Search: CVE-2024-21887

A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.

Salt Typhoon, a Chinese state-sponsored threat actor, has been targeting major telecommunications providers worldwide by exploiting vulnerabilities in network devices. This analysis tracks global exposures of internet-facing devices associated with Salt Typhoon activity over six months, including Sophos Firewalls, Cisco IOS XE WebUIs, Ivanti Connect Secure, and Fortinet FortiClient EMS systems. Overall combined exposure decreased by 25%, with Sophos Firewall interfaces showing the largest reduction. Cisco IOS XE was the only platform with increased exposure. Geographically, most exposures remain concentrated in the United States, except for Sophos XG Firewall exposures in Germany. The persistence of exposed devices raises questions about remediation efforts and organizational responses to these threats.

Malware#chinese state-sponsored#masol ratGermany+6

The 'Game of Emperor' report reveals a long-term cyber intrusion campaign attributed to the threat actor 'Earth Estries,' targeting multiple sectors including consulting, managed service providers, NGOs, and telecoms across various countries primarily outside Europe. The campaign appears to be persistent and ongoing, with a low severity rating and no known exploits or patches available. The threat actor's activity has been observed in countries such as Afghanistan, Brazil, India, Indonesia, Malaysia, Pakistan, Philippines, South Africa, Taiwan, Thailand, USA, and Vietnam. Although no direct European targets are listed, the sectors affected and the global nature of managed service providers and telecoms imply potential indirect risks to European organizations. The lack of detailed technical indicators and the unknown nature of the threat limit precise mitigation steps, but vigilance and enhanced monitoring of supply chains and third-party providers are recommended. Given the low severity and absence of known exploits, the threat is assessed as medium severity due to its persistence and potential for indirect impact.

Unknowntype#type:osint#osint:lifetime="perpetual"Germany+7