Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Medtronic MyCareLink Patient Monitor has an internal service that deserializes data, which allows a local attacker to interact with the service by crafting a binary payload to crash the service or elevate privileges. 

This issue affects MyCareLink Patient Monitor models 24950 and 24952: before June 25, 2025

CVE-2025-4393 is a vulnerability identified in Medtronic's MyCareLink Patient Monitor models 24950 and 24952, specifically affecting versions released before June 25, 2025. The vulnerability arises from improper handling of deserialization of untrusted data within an internal service of the device. Deserialization is the process of converting binary or serialized data back into an object or data structure. When untrusted data is deserialized without proper validation or sanitization, it can lead to severe security issues such as remote code execution, privilege escalation, or denial of service. In this case, a local attacker with access to the device can craft a malicious binary payload that, when processed by the vulnerable deserialization service, can cause the service to crash or allow the attacker to elevate their privileges on the device. The CVSS v3.1 base score is 6.5, indicating a medium severity level. The vector string (AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H) shows that the attack requires local access (AV:L), high attack complexity (AC:H), low privileges (PR:L), no user interaction (UI:N), unchanged scope (S:U), low confidentiality impact (C:L), high integrity impact (I:H), and high availability impact (A:H). This means that while the attacker needs local access and some skill, the consequences can be significant, including potential compromise of data integrity and availability of the patient monitoring device. No known exploits are currently reported in the wild, and no patches are listed yet, indicating that mitigation may rely on vendor updates or operational controls. The vulnerability is categorized under CWE-502, which is a common weakness related to unsafe deserialization practices.

Detailed information about CVE-2025-4393: CWE-502 Deserialization of Untrusted Data in Medtronic MyCareLink Patient Monitor 24950 affecting Medtronic MyCareLink

CVE-2025-4393: CWE-502 Deserialization of Untrusted Data in Medtronic MyCareLink Patient Monitor 24950 - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-4393: CWE-502 Deserialization of Untrusted Data in Medtronic MyCareLink Patient Monitor 24950

Two cyberattack campaigns, Operation GhostChat and Operation PhantomPrayers, targeted the Tibetan community in June 2025, coinciding with the Dalai Lama's 90th birthday. These attacks involved strategic web compromises, DLL sideloading, and multi-stage infection chains to deploy Ghost RAT and PhantomNet backdoors. The attackers used social engineering tactics, impersonating legitimate platforms and leveraging culturally significant events to lure victims. Both campaigns employed sophisticated evasion techniques, including code injection and API hook bypassing. The attacks are attributed to China-nexus APT groups based on victimology, malware used, and employed tactics. The campaigns highlight the ongoing cyber threats faced by the Tibetan community and the evolving tactics of state-sponsored threat actors.

The threat known as "Illusory Wishes" involves two coordinated cyberattack campaigns, Operation GhostChat and Operation PhantomPrayers, targeting the Tibetan community in June 2025, coinciding with the Dalai Lama's 90th birthday. These campaigns are attributed to China-nexus Advanced Persistent Threat (APT) groups, based on the victimology, malware families used, and the tactics, techniques, and procedures (TTPs) observed. The attackers employed strategic web compromises to initially lure victims, leveraging social engineering techniques that impersonated legitimate platforms and exploited culturally significant events to increase the likelihood of user interaction and infection. The attacks utilized multi-stage infection chains, starting with web compromises leading to DLL sideloading—a technique where malicious DLLs are loaded by legitimate applications to evade detection. The deployed malware includes Ghost RAT and PhantomNet backdoors, both sophisticated tools enabling persistent remote access, data exfiltration, and further lateral movement within victim environments. The campaigns demonstrated advanced evasion techniques such as code injection and API hook bypassing to avoid detection by security solutions. The attack techniques align with multiple MITRE ATT&CK tactics and techniques, including T1113 (screen capture), T1033 (system owner/user discovery), T1056.001 (keylogging), T1123 (audio capture), T1204.002 (malicious file execution), T1573.001 (encrypted channel), T1574.001 (DLL side-loading), and others, indicating a comprehensive and stealthy approach to compromise and maintain persistence. These campaigns underscore the ongoing cyber threats faced by politically sensitive communities and the evolving capabilities of state-sponsored threat actors to conduct targeted espionage and surveillance operations.

Detailed information about Illusory Wishes: China-nexus APT Targets the Tibetan Community. Get real-time updates, technical details, and mitigation strategies.

Illusory Wishes: China-nexus APT Targets the Tibetan Community - Live Threat Intelligence - Threat Radar | OffSeq.com

Illusory Wishes: China-nexus APT Targets the Tibetan Community

An attacker spoofing answers to ECS enabled requests sent out by the Recursor has a chance of success higher than non-ECS enabled queries.

