source.

https://www.cve.org/CVERecord?id=CVE-2024-39289

https://www.cve.org/CVERecord?id=CVE-2024-39385

https://www.cve.org/CVERecord?id=CVE-2024-41148

https://www.cve.org/CVERecord?id=CVE-2024-41921

Edit to add a couple more.

https://www.cve.org/CVERecord?id=CVE-2025-23266

https://www.cve.org/CVERecord?id=CVE-2025-3753

🚨🇧🇪Alleged Admin Access Sale to Belgian IT Company's Zabbix Monitoring Panel

A threat actor is selling admin access to a Zabbix monitoring system allegedly belonging to a Belgium-based IT company with $7M revenue.

Details of the Access:

- Platform: Zabbix
- Version: 3.0.32
- Hosts Monitored: 63
- Items Tracked: 5,034
- Triggers: 2,646
- User Accounts:
- Groups: 16

CVE Exposure: CVE-2024-22122, CVE-2024-22120 (These are critical Zabbix vulnerabilities exploited for initial access)

What’s Included?
Full Admin Access to the monitoring infrastructure

Price: 300$