CISA Known Exploited Vulnerabilities

An authorization issue was addressed with improved state management. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.1 and iPadOS 18.3.1, iPadOS 17.7.5. A physical attack may disable USB Restricted Mode on a locked device. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.

A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could allow an authenticated attacker with administrative privilege to conduct an argument injection attack, due to insufficient parameter sanitization during the boot process. A successful exploit could allow an attacker to execute arbitrary commands within the context of the system.

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Windows Storage Elevation of Privilege Vulnerability

**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device via Telnet.

**UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device by sending a crafted HTTP POST request.

CVE-2025-0994 is a high-severity deserialization vulnerability in Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10. It allows an authenticated user to execute remote code on the Microsoft IIS web server hosting the application. The vulnerability arises from unsafe deserialization of untrusted data. No known exploits are reported in the wild. Patch status is not confirmed from the provided data.

A vulnerability in 7-Zip allows remote attackers to bypass the Mark-of-the-Web security feature, enabling execution of arbitrary code with the current user's privileges. This flaw has been exploited in the wild and is rated as high severity.

Microsoft Outlook contains a critical improper input validation vulnerability that enables remote code execution. This flaw allows attackers to bypass the Office Protected View security feature, causing documents to open directly in editing mode instead of protected mode. The vulnerability has been exploited in the wild, posing a significant risk to users. No specific affected versions or patch information is provided in the available data.

Sophos XG Firewall has a buffer overflow vulnerability in its HTTP/S bookmark feature that enables remote code execution. This vulnerability has been exploited in the wild and is considered high severity. No specific affected versions or patch information is provided.

CyberoamOS (CROS) contains a SQL injection vulnerability in its WebAdmin interface that allows unauthenticated remote attackers to execute arbitrary SQL commands. This vulnerability has been exploited in the wild and is associated with known ransomware campaigns. The vulnerability is classified as high severity due to its potential impact on system integrity and confidentiality.

CVE-2022-23748 is a process control vulnerability in the Dante Discovery application, specifically in the mDNSResponder.exe component. This flaw allows a local attacker to perform a DLL sideloading attack, enabling arbitrary code execution. The vulnerability has been exploited in the wild, indicating active threat usage. No specific affected versions or patch information are provided.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (CVE-2024-53104) * kernel: vsock: Keep the binding until socket destruction (CVE-2025-21756) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Microsoft .NET Framework has an information disclosure vulnerability identified as CVE-2024-29059. This flaw exposes the ObjRef URI to attackers, which can lead to remote code execution. The vulnerability has a high severity score of 7.5 and is known to be exploited in the wild. No specific affected versions or patch information are provided in the available data.