Threats Affecting Hungary

A threat actor exploited CVE-2026-15409, a critical unauthenticated server-side request forgery vulnerability in SonicWall SMA1000 appliances, to gain command execution and steal credentials. The attacker used a modified public proof-of-concept exploit to access internal Erlang services on the appliance, enabling remote code execution. This allowed extraction of LDAP configurations, Active Directory credentials, and deployment of tools to dump secrets from internal Windows systems. The campaign targeted at least 250 SonicWall SMA1000 devices across multiple countries and sectors, with confirmed credential theft in France, India, Italy, and the US. The attack leveraged compromised appliances as pivots into internal networks, exposing sensitive Active Directory data and enabling DCSync attacks against domain controllers. The targeting was opportunistic and technology-driven rather than sector-specific. The campaign was uncovered through an open directory left exposed by the attacker, providing a comprehensive view of the operation.

MediumCampaignFranceIndiaItaly+9#threatintelligence+threatintel+websecurityresearch#reddit#campaign

This report highlights a cyber espionage campaign attributed to the Iranian APT group Charming Kitten, targeting eight countries and eight critical sectors simultaneously. The campaign, dubbed Operation Olalampo, affects Egypt, Saudi Arabia, UAE, Turkey, Hungary, Turkmenistan, Israel, and South America, focusing on government, healthcare, financial services, energy, education, telecommunications, defense, and industrial sectors. The information is sourced from a Reddit post linking to a GitHub repository simulating adversary tactics. No specific vulnerabilities or exploits are detailed, and no affected software versions are identified.

CriticalCampaignEgyptSaudi ArabiaUnited Arab Emirates+4#blueteamsec+asknetsec+information_security#reddit#high-priority

Improper Restriction of XML External Entity Reference vulnerability in XMLUtils.java in Slovensko.Digital Autogram allows remote unauthenticated attacker to conduct SSRF (Server Side Request Forgery) attacks and obtain unauthorized access to local files on filesystems running the vulnerable application. Successful exploitation requires the victim to visit a specially crafted website that sends request containing a specially crafted XML document to /sign endpoint of the local HTTP server run by the application.

HighVulnerabilitySlovakiaCzechiaAustria+6#cve#cve-2026-3511#cwe-611

Incorrect Access Control via missing 2FA rate-limiting allowing unlimited brute-force retries and full MFA bypass with no user interaction required. Affected Product: Deutsche Telekom AG Telekom Account Management Portal, versions before 2025-10-24, fixed 2025-11-03.

CriticalVulnerabilityGermanyAustriaSwitzerland+7#cve#cve-2025-69615

CVE-2025-69614 is a critical vulnerability in the Deutsche Telekom AG Telekom Account Management Portal that allows unauthorized password resets via activation token reuse. This incorrect access control flaw enables attackers to bypass authentication and fully take over user accounts without any user interaction. The vulnerability affects versions prior to 2025-10-27 and was fixed on 2025-10-31. Exploitation requires no privileges and can be performed remotely over the network. The flaw stems from improper handling of password reset tokens, classified under CWE-640. Although no known exploits are currently observed in the wild, the high CVSS score of 9.4 indicates severe risk. Organizations using this portal must urgently apply the patch to prevent account compromise and potential downstream impacts on confidentiality and integrity.

CriticalVulnerabilityGermanyAustriaSwitzerland+7#cve#cve-2025-69614

Charging station authentication identifiers are publicly accessible via web-based mapping platforms.

MediumVulnerabilityHungaryGermanyAustria+7#cve#cve-2026-27777#cwe-522

Multiple Finka programs use hard-coded Firebird database credentials (shared across all instances of this software). A malicious attacker in local network who knows default credentials is able to read and edit database content. This vulnerability has been fixed in version: Finka-FK 18.5, Finka-KPR 16.6, Finka-Płace 13.4, Finka-Faktura 18.3, Finka-Magazyn 8.3, Finka-STW 12.3

HighVulnerabilityPolandGermanyCzechia+5#cve#cve-2025-13776#cwe-798

UAT-7290, a sophisticated threat actor active since 2022, is targeting critical infrastructure entities in South Asia, particularly telecommunications providers. The group's arsenal includes malware families like RushDrop, DriveSwitch, SilentRaid, and Bulbature. UAT-7290 conducts extensive reconnaissance before intrusions, using one-day exploits and SSH brute force to compromise edge devices. The actor is believed to be a China-nexus APT, sharing similarities with APT10 and other known Chinese threat groups. UAT-7290 has recently expanded its targeting to Southeastern Europe and may establish Operational Relay Boxes for other China-nexus actors. Their malware suite primarily focuses on Linux systems but can also utilize Windows-based implants.

MediumMalwareGreeceBulgariaRomania+4#driveswitch#china-nexus#espionage

Asseco InfoMedica is a comprehensive solution used to manage both administrative and medical tasks in the healthcare sector. Passwords of all users are stored in a database in an encoded format. An attacker in possession of these encoded passwords is able to decode them by using an algorithm embedded in the client-side part of the software.  This vulnerability has been fixed in versions 4.50.1 and 5.38.0

MediumVulnerabilityPolandCzechiaSlovakia+3#cve#cve-2025-8307#cwe-257

Asseco InfoMedica is a comprehensive solution used to manage both administrative and medical tasks in the healthcare sector. A low privileged user is able to obtain encoded passwords of all other accounts (including main administrator) due to lack of granularity in access control.  Chained exploitation of this vulnerability and CVE-2025-8307 allows an attacker to escalate privileges. This vulnerability has been fixed in versions 4.50.1 and 5.38.0

MediumVulnerabilityPolandGermanyCzechia+2#cve#cve-2025-8306#cwe-1220