The updated version include various mitigations against spoofing attempts of ECS enabled queries by chaining ECS enabled requests and enforcing stricter validation of the received answers.

The most strict mitigation done when the new setting outgoing.edns_subnet_harden (old style name edns-subnet-harden) is enabled.

CVE-2025-30192 is a high-severity vulnerability affecting the PowerDNS Recursor, a widely used DNS resolver software. The vulnerability stems from insufficient verification of data authenticity (CWE-345) specifically related to EDNS Client Subnet (ECS) enabled queries. ECS is a DNS extension that allows recursive resolvers to include part of the client's IP address in queries to authoritative servers, enabling geographically optimized responses. However, this feature also introduces complexity and potential attack vectors. In this case, an attacker can spoof DNS answers to ECS-enabled requests with a higher success probability than for non-ECS queries. This spoofing could lead to denial of service or manipulation of DNS responses, impacting availability. The vulnerability does not affect confidentiality or integrity directly but can cause significant disruption by providing incorrect DNS responses or causing service outages. The PowerDNS team has introduced mitigations in updated versions, including chaining ECS-enabled requests and enforcing stricter validation of received answers. The most stringent mitigation is available via the configuration setting outgoing.edns_subnet_harden (previously edns-subnet-harden), which hardens the validation process for ECS queries, reducing the risk of spoofing. The CVSS 3.1 score is 7.5 (high), reflecting the network attack vector, low attack complexity, no privileges or user interaction required, and an impact limited to availability. No known exploits are currently reported in the wild, but the vulnerability's nature and severity warrant prompt attention.

Detailed information about CVE-2025-30192: CWE-345 Insufficient Verification of Data Authenticity in PowerDNS Recursor affecting PowerDNS Recursor. Get real-tim

CVE-2025-30192: CWE-345 Insufficient Verification of Data Authenticity in PowerDNS Recursor - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-30192: CWE-345 Insufficient Verification of Data Authenticity in PowerDNS Recursor

An issue was discovered in Westermo WeOS 5 (5.24 through 5.24.4). A threat actor potentially can gain unauthorized access to sensitive information via system logging information (syslog verbose logging that includes credentials).

CVE-2025-54319 is a vulnerability identified in Westermo WeOS version 5.24.0, specifically related to CWE-532, which concerns the insertion of sensitive information into log files. Westermo WeOS is an operating system used primarily in industrial networking equipment such as routers and switches. The vulnerability arises from verbose syslog logging configurations that inadvertently include sensitive credentials in the logs. This means that when syslog verbose mode is enabled, authentication credentials or other sensitive information may be recorded in plaintext within log files. An attacker who gains access to these log files could extract these credentials, potentially leading to unauthorized access to the device or network. The CVSS v3.1 score is 6.3 (medium severity), reflecting a network attack vector (AV:N), high attack complexity (AC:H), low privileges required (PR:L), no user interaction (UI:N), and a scope change (S:C). The impact is primarily on confidentiality (C:H), with no direct impact on integrity or availability. There are no known exploits in the wild as of the publication date, and no patches have been linked yet. This vulnerability is significant because industrial network devices often serve as critical infrastructure components, and exposure of credentials can facilitate lateral movement or deeper network compromise. The vulnerability requires an attacker to have network access and some level of privileges but does not require user interaction, making it a plausible risk in environments where logging verbosity is enabled for troubleshooting or monitoring purposes.

Detailed information about CVE-2025-54319: CWE-532 Insertion of Sensitive Information into Log File in Westermo WeOS affecting Westermo WeOS. Get real-time upda

CVE-2025-54319: CWE-532 Insertion of Sensitive Information into Log File in Westermo WeOS - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-54319: CWE-532 Insertion of Sensitive Information into Log File in Westermo WeOS

Inside the ChatGPT iOS app, I’m using the built-in code interpreter. Every time I ask it to scan for open ports, it shows port 8080 bound to 0.0.0.0, not localhost, like it used to. Happens across sessions, even after restarting the phone and turning off the local network feature in app settings. 

Same PID (3), same process (python3). Also seeing two private IPs (10.x.x.x) and localhost loopbacks, about 18 of them. As well as access to internal libraries, A LOT of them. 

Looks like something is preloaded inside the interpreter container. Anyone know what this is? 

As I’m writing this, apparently the localhost connection to 8080 is weirder than 0.0.0.0. 
I’m clearly clueless, but I noticed a weird change and decided to share. 

