CISA Known Exploited Vulnerabilities

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.

A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.

Acclaim Systems USAHERDS contains a hard-coded credentials vulnerability that can enable an attacker to achieve remote code execution on the affected system. Exploitation requires obtaining the MachineKey through another vulnerability or channel. This vulnerability is known to be exploited in the wild and is classified as high severity.

The Reolink RLC-410W IP camera has an authenticated OS command injection vulnerability in its network settings functionality. This vulnerability allows an attacker with valid credentials to execute arbitrary operating system commands on the device. It has been exploited in the wild, indicating active threat usage. No specific affected versions or patch information is provided.

NUUO NVRmini devices have an OS command injection vulnerability identified as CVE-2018-14933. This flaw allows remote attackers to execute arbitrary commands on the device by injecting shell metacharacters into the uploaddir parameter of the writeuploaddir command. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.

Multiple Reolink IP camera models have an authenticated OS command injection vulnerability that allows an admin user to execute arbitrary commands as root via the 'TestEmail' feature. This vulnerability affects models including RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W. Exploitation requires authentication but can lead to full system compromise. The vulnerability is known to be exploited in the wild.

NUUO NVRmini2 devices have a missing authentication vulnerability that permits unauthenticated attackers to upload encrypted TAR archives. This flaw can be exploited to add arbitrary users to the device, potentially compromising device security. The vulnerability is classified as high severity and has been exploited in the wild. No specific affected versions or patch information is provided.

CVE-2024-55956 affects Cleo Harmony, VLTrader, and LexiCom products prior to version 5.8.0.24. The vulnerability allows an unauthenticated attacker to import and execute arbitrary Bash or PowerShell commands on the host system by exploiting the default settings of the Autorun directory. This can lead to full system compromise. The vulnerability has a critical CVSS score of 9.8 and is known to be exploited in the wild, including use in ransomware campaigns.

CVE-2024-35250 is a high-severity vulnerability in the Microsoft Windows Kernel-Mode Driver involving an untrusted pointer dereference. This flaw allows a local attacker to escalate privileges on the affected system. It has been confirmed exploited in the wild. No specific affected Windows versions or patch information is provided in the available data.

ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could leverage this vulnerability to access or modify restricted files. Exploitation of this issue does not require user interaction. Exploitation of this issue requires the admin panel be exposed to the internet.

In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.

CVE-2024-49138 is a heap-based buffer overflow vulnerability in the Microsoft Windows Common Log File System (CLFS) driver. It allows a local attacker to escalate privileges on the affected system. The vulnerability has a high severity rating with a CVSS score of 7.8 and has been exploited in the wild. No specific affected Windows versions or patch information are provided in the available data.

A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user.

getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.

ProjectSend has an improper authentication vulnerability that allows remote, unauthenticated attackers to modify application configuration via crafted HTTP requests to options.php. Exploitation enables attackers to create accounts, upload webshells, and embed malicious JavaScript, leading to potential full compromise. This vulnerability is actively exploited in the wild. No specific affected versions or patch information is provided yet.

A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware versions V5.00 through V5.38, USG FLEX 50(W) series firmware versions V5.10 through V5.38, and USG20(W)-VPN series firmware versions V5.10 through V5.38 could allow an attacker to download or upload files via a crafted URL.

Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier allow a remote unauthenticated attacker to conduct XML External Entity (XXE) attacks. By processing a specially crafted request containing malformed XML data, arbitrary files on the server containing account information may be read by the attacker.

Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using a flags attribute in an HTTP header without authentication. The product could then be exploited through a vulnerable URL. The 2023-03-09 vendor advisory stated "a new Array AG release with the fix will be available soon."