The reported security observation concerns the behavior of the built-in code interpreter feature within the ChatGPT iOS application. A user on the Reddit NetSec forum noted that when scanning for open ports from inside the code interpreter environment, port 8080 is bound to 0.0.0.0 rather than localhost (127.0.0.1) as previously expected. This means the port is listening on all network interfaces rather than just the loopback interface. The process owning this port is identified as python3 with PID 3, consistent across sessions and device restarts, indicating a persistent internal service or containerized environment preloaded within the interpreter. Additionally, multiple private IP addresses (10.x.x.x) and localhost loopback addresses are visible, along with access to numerous internal libraries. The user suspects that some internal service or containerized environment is preloaded and exposing this port. The observation that the localhost connection to port 8080 behaves differently than 0.0.0.0 suggests potential network namespace or container networking peculiarities. There is no indication of active exploitation or known vulnerabilities associated with this behavior, and the discussion level is minimal. The report is primarily an informational note about an unexpected network binding behavior inside the ChatGPT iOS app's code interpreter environment, which could have implications if the exposed port is accessible beyond the local device or if it exposes sensitive services internally. However, no direct evidence of a security vulnerability or exploit is provided.

Detailed information about Code Interpreter Open Ports. Get real-time updates, technical details, and mitigation strategies.

Code Interpreter Open Ports - Live Threat Intelligence - Threat Radar | OffSeq.com

Code Interpreter Open Ports

Reddit Discussion: Code Interpreter Open Ports

Chinese Salt Typhoon Infiltrated US National Guard Network for Months

Source: https://hackread.com/chinese-salt-typhoon-infiltrated-us-national-guard-network/

The reported threat involves a cyber espionage campaign attributed to a Chinese threat actor group known as Salt Typhoon, which successfully infiltrated the US National Guard network for an extended period. Salt Typhoon is recognized for conducting sophisticated cyber intrusions targeting government and military networks to gather intelligence and potentially disrupt operations. The intrusion reportedly persisted for months, indicating a high level of stealth and persistence within the victim network. Although specific technical details such as attack vectors, exploited vulnerabilities, or malware used have not been disclosed, the prolonged presence suggests the attackers employed advanced tactics such as lateral movement, privilege escalation, and possibly custom malware or living-off-the-land techniques to avoid detection. The compromise of a critical military reserve force's network raises concerns about the confidentiality and integrity of sensitive defense-related information and the potential for operational disruption. The lack of disclosed indicators of compromise (IOCs) and absence of known exploits in the wild limits the ability to fully characterize the attack methodology. However, the incident underscores the ongoing threat posed by state-sponsored actors targeting military and governmental infrastructure with sophisticated, persistent cyber espionage campaigns.

Detailed information about Chinese Salt Typhoon Infiltrated US National Guard Network for Months. Get real-time updates, technical details, and mitigation strat

Chinese Salt Typhoon Infiltrated US National Guard Network for Months - Live Threat Intelligence - Threat Radar | OffSeq.com

Chinese Salt Typhoon Infiltrated US National Guard Network for Months

Reddit Discussion: Chinese Salt Typhoon Infiltrated US National Guard Network for Months

An authenticated command injection vulnerability exists in OP5 Monitor through version 7.1.9 via the 'cmd_str' parameter in the command_test.php endpoint. A user with access to the web interface can exploit the 'Test this command' feature to execute arbitrary shell commands as the unprivileged web application user. The vulnerability resides in the configuration section of the application and requires valid login credentials with access to the command testing functionality. This issue is fixed in version 7.2.0.

CVE-2025-34115 is a high-severity authenticated OS command injection vulnerability affecting ITRS Group's OP5 Monitor software versions up to 7.1.9. The flaw exists in the 'cmd_str' parameter of the command_test.php endpoint, specifically within the 'Test this command' feature accessible via the web interface. An authenticated user with valid credentials and access to this functionality can inject arbitrary shell commands that execute with the privileges of the unprivileged web application user. This vulnerability stems from improper neutralization of special elements in OS commands (CWE-78), insufficient authentication controls (CWE-306), and inadequate input validation (CWE-20). Exploitation does not require elevated privileges beyond valid login and does not require user interaction beyond the attacker’s own actions. The vulnerability resides in the configuration section of the application, making it a critical risk for administrators and operators who have access to the web interface. The issue is resolved in OP5 Monitor version 7.2.0. The CVSS v4.0 base score is 8.7, reflecting a high impact on confidentiality, integrity, and availability with low attack complexity and no user interaction needed. Although no known exploits are currently reported in the wild, the vulnerability’s characteristics make it a prime candidate for exploitation by insiders or attackers who have obtained valid credentials. The vulnerability could allow attackers to execute arbitrary commands, potentially leading to data exfiltration, lateral movement, or disruption of monitoring services.

Detailed information about CVE-2025-34115: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in ITRS Group OP5 M

CVE-2025-34115: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in ITRS Group OP5 Monitor - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-34115: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in ITRS Group OP5 Monitor

Emerson ValveLink products 
use a fixed or controlled search path to find resources, but one or 
more locations in that path can be under the control of unintended 
actors.

CVE-2025-48496 is a medium-severity vulnerability classified under CWE-427, which relates to the use of an uncontrolled search path in Emerson's ValveLink SOLO product. ValveLink SOLO is a specialized industrial control system (ICS) software used for valve diagnostics and management, typically deployed in critical infrastructure sectors such as oil and gas, chemical processing, and utilities. The vulnerability arises because the software uses a fixed or controlled search path to locate resources, but one or more locations within this path can be influenced or controlled by unauthorized actors. This can lead to a scenario where malicious files or libraries placed in these locations are loaded by the application instead of legitimate ones, potentially causing denial of service or other disruptions. The CVSS v3.1 score of 5.1 reflects a medium severity, with the vector indicating that the attack requires local access (AV:L), high attack complexity (AC:H), no privileges (PR:N), and no user interaction (UI:N). The impact is limited to availability (A:H), with no confidentiality or integrity impact reported. No known exploits are currently in the wild, and no patches have been released yet. The vulnerability is particularly relevant to ICS environments where ValveLink SOLO is used, as exploitation could disrupt valve operations, leading to process interruptions or safety risks.

Detailed information about CVE-2025-48496: CWE-427 in Emerson ValveLink SOLO affecting Emerson ValveLink SOLO. Get real-time updates, technical details, and mit

CVE-2025-48496: CWE-427 in Emerson ValveLink SOLO - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-48496: CWE-427 in Emerson ValveLink SOLO

The AXIS Camera Station Server had a flaw that allowed
to bypass authentication that is normally required.

CVE-2025-30026 is a medium-severity vulnerability identified in Axis Communications AB's AXIS Camera Station Pro software versions prior to 6.9. The vulnerability is classified under CWE-288, which pertains to authentication bypass using an alternate path or channel. Specifically, this flaw allows an attacker to circumvent the authentication mechanisms that are normally required to access the AXIS Camera Station Server. The CVSS 4.0 base score is 5.3, reflecting a medium impact level. The vector string indicates that the attack requires adjacent network access (AV:A), has low attack complexity (AC:L), does not require authentication (PR:N), no user interaction (UI:N), and does not affect confidentiality, integrity, or availability directly (VC:N/VI:N/VA:N). However, the scope is limited (S:U), and the impact is limited to a low level (SI:L/SA:L), suggesting that the attacker can gain some level of unauthorized access or functionality but without full system compromise or data breach. The vulnerability arises because the software improperly handles authentication checks, allowing an attacker to exploit an alternate communication path or channel to bypass login requirements. This could enable unauthorized viewing or control of surveillance cameras managed by the AXIS Camera Station Pro server. No known exploits are currently reported in the wild, and no patches or mitigation links are provided yet. Given the nature of the product—a video management system used for security surveillance—unauthorized access could lead to privacy violations, unauthorized monitoring, or manipulation of camera feeds.

Detailed information about CVE-2025-30026: CWE-288: Authentication Bypass Using an Alternate Path or Channel in Axis Communications AB AXIS Camera Station Pro a

CVE-2025-30026: CWE-288: Authentication Bypass Using an Alternate Path or Channel in Axis Communications AB AXIS Camera Station Pro - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-30026: CWE-288: Authentication Bypass Using an Alternate Path or Channel in Axis Communications AB AXIS Camera Station Pro

The communication protocol used between client and server had a flaw that could lead to an authenticated user performing a remote code execution attack.

CVE-2025-30023 is a critical vulnerability identified in Axis Communications AB's AXIS Camera Station Pro software versions prior to 6.9. The root cause of this vulnerability is a deserialization flaw (CWE-502) in the communication protocol between the client and server components of the product. Specifically, the protocol improperly handles untrusted serialized data, allowing an authenticated user to exploit this flaw to perform remote code execution (RCE) on the server. This vulnerability requires the attacker to have legitimate credentials (low privilege required) but does not require any user interaction beyond authentication. The CVSS v3.1 score of 9.0 reflects the critical nature of this vulnerability, with high impact on confidentiality, integrity, and availability, and a scope that affects the entire system. The vulnerability allows an attacker to execute arbitrary code remotely, potentially leading to full system compromise, data exfiltration, or disruption of video surveillance services. The flaw arises from unsafe deserialization practices, which can allow crafted serialized objects to trigger malicious code execution during the deserialization process. No known public exploits have been reported yet, but the criticality and nature of the vulnerability make it a high-priority risk for organizations using this software.

Detailed information about CVE-2025-30023: CWE-502 Deserialization of Untrusted Data in Axis Communications AB AXIS Camera Station Pro affecting Axis Communicat

CVE-2025-30023: CWE-502 Deserialization of Untrusted Data in Axis Communications AB AXIS Camera Station Pro - Live Threat Intelligence - Threat Radar | OffSeq.com

Title	Severity	Type	Source	Date

Threats Affecting Norway

Filter Threats

Threats Affecting Norway

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility