Joseph Lee

Threat Report May 2025: Hack, Rinse, Repeat

May 2025 was a volcanic month for cybersecurity news, including several large breaches and new critical severity vulnerabilities. The Greenbone blog has already covered some major events, such as new actively exploited vulnerabilities in SAP Netweaver, Commvault Command Center and Ivanti EPMM. In total 4,014 new vulnerabilities were added to MITRE’s CVE (Common Vulnerabilities and Exposures) program. Greenbone added over 2,500 vulnerability tests to the Enterprise Feed, many capable of detecting multiple CVEs.

In this threat report for May 2025, we will round up some of the riskiest new CVEs disclosed this month, review a nation-state backed cyber campaign impacting tech companies around the world, and review how AI is poised to escalate cyber risk with intelligent automation at all stages of the Cyber Kill Chain.

The Inevitable AI-Enabled Attack Cycle: Hack, Rinse, Repeat

AI is now a force multiplier in the cyber attack lifecycle. Threat actors are leveraging AI in two fundamental ways; expediting the conversion of public vulnerability knowledge into exploit tools, and building more convincing social engineering content. Researchers have proposed a long list of additional capabilities that AI can further optimize, including automation of initial access attacks and command-and-control (C2) operations.

Even without AI, skilled human hackers can exfiltrate sensitive information within minutes of initial access. If significant vulnerabilities exist on the LAN side of a victim’s network, manual deployment of ransomware is trivial. In 2017, WannaCry demonstrated that ransomware attacks can be automated and wormable, i.e., capable of spreading between systems autonomously.

According to Norton’s latest Gen Threat Report, data-theft has increased 186% in Q1 2025. As discussed last month, data-theft-related class action filings have risen more than 1,265% over six years. When a victim’s cyber hygiene is non-compliant, multi-million dollar settlements are the norm. The top 10 data-breach class action settlements in 2023 totaled over 515 million dollars; the largest was a 350 million dollar settlement involving T-Mobile. This stolen data is often sold on the dark web, becoming fuel for subsequent cyber attacks. We should expect AI to reach full autonomy at all stages of the Cyber Kill Chain in the near future, resulting in a fully autonomous vicious cycle of exploitation; hack, rinse, repeat.

Russian GRU-Backed Espionage Campaign Hits Global Tech and Logistic Firms

CISA (Cybersecurity and Infrastructure Security Agency) and defense entities from nine other countries have warned of a cyber espionage-oriented campaign. The operation is being conducted by the Russian General Staff Main Intelligence Directorate (GRU), specifically the 85th Main Special Service Center (85th GTsSS), military unit 26165. The group is tracked under several aliases including the well-known FancyBear and APT28.

The full report outlines detailed Tactics, Techniques and Procedures (TTPs) leveraged in the campaign, which includes reconnaissance [TA0043], credential brute forcing [T1110.003], spearphishing to attain credentials and deliver malware [T1566], exploiting trust relationships to gain access [T1199], proxying attacks through compromised devices [T1665] and exploiting known software vulnerabilities – both for initial access [T1190] and privilege escalation [T1068]. The sheer diversity of attack techniques indicates a highly sophisticated threat.

The campaign targets a wide range of small office/home office (SOHO) devices, Microsoft Outlook, RoundCube Webmail and WinRAR as well as undisclosed CVEs in other internet-facing infrastructure – including corporate VPNs and SQL injection flaws. Greenbone includes detection tests for all CVEs referenced in the report. Those CVEs include:

  • CVE-2023-23397 (CVSS 9.8): A privilege escalation vulnerability in Microsoft Outlook that leverages replay of captured Net-NTLMv2 hashes.
  • CVE-2020-12641 (CVSS 9.8): Allows attackers to execute arbitrary code via shell metacharacters in a Roundcube Webmail configuration setting for `im_convert_path` or `im_identify_path`.
  • CVE-2020-35730 (CVSS 5.0): An XSS flaw in Roundcube Webmail via a plain text email message, containing a JavaScript link reference.
  • CVE-2021-44026 (CVSS 9.8): An SQL injection flaw in Roundcube via search or search_params.
  • CVE-2023-38831 (CVSS 7.8): Allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive.

DragonForce Ransomware Spreads its Wings

Emerging in mid-2023, DragonForce transitioned from a hacktivist collective into a financially motivated Ransomware-as-a-Service (RaaS) operation. Fast forward to 2025, and DragonForce has established itself as an apex threat in the ransomware ecosystem.

DragonForce ransomware attacks impacted the following countries:

  • United States – 43 confirmed incidents
  • United Kingdom – including recent May 2025 breaches of Marks & Spencer, Co-op and Harrods
  • Saudi Arabia – a data leak from a major Riyadh construction firm
  • Australia – e.g., Yakult Australia
  • Singapore – Coca-Cola operations
  • Palau – a government breach in March 2024
  • Canada – among the top five most attacked nations
  • India – has faced increased targeting, particularly in the past month

Campaigns have included exploitation of SimpleHelp remote monitoring and management (RMM) [1], Confluence Server and Data Center [2], Log4Shell (aka Log4J), Microsoft Windows vulnerabilities, as well as various flaws in Ivanti products [3]. Greenbone provides multiple active check and version detection tests for all CVEs identified in DragonForce campaigns.

DragonForce has been observed exploiting:

In line with the attack trajectory of other prominent ransomware actors, DragonForce is known to use other techniques in addition to breaching public-facing vulnerabilities such as phishing emails, credential theft, brute-force, and credential stuffing attacks on exposed services and remote management (RMM) tools like AnyDesk, Atera, and TeamViewer, for persistence and lateral movement. Therefore, organizations need comprehensive cybersecurity programs that include user awareness training to prevent social engineering attacks and regular penetration testing to simulate real-world adversarial activity.

CVE-2025-32756: Stack-Based Buffer Overflow Vulnerability in Multiple Fortinet Products

CVE-2025-32756 (CVSS 9.8), published on May 13, 2025, is a critical severity stack-based buffer overflow vulnerability [CWE-12] affecting multiple Fortinet products. It allows remote, unauthenticated attackers to execute arbitrary code via a crafted HTTP cookie. The flaw is being actively exploited in the wild – primarily against FortiVoice systems – and is linked to attacks involving malware deployment, credential theft using cron job, and network reconnaissance. Proof-of-concept details are publicly available, and a full technical analysis has been published increasing the risk factor.

Fortinet flaws have a historically high conversion rate for use in ransomware attacks. A total of 18 vulnerabilities in Fortinet products have been added to CISA Known Exploited Vulnerabilities (KEV) list since late 2021 – 11 of these are known to be leveraged by ransomware operators. In addition to CISA, several other national CERT entities have issued alerts, including CERT-EU, the Centre for Cybersecurity Belgium (CCB), and Germany’s CERT-BUND.

The root cause is a missing length check in the `cookieval_unwrap()` function of libhttputil.so. A malicious AuthHash cookie can induce memory corruption to control the return memory address, allowing an attacker to hijack execution flow at the process level. Greenbone Enterprise Feed provides a vulnerability test to detect affected products and almost 1,000 other tests for detecting other vulnerabilities in Fortinet products.

CVE-2025-32756 affects dozens of firmware versions across multiple FortiNet products, including:

  • FortiVoice (6.4.0 – 7.2.0)
  • FortiMail (7.0.0 – 7.6.2)
  • FortiNDR (1.1 – 7.6.0)
  • FortiRecorder (6.4.0 – 7.2.3)
  • all versions of FortiCamera 1.1 and 2.0 as well as 2.1.0 – 2.1.3

Fortinet advises upgrading to the latest fixed versions immediately. If patching is not feasible, users should disable the HTTP/HTTPS administrative interface to prevent successful attacks.

Trio of SysAid Flaws Now Have CVEs and Public PoC

In May, three critical-severity vulnerabilities were disclosed affecting on-premises SysAid IT Service Management (ITSM) platform. These flaws can be chained, allowing unauthenticated Remote Code Execution (RCE). Full technical details and Proof-of-Concept (PoC) were published by watchTowr. Also, considering that SysAid vulnerabilities have been targeted by ransomware operators in the past, these flaws are especially high risk.

CVE-2025-2775, CVE-2025-2776, and CVE-2025-2777 (each CVSS 9.3) are unauthenticated XML External Entity (XXE) [CWE-611] vulnerabilities, found in the Checkin, Server URL and lshw functions respectively. All allow admin account takeover and arbitrary file read on the victim’s system. SysAid On-Prem versions ≤ 23.3.40 are affected. Notably, the flaws were patched by the vendor in March, but CVE IDs were not reserved or issued. This type of scenario contributes to a less transparent threat landscape for software users, reducing visibility and complicating operational vulnerability management. Greenbone offers detection tests for all aforementioned CVEs.

SysAid has a global presence of over 10,000 customers across 140 countries, including organizations such as Coca-Cola, Panasonic, Adobe, and LG. While it holds a smaller share of the ITSM market compared to larger competitors like ServiceNow or Jira Service Management, it remains a popular solution for mid-sized businesses.

A CVSS 10 in Cisco IOS XE Wireless Controller

CVE-2025-20188 is a new critical-severity (CVSS 10) vulnerability disclosed in May 2025. It affects Cisco’s flagship platform, the Catalyst 9800 Series. Although not known to be actively exploited yet, a full technical walkthrough is now available, which will provide less sophisticated threat actors with a head start.

The root cause of the vulnerability is a hard-coded JSON Web Token (JWT) which could allow the attacker to upload files, perform path traversal, and execute arbitrary commands with root privileges via specially crafted HTTP request. Specifically, a hardcoded fallback secret – the string `notfound` – is used to verify the authenticity of a JWT if `/tmp/nginx_jwt_key` is not present.

Although this key file may be generated at certain times, such as when an administrator logs into the management console, it may not be present at certain times, such as immediately after a device reboot or service start.

Crucially, the flaw does not affect all HTTP endpoints – it is limited to the Out-of-Band Access Point (AP) Image Download feature of Cisco IOS XE Software for WLAN Controllers (WLCs). While Cisco’s advisory claims this service is not enabled by default, Horizon.ai researchers found that it was. Therefore, while there are several conditions affecting the exploitability of CVE-2025-20188, if those conditions are present, exploitation is trivial – and likely affects many organizations.

Cisco has released an advisory which recommends that affected users either upgrade to the patched version, or disable the Out-of-Band AP Image Download feature. Greenbone Enterprise Feed includes a version detection test for identifying affected devices and verifying patch level.

Summary

May 2025 delivered a surge of critical vulnerabilities, major breaches and escalating nation-state activity. It’s important to keep in mind that AI-enhanced attack cycles are destined to become a reality – the chaotic and urgent cybersecurity landscape shows no sign of easing any time soon.

New actively exploited flaws in Cisco, Fortinet, and SysAid products force organizations to maintain vigilant, continuous detection efforts, followed by prioritization and mitigation.

Greenbone’s Enterprise coverage helps security teams see vulnerabilities that threat actors can exploit to stay ahead in a fast-moving threat landscape.

Contact Test Now Buy Here Back to Overview

/by
Greenbone AG

Greenbone Audits for Compliance with the CIS Windows 11 Enterprise Benchmark”

Microsoft Windows remains the most widely used desktop operating system in enterprise environments – and also one of the most targeted by threat actors. Insecure configurations are a leading source of security breaches [1][2][3], often exploited to gain initial access [TA0001], escalate privileges [TA0004], steal credentials [TA0006], establish persistent access [TA0003], and move laterally within a network [TA0008]. Many national cybersecurity agencies continue to advocate strongly for organizations to enact policies to strengthen operating system (OS) baseline configurations [4][5][6][7][8].

Securing Windows 11 systems requires more than just patching known vulnerabilities. IT operations should start by deploying security hardened baseline images of Windows and periodically verify their configuration. This means adjusting many hidden or often overlooked settings of Microsoft Windows while disabling some features altogether. Hardened security controls include enforcing strong password and account lockout policies, disabling unnecessary system services like Remote Registry, applying application control rules via AppLocker, configuring advanced audit policies to monitor system activity and more.

Aligning with these enterprise IT cybersecurity goals, Greenbone is proud to announce the addition of CIS Microsoft Windows 11 Enterprise Benchmark v3.0.0 Level 1 (L1) auditing to our compliance capabilities. This latest enhancement allows our Enterprise feed customers to verify their Windows 11 configurations against the CIS compliance standard and adds to Greenbone’s growing arsenal of CIS compliance policies including Google Chrome, Apache, IIS, NGINX, MongoDB, Oracle, PostgreSQL, Windows, Linux and Docker [1][2]. Read on to find out more about Greenbone’s latest IT security detection capabilities.

Greenbone Adds CIS Microsoft Windows 11 Enterprise Benchmark

The CIS Microsoft Windows 11 Enterprise Benchmark v3.0.0 L1 is now available in the Greenbone Enterprise Feed. This benchmark defines a comprehensive set of security configurations – from Group Policy and registry hardening to built-in feature restrictions – designed to lock down Windows 11 Enterprise in line with industry best practices. With this new addition, Greenbone makes it easier to identify Microsoft Windows misconfigurations before attackers can exploit them.

Our Enterprise vulnerability feed leverages compliance policies to execute tests to verify each automatable CIS L1 requirement. These tests are grouped into scan configurations, allowing security teams to launch targeted assessments across their Windows 11 fleet. Whether aligning with internal security mandates or regulatory frameworks, Greenbone’s audit will confirm your Windows 11 Enterprise settings, ensuring that systems are locked down and that deprecated or risky features are disabled.

Windows Security Is Paramount

Microsoft Windows plays a prominent role in enterprise IT environments, serving as the backbone for endpoints, servers and domain infrastructure. But this ubiquity also makes it a prime target. Insecure Windows configurations can open the door to Remote Code Execution (RCE), credential theft and privilege escalation. A serious cyber breach can result in full domain compromise, ransomware attacks, loss of customer confidence, regulatory fines and even high cost legal action such as class action lawsuits when user data is leaked.

In recent years, national cybersecurity agencies – including Germany’s BSI [9], the U.S. Cybersecurity and Infrastructure Security Agency (CISA) [10] and the Canadian Centre for Cyber Security [11] among others [12][13] – have issued alerts emphasizing the need to harden OS security configurations and disable legacy features that attackers routinely exploit. The increasing frequency and sophistication of adversarial threat actors further underscores the need for proactive Windows security.

Misconfigurations in Windows can have a cascading impact, compromising both the local system and the wider network. That’s why hardening efforts must go beyond vulnerability patching to include robust configuration management. Greenbone’s new CIS Windows 11 Enterprise compliance policy gives defenders the tools they need to strengthen resilience against many critical IT security weaknesses.

How Does the CIS Windows 11 Benchmark Improve Cybersecurity?

The CIS Microsoft Windows 11 Enterprise Benchmark offers a structured approach to securing Microsoft Windows endpoints. It defines configuration settings that could be used for unauthorized access, privilege abuse and system compromise. The benchmark audits a wide range of policies including account security, system services, network configurations, application controls and administrative templates to reduce attack surface and improve system integrity.

The major sections of the CIS Windows 11 benchmark are:

  • Account Policies: Defines policies for password complexity, history, expiration and account lockout thresholds. These settings help enforce strong authentication hygiene and limit brute-force attacks.
  • Local Policies: Focuses on enforcing a wide array of local access controls and system behavior. It covers audit settings, user rights assignments (like who can log in locally or shut down the system) and security options (like guest account status, access tokens, network access, device drivers, firmware options and cryptography requirements) and more.
  • System Services: Reduces attack surface by limiting active system components. Recommends disabling or configuring Windows services that may be unnecessary or expose the system to risk (e.g., Remote Registry, FTP, Bluetooth, OpenSSH, Geolocation service and more).
  • Windows Defender Firewall with Advanced Security: Covers firewall configurations for domain, private and public profiles. Includes rules for logging, connection restrictions and blocking unsolicited inbound traffic to enforce network segmentation and traffic control.
  • Advanced Audit Policy Configuration: Provides granular auditing settings across categories like logon events, object access and policy changes to enhance visibility and compliance.
  • Administrative Templates (Computer): Covers Group Policy settings at the computer level, including UI restrictions, legacy protocol controls, SMB hardening, UAC behavior and device configuration.
  • Administrative Templates (User): Focuses on user-level policies affecting personalization, privacy, desktop behavior, Windows components, telemetry, cloud content, search and Microsoft Store access.

Greenbone Is a CIS Consortium Member

As a member of the CIS consortium, Greenbone is committed to adding additional scan configurations to attest CIS Benchmarks. All our CIS Benchmarks policies are aligned with CIS hardening guidelines and certified by CIS, ensuring maximum security for system audits. Greenbone also has a dedicated compliance view for the Greenbone Security Assistant (GSA) web-interface, to streamline the assessment process for organizations.

Summary

Securing Microsoft Windows 11 Enterprise requires more than patching vulnerabilities – it demands a disciplined approach to configuration management based on proven best practices. By hardening hidden system settings and disabling unnecessary features, security teams can prevent exploitation paths commonly used by attackers to deploy ransomware, exfiltrate data or establish persistence.

With added support for the CIS Microsoft Windows 11 Enterprise Benchmark v3.0.0, Greenbone strengthens its position as a leader in proactive cybersecurity, offering enterprises the tools they need to reduce risk, demonstrate compliance and stay resilient in an increasingly hostile digital landscape. Enterprise Feed subscribers can now audit and verify their Windows 11 configurations with precision and confidence

Contact Test Now Buy Here Back to Overview

/by
Markus Feilner

Dwell time: Attackers Are Striking Faster and Disguising Themselves Better

Security experts are observing a worrying trend: the time to exploit (TTE), i.e. the time between a security vulnerability becoming known and being exploited by malicious actors, has been falling dramatically in recent times.

At the same time, attackers are becoming increasingly skilled at concealing their presence in a successfully hacked network. Experts refer to the time it takes to establish a foothold and then gain unauthorized access to company resources before being detected (and removed) as “dwell time”. The shorter this time, the better for those under attack. Even the most talented hacker needs time and can cause more (permanent) damage the longer they remain undetected and unobserved.

The Enemy Is Listening – and May Already Be There

Alarmingly, dwell time is increasingly reaching months or even years, as was the case with Sony and the US Office for Personal Management. There, attackers were able to operate undisturbed for more than twelve months. As a result, more than 10 terabytes of data were stolen from the Japanese technology group.

The fear of hidden intruders is great; after all, no one can say with certainty whether a malicious listener is already on their own network. It happens. In the 2015 Bundestag hack, for example, it was not the Bundestag’s own monitoring system that informed the German authorities about strange activities by third parties (Russian APT hacker groups) on the Bundestag network, but a “friendly” intelligence service. How long and how many actors had already been active in the network at that point remained unclear. The only thing that was clear was that there was more than one, and that the friendly intelligence services had been watching for some time.

Detection, Prevention and Response Increasingly Critical

This makes it more important to ensure that attackers do not gain access to the system in the first place. But this is becoming increasingly difficult: as reported by experts at Google’s Mandiant, among others, the response time available to companies and software operators between the discovery of a vulnerability and its exploitation has fallen rapidly in recent years, from 63 days in 2018 to just over a month in recent years.

Less and Less Time to Respond

In 2023, administrators had an average of only five days to detect and close vulnerabilities. Today it is already less than three days.

But that’s not all. In the past, security vulnerabilities were often exploited after patches became available, i.e., after experienced administrators had already secured their systems and installed the latest patches. These so-called “N-day vulnerabilities” should not really be a problem, as fixes are available.

Improved Discipline with Side Effects: Attackers Learn

Unfortunately, in the past, discipline (and awareness) was not as strong in many companies, and the issue was neglected, inadvertently contributing to the spread of automated attack methods such as worms and viruses. But there is good news here too: in 2022, attacks via N-day vulnerabilities still accounted for 38% of all attacks, but by 2023 this figure will fall to just 30%.

At first glance, this sounds good because administrators can find and fix known vulnerabilities for which patches are available more quickly and effectively. After years of poor discipline and a lack of update and patch strategies, the major and successful ransomware incidents have certainly also helped to convey the scope and importance of proper vulnerability management to the majority of those responsible.

Two-thirds Are now Zero-days

But there is also a downside to these figures: more than two-thirds of all attacks are now based on zero-day vulnerabilities, i.e., security gaps for which there is no patch yet – in 2023, this figure was as high as 70%. Criminal groups and attackers have reacted, learned and professionalized, automated and greatly accelerated their activities.

Without automation and standardization of processes, without modern, well-maintained and controlled open-source software, administrators can hardly keep up with developments. Who can claim to be able to respond to a new threat within three days?

Powerless? Not with Greenbone

When attackers can respond faster to new, previously unknown vulnerabilities and have also learned to hide themselves better, there can only be one answer: the use of professional vulnerability management. Greenbone solutions allow you to test your network automatically. Reports on the success of measures give administrators a quick overview of the current security status of your company.

Contact Test Now Buy Here Back to Overview

/by
Joseph Lee

Attackers Advance on Two New Ivanti EPMM Flaws

Just last month, CVE-2025-22457 (CVSS 9.8) affecting Ivanti Connect Secure, Policy Secure, and ZTA Gateways was recognized as a vector for ransomware. Now, two new CVEs have been added to the growing list of high-risk Ivanti vulnerabilities; CVE-2025-4427 and CVE-2025-4428 affecting Ivanti EPMM (Endpoint and Patch Management Mobile) are under active exploitation.

Greenbone includes active check and version detection tests addressing both new CVEs and many other flaws in Ivanti products, allowing users to identify vulnerable instances, proceed with the patch process and verify security compliance once patches have been applied. In this blog post we will review the technical details of both new CVEs and assess the role that Ivanti has played in the global cyber risk calculus.

Two New CVEs in Ivanti EPMM Combine for Unauthorized Access

At the time of disclosure, Ivanti admitted that on-premises EPMM customers had already been breached. However, cloud security firm Wiz claims that self-managed cloud instances have also been effectively exploited by attackers. A full technical description of the attack chain is publicly available, making exploit development easier for attackers and further increasing the risk.

Here is a brief summary of each CVE:

  • CVE-2025-4427 (CVSS 5.3): An authentication bypass in the API component of Ivanti EPMM 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API.
  • CVE-2025-4428 (CVSS 7.2): Remote Code Execution (RCE) in the API component of Ivanti EPMM 12.5.0.0 and prior allows authenticated attackers to execute arbitrary code via crafted API requests.

Ivanti has released patches to remediate the flaws. Users should update EPMM to at least version 11.12.0.5, 12.3.0.2, 12.4.0.2 or 12.5.0.1. If immediate patching is not possible, Ivanti recommends restricting API access using either the built-in Portal ACLs (Access Control Lists with the “API Connection” type) or an external WAF (Web Application Firewall). Network-based ACLs are discouraged by the vendor, since they may block some EPMM functionality. While these mitigations reduce risk, they can impact functionality for certain EPMM integrations, such as Microsoft Autopilot and Graph API. Ivanti also offers an RPM file which can be used to patch EPMM via SSH command line access.

The Invanti EPMM Exploit Chain

The exploit chain in Ivanti EPMM begins with CVE-2025-4427. Due to an insecure configuration in the application’s security.xml file, certain endpoints (specifically /rs/api/v2/featureusage) partially process requests if the format parameter is provided. This pre-auth processing allowed unauthenticated requests to access functions that should be protected. This access control flaw caused by CVE-2025-4427 sets the stage for RCE via CVE-2025-4428.

CVE-2025-4428 allows RCE via an Expression Language (EL) injection via HTTP requests. If the format parameter supplied in a request is invalid as per the EPMM’s specification (neither “cve” or “json”), its value is appended to an error message without sanitization and logged via Spring Framework’s message templating engine. By supplying specially crafted values in the format parameter, attackers can execute arbitrary Java code because the logged message is evaluated as an EL formatted string.

Researchers have pointed out these risks associated with message templating engines are well documented and rebuked Ivanti’s claims that the vulnerability was due to a flaw in a third-party library, rather than their own oversight. Also, if the conditions leading to exploitation of CVE-2025-4428 sounds familiar, it is reminiscent of the infamous Log4Shell vulnerability. Like Log4Shell, CVE-2025-4428 results from passing unsanitized user input into an expression engine which will interpret special commands from a formatted string. In the case of Log4Shell, malicious string formatting in JNDI lookups (e.g., ${jndi:ldap://…}), could trigger RCE.

Risk Assessment: Attackers Advance on Ivanti Flaws

Ivanti has been in the hot seat for the past few years. Attackers have often exploited flaws in Ivanti’s products to gain initial access to their victim’s networks. Across all product lines, the vendor has been the subject of 61 Critical severity (CVSS >= 9.0) CVEs since the start of 2023. 30 of these have been added to CISA KEV (Known Exploited Vulnerabilities of the Cybersecurity and Infrastructure Security Agency), although the true tally of actively exploited flaws may be higher. Ivanti CVEs have a high conversion rate for use in ransomware attacks; CISA notes 8 CVEs in this category.

In early 2024, the European Commission, ENISA, CERT-EU and Europol issued a joint statement addressing active exploitation of Ivanti Connect Secure and Policy Secure Gateway products. In the US, CISA directed all federal civilian agencies to disconnect these products and assume they had been breached [1][2]. CISA, the FBI and cybersecurity agencies from the UK, Australia and Canada issued a joint advisory warning of ongoing exploitation. By late 2024, CISA had also alerted to active exploitation of Ivanti Cloud Service Appliances (CSA), warning that both state-sponsored and financially motivated threat actors were successfully targeting unpatched systems.

In 2025, on January 8th, CISA warned that newly disclosed CVE-2025-0282 and CVE-2025-0283 in Ivanti Connect Secure, Policy Secure and ZTA Gateways were also under active exploitation. Unfortunately, attackers continue to advance on new flaws in Ivanti’s products well into 2025 including CVE-2025-22457 [3][4] and now, two new CVEs in EPMM discussed above.

Dennis Kozak replaced Jeff Abbott as Ivanti’s CEO effective January 1, 2025 despite a mid-2024 pledge from Mr. Abbot for improved product security. No public statement was made linking the succession to the Utah company’s security challenges, however it happened with only a few weeks’ notice. Executives have not been called to testify before US congress as many other cybersecurity leaders have following high-risk incidents including Sudhakar Ramakrishna (CEO of SolarWinds), Brad Smith (President of Microsoft) and George Kurtz (CEO of CrowdStrike).

Echoes from EPMM’s Past: CVE-2023-35078 and CVE-2023-35082

In addition to the vortex of vulnerabilities discussed above, CVE-2023-35078 (CVSS 9.8) and CVE-2023-35082 (CVSS 9.8), disclosed in July and August 2023 respectively, also provided unauthenticated RCE for Ivanti EPMM. Public exploitation kicked off almost immediately after their disclosure in 2023.

CVE-2023-35078 was exploited to breach the Norwegian government, compromising data from twelve ministries [3][4]. CISA issued an urgent advisory (AA23-214A) citing confirmed exploitation by Advanced Persistent Threat (APT) actors and advising all federal agencies to take immediate mitigation steps. Even back in 2023, the speed and breadth of the attacks underscored Ivanti’s growing profile as a repeat offender, enabling espionage and financially motivated cybercrime.

Summary

Ivanti EPMM is susceptible to two new vulnerabilities; CVE-2025-4427 and CVE-2025-4428 can be combined for unauthorized remote code execution. Now under active exploitation, they underscore a troubling pattern of high-severity flaws in Ivanti products. Ivanti has released patches to remediate the flaws and users should update EPMM to at least version 11.12.0.5, 12.3.0.2, 12.4.0.2 or 12.5.0.1.

Greenbone’s vulnerability detection capabilities extend to include tests for CVE-2025-4427 and CVE-2025-4428 allowing Ivanti EPMM users to identify all vulnerable instances and verify security compliance once patches have been applied.

/by
Greenbone AG

Greenbone Reduces the Blast Radius of a Cyber Breach

Cyber attacks, like other types of security incidents, range dramatically in scope and impact. When defenders are prepared, an incident may be contained, damage limited, and recovery swift. When caught unprepared, a single incident may result in days or weeks of downtime, lost revenue, tarnished reputation, regulatory penalties or class action settlements [1][2]. In May 2024, Change Healthcare forecasted an expected loss of 1.6 billion Dollar. As of January 2025, the total cost of the Change Healthcare ransomware attack has reached almost 3 billion Dollar [3][4].

The totality of damage caused by an IT security breach, known as the “blast radius”, depends on many factors. These factors include whether vulnerabilities are being managed, if a defense in depth approach to cybersecurity has been applied, network segmentation, effective backup strategies and more. Negligent security hygiene is an open invitation to attackers, resulting in more costly outcomes like extensive data theft, ransomware extortion and even destructive wiper attacks used for industrial sabotage. A recent report found that once inside a network, attackers now deploy ransomware within 48 minutes on average and CVE disclosures are being weaponized into exploits within 18 days.

This article explores the concept of a cyber attack “blast radius” and the role that effective Vulnerability Management plays in containing the fallout from cyber intrusions. With the right controls in place, the damage from a cyber breach can be minimized and worst-case outcomes prevented

What is the “Blast Radius” of a Cyber Breach?

The term “blast radius” is military jargon referring to the physical area damaged by an exploding bomb. In digital systems, the term similarly refers to the extent of damage caused by a cyber attack. How many systems did an attacker compromise? Were they able to subsequently compromise critical systems after initial access? Did they breach adjacent networks or cloud assets?

Far-reaching damage is not a foregone conclusion when hackers gain initial access. Defenders can effectively cut off the attack at an early stage, preventing malicious actors from achieving their ultimate objectives or causing far reaching damage.

The Consequences of a Bigger Blast Radius

While forfeiting unauthorized access to an adversary is bad, it’s the subsequent stages of an attack that keeps IT security managers up at night. The latter stages of a cyber breach such as installing malware on critical assets, exfiltrating sensitive data, or encrypting files have the most profound implications for organizations. As blast radius increases, it is much more likely that an organization will experience a significantly negative impact.

Increased blast radius can result in:

  • Longer “Dwell Time”: Lateral movement and persistence techniques can allow attackers to remain undetected for extended periods, gathering intelligence and preparing subsequent attacks.
  • Increased financial losses: Service disruptions and ransomware attacks contribute to higher financial losses, lost revenue from downtime, risk of regulatory penalties and erode business relationships.
  • Increased operational downtime: The impact of operational downtime can reverberate across an organization causing delays, frustration and desynchronizing operations.
  • Loss of sensitive data: Attackers seek to exfiltrate sensitive data to support espionage campaigns or extort victims into paying ransom.
  • Compromised trust: Unauthorized access to messaging systems or third-party assets can erode trust among stakeholders, including customers, employees and business partners.

Greenbone Reduces the Blast Radius of a Cyber Breach

Vulnerability Management is a powerful factor in reducing the so-called “blast radius”. Effective mitigation of security gaps can leave an adversary with no easily accessible means to extend their initial foothold. Vulnerability management is most efficiently and effectively implemented by automatically scanning for security weaknesses throughout a network infrastructure and remediating the attack surface. In doing so, organizations can greatly reduce the potential blast radius of a successful cyber attack and also reduce probability of being breached in the first place.

Threat Mapping helps IT security teams understand their attack surfaces, the locations where adversaries may be able to enter a network. Greenbone’s core capabilities support Threat Mapping efforts with system and service discovery scans and by scanning both network and host attack surfaces allowing defenders to reduce their attack surface by 99%. Furthermore, Greenbone provides real-time reporting and alerts to keep security teams informed of emerging threats, enabling a proactive cybersecurity posture and timely remediation. This proactive, layered approach to cybersecurity reduces the potential blast radius and results in better security outcomes. Defenders are afforded more time to detect an attacker’s presence and eliminate it before catastrophic damage can be done.

The Strongest Defenses with Greenbone Enterprise Feed

The strongest defenses come from Greenbone’s industry leading Enterprise Vulnerability Feed. In total, the Greenbone Enterprise Feed has approximately 180,000 vulnerability tests and counting which can detect both general security compliance weaknesses and application specific vulnerabilities. Our Enterprise Feed adds hundreds of new tests each week to detect the newest emerging threats.

Here is a list of IT assets that Greenbone is designed to scan:

  • Internal network infrastructure: Scanning internal network devices with any type of exposed service, such as databases, file shares, SNMP enabled devices, firewalls, routers, VPN gateways and more.
  • On-premises and cloud servers: Attesting server configurations to ensure compliance with security policies and standards.
  • Workstations: Greenbone scans workstations and other endpoints across all major operating system (Windows, Linux, and macOS) to identify the presence of known software vulnerabilities attesting compliance with cybersecurity standards like CIS Benchmark
  • IoT and peripheral devices: IoT and peripheral devices, such as printers, use the same network protocols for communication as other network services. This allows them to be easily scanned for device and application specific vulnerabilities and common misconfigurations similarly to other network endpoints.

Reducing Network Attack Surface

Network attack surface consists of exposed network services, APIs and websites within an organization’s internal network environment and public facing infrastructure. To scan network attack surfaces, Greenbone builds an inventory of endpoints and listening services within target IP range(s) or a list of hostnames, then scans for known vulnerabilities.

Greenbone’s network vulnerability tests (NVTs) consist of version checks and active checks. Version checks query the service for a version string and then compare it for matching CVEs. Active checks use network protocols to interact with the exposed service to verify whether known exploit techniques are effective. These active checks use the same network communication techniques as real world cyber attacks, but do not seek to exploit the vulnerability. Instead, they simply notify the security team that a particular attack is possible. Anything an attacker can reach via the internet or local network, Greenbone can scan for vulnerabilities.

Reducing Host Attack Surface

Host attack surface is the software and configurations within individual systems that cannot be accessed directly via the network. Reducing the host attack surface minimizes what an attacker can do with initial access. Greenbone’s authenticated scans conduct Local Security Checks (LSC) to assess a system’s internal components for known weaknesses and non-compliant configurations that could allow attackers to escalate their privilege level, access sensitive information, install additional malware or move laterally to other systems.

Greenbone’s Enterprise Feed includes families of LSC for each major operating system including Ubuntu, Debian, Fedora, Red Hat, Huawei, SuSE Linux distributions, Microsoft Windows, macOS and many more.

Post-Breach Tactics: the Second Stage of Cyber Intrusions

Once attackers gain a foothold within a victim’s network, they engage in secondary exploitation techniques to deepen their access and achieve their objectives. In the modern cybercrime ecosystem, Initial Access Brokers (IABs) specialize in gaining unauthorized access. IABs then sell this access to other cybercriminal groups that specialize in second-stage attack tactics such as deploying ransomware or data theft. Similar to breaching the walls of a fortress, after initial access, an organization’s internal network becomes more accessible to attackers.

Some tactics used during the second stage of cyber attack include:

  • Privilege escalation [TA0004]: Attackers seek ways to elevate their access rights, allowing them access to more sensitive data or to execute administrative actions.
  • Lateral movement [TA0008]: Attackers compromise other systems within the victim’s network, extending their access to high-value resources.
  • Persistent remote access [TA0028]: Creating new accounts, deploying backdoors or using compromised credentials, attackers seek to maintain their access even if the initial vulnerability is remediated or their presence is detected.
  • Credential theft [TA0006]: Stolen sensitive data can be processed offline by attackers attempting to crack passwords, break into protected resources or plan social engineering attacks.
  • Accessing messaging systems [T1636]: Accessing organizational messaging platforms or collaboration tools gives access to sensitive information which can be used to conduct social engineering attacks such as spear phishing, even targeting external partners or customers.
  • Encryption for impact [T1486]: Identifying critical assets, financially motivated adversaries seek to maximize impact by deploying ransomware and extorting the victim to return access to the encrypted data.
  • Data exfiltration [TA0010]: Downloading a victim’s sensitive data can be used for espionage and also gives attackers leverage to extort victims into paying to not release it publicly.
  • Denial of Service attacks [T0814]: Service disruption can be used for further extortion or as a distraction to execute other attacks within the victim’s network.

Summary

Blast radius refers to the scope of damage that an adversary imposes during a cyber attack. As attacks progress, adversaries seek to penetrate deeper, gaining access to more sensitive systems and data. Lack of cyber hygiene gives attackers free reign to steal data, deploy ransomware and cause service disruptions and complicates detection and recovery. Minimizing attack surface is crucial for reducing the potential impact of a cyber breach and helps ensure a better security outcome.

Greenbone’s core contribution to cybersecurity is to increase security visibility in real-time, alerting defenders to vulnerabilities and giving them the opportunity to close security gaps, preventing hackers from exploiting them. This includes both network attack surface: public-facing assets, internal network infrastructure, cloud assets and host attack surface: internal software applications, packages and common misconfigurations.

By delivering industry-leading vulnerability detection, Greenbone empowers real-time threat visibility, empowering defenders to proactively ensure that adversaries are decisively neutralized.

Contact Test Now Buy Here Back to Overview

/by
Greenbone AG

Availability of CVE Vulnerability Data in Greenbone Products

Greenbone AG has been consistently committed to an independent and resilient supply chain for the provision of vulnerability data for many years. Against the background of current discussions on the financing and sustainability of the CVE programme of the US organisation MITRE, we would like to inform you about our measures to ensure the continuous provision of important information about vulnerabilities in IT systems.

Since 1999, the CVE system has formed the central basis for the clear identification and classification of security vulnerabilities in IT. Funding for the central CVE database is currently secured by the US government until April 2026. Against this background, Greenbone took structural measures at an early stage to become less dependent on individual data sources.

With our OPENVAS brand, Greenbone is one of the world’s leading open source providers in the IT security ecosystem. We make an active contribution to the development of sustainable, decentralised infrastructures for the provision of vulnerability information – and are already focusing on future-proof concepts that effectively protect our customers from security risks.

Our sovereign data approach includes the following measures, among others:

  • Broad source diversification: Our Systems and our security research team monitor a large number of international information sources in order to be able to react promptly to new threats independently of the official CVE process – even if there is no official CVE entry yet.
  • Integration of alternative databases: We integrate independent vulnerability catalogues such as the European Vulnerability Database (EUVD) into our systems in order to create a stable and geographically diversified information basis.
  • Promotion of open standards: We actively support the dissemination of the CSAF standard (Common Security Advisory Framework), which enables the decentralised and federated distribution of vulnerability information.

These measures ensure that our customers retain unrestricted access to up-to-date vulnerability information, even in the event of changes in the international data ecosystem. This ensures that your IT systems remain fully protected in the future.

Greenbone stands for independent, sovereign and future-proof weak-point supply – even in a changing geopolitical environment.

Contact Test Now Buy Here Back to Overview

/by
Joseph Lee

CVE-2025-31324: An Actively Exploited Flaw Affecting SAP NetWeaver Visual Composer

CVE-2025-31324 (CVSS 9.8), published on April 24th 2025, allows unauthenticated attackers to upload executable files [CWE-434] via the NetWeaver Visual Composer component which can result in Remote Code Execution (RCE). The CVE presents a high degree of risk; many publicly available proof-of-concept (PoC) exploits [1][2][3][4][5] are available, and active attack campaigns have been alerted by multiple cybersecurity organizations [6][7][8]. Although CVE-2025-31324 was initially exploited as a zero-day vulnerability (before public disclosure), the Greenbone Enterprise Feed now includes a detection test, allowing organizations to identify vulnerable instances of SAP NetWeaver in their environment to apply mitigation.

In the past, critical severity vulnerabilities in SAP NetWeaver such as CVE-2020-6287 (aka RECON), have been exploited by initial access brokers (IAB) who then sell unauthorized access to ransomware operators. Let’s further examine the circumstances of CVE-2025-31324.

What Is SAP NetWeaver?

SAP NetWeaver is categorized as a Software Framework within SAP’s suite of enterprise technologies. It serves as the foundational integration and application platform for various SAP solutions, including SAP Enterprise Resource Planning (ERP), Customer Relationship Management (CRM), Supply Chain Management (SCM) and other core business processes. SAP NetWeaver supports a range of use cases, including running the SAP ERP Central Component (ECC), developing and deploying custom applications using ABAP (SAP’s proprietary coding language) or Java, integration of business processes and databases from SAP and non-SAP systems and integration of distributed services through Web Services or Remote Function Calls (RFCs).

Although SAP NetWeaver holds only a minute fraction of the global Software Frameworks category, with around 8,471 companies utilizing the platform, these are prominent enterprises such as Accenture, Baker Hughes, Jabil, Rockwell Automation and Wolters Kluwer. 41% of SAP NetWeaver customers are based in the United States, followed by 7% in India and 6% in Germany. Competitors to SAP NetWeaver include Oracle Fusion Middleware, MuleSoft Anypoint Platform and IBM WebSphere.

SAP NetWeaver Flaws: Hot Targets for Ransomware

CVE-2020-6287 (CVSS 10), known as RECON, is another high-profile vulnerability in SAP NetWeaver disclosed in 2020 that was actively exploited by ransomware threat actors. Following the public disclosure of the RECON vulnerability in July 2020, threat actors rapidly developed and disseminated exploit tools. A PoC exploit became available within a day, and mass scanning activities commenced shortly thereafter. Reports indicate that initial access brokers first exploited RECON and then sold access to ransomware operators and espionage actors resulting in the insolvency of at least one US company.

A Technical Description of CVE-2025-31324

CVE-2025-31324 impacts the Application Layer, specifically the Java stack of SAP NetWeaver, within the Visual Composer development environment. Exploiting CVE-2025-31324 follows a typical attack pattern for unauthenticated file upload vulnerabilities [CWE-434] to gain RCE; uploading a webshell. Attackers have been observed scanning for SAP NetWeaver Java instances to identify the presence of the /developmentserver/metadatauploader URL endpoint. If found, a specially crafted POST request is used to upload malicious executable files (e.g., .jsp webshells). Once the webshell has been uploaded, attackers can access it directly via web browser and proceed to execute arbitrary commands on the victim’s system with the privileges of the <sid>adm operating system user.

This allows access to the underlying database; attackers can modify business logic and potentially pivot to other internal systems, deploy ransomware, steal or alter financial data or exfiltrate sensitive business records. Evidence from analyzed attack campaigns also indicate that attackers are using living-off-the-land techniques (using native OS functionality) to establish persistent access without requiring the uploaded webshell.

Mitigating CVE-2025-31324 in SAP NetWeaver

SAP has issued only a brief reference to CVE-2025-31324 in their April 2025 Security Patch announcement. SAP follows a standard patch cycle for releasing updates similar to Microsoft’s monthly “Patch Tuesday”. To remediate CVE-2025-31324, ensure your SAP NetWeaver system is updated to the latest support package. If the security patch cannot be applied immediately, consider temporarily disabling the Visual Composer component to prevent exploitation until the updates can be installed.

Ideally, NetWeaver instances should not be directly exposed on the public Internet. Doing so poses significant security risks, including exposure to RCE vulnerabilities, authentication bypass flaws and unauthorized data access. In efforts to support remote work, outsourced operations or cloud hosted instances, adequate security gateways should be configured such as a secured reverse proxy, VPN or WAF controls.

It’s also important to check for Indicators of Compromise (IoC) to verify that attackers have not already exploited vulnerable NetWeaver instances. Researchers have observed webshells using filenames such as helper.jsp, cache.jsp, or other randomized filenames. Other measures to detect infection include scanning systems for the presence of malware or other unexpected files, analyzing access logs for suspicious POST requests to /developmentserver/metadatauploader and checking directories such as /irj/root, /irj/work and /irj/work/sync for unauthorized .jsp, .java or .class files. Also, scan for other IoCs related to maintaining persistence relevant to your SAP server operating system (OS).

Summary

CVE-2025-31324 is a critical vulnerability in SAP NetWeaver’s Visual Composer component that allows unauthenticated RCE via arbitrary file uploads. Exploited as a zero-day, the flaw has been used in attacks that initially infect NetWeaver instances with a webshell, then progress to total system compromise including lateral movement within enterprise network environments.

Organizations using SAP NetWeaver are strongly urged to apply SAP’s emergency patch or disable the Visual Composer component and assess systems for Indicators of Compromise to identify existing compromise and recover infected systems. The Greenbone Enterprise Feed includes a detection test, allowing organizations to identify vulnerable instances of SAP NetWeaver in their environment to apply mitigation.

Contact Test Now Buy Here Back to Overview

/by
Joseph Lee

April 2025 Threat Report: The Consequences Are Real

In the early days of digital, hacking was often fame or prank driven. Fast forward to 2025; hacking has been widely monetized for illicit gains. Cybercrime is predicted to cost the global economy 10.5 trillion Dollar in 2025. Globally, the trend of increasing geocriminality is pushing individual countries and entire economic regions [1][2] to make deeper commitments to cyber defenses. An accelerating threat environment underscores the urgency for proactive, well-funded cybersecurity strategies across all sectors, in all regions of the world.

The continuous deluge of critical vulnerabilities, novel attack techniques, active ransomware and espionage campaigns signal the need for comprehensive cybersecurity measures to prevent the most catastrophic consequences. In this month’s threat report, we will review the post pressing threats from the cybersecurity landscape that emerged in April 2025. Without further ado, let’s get started!

Considering the Consequences

Dire consequences loom for those unprepared to weather sophisticated cyber attacks. Ransomware is widely considered the biggest existential cyber threat business, but data breach lawsuits are escalating dramatically. Breach related class action filings have risen more than 1,265% over six years, with filings in the U.S. more than doubling from 604 in 2022 to 1,320 in 2023. Robust backups can help a victim escape paying ransom, and a well executed incident response plan may minimize downtime, but breach victims have little recourse from costs related to regulatory or legal action.

Equifax’s 2019 settlements are the highest in history for a cybersecurity-related incident – with a total cost estimated at 1.5 billion Dollar. Failure to patch CVE-2017-5638 in Apache Struts, was implicated as the root cause of the breach. In April 2025, U.S. defense contractor Raytheon agreed to pay an 8.5 million Dollar settlement for failing to implement required security measures for 29 of their Department of Defense (DoD) contracts.

Healthcare providers are especially hard-hit because personal healthcare information fetches roughly 1,000 Dollar per record on darkweb marketplaces, compared to 5 Dollar per record for payment card data due to its effective use in identifying fraud. In 2023, the U.S. healthcare sector reported 725 data breaches, exposing over 133 million records. Most recently, on April 23, 2025, the U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) announced a 600,000 Dollar settlement with PIH Health, Inc. due to inadequate technical safeguards. However, legal consequences for cyber breaches are impacting organizations across all industries. Data breach-related securities class actions have also seen substantial settlements, with three of the top ten largest settlements occurring in 2024, totaling 560 million Dollar.

Considering the consequences, organizations should carefully assess their posture to cyber hygiene, paying special attention to core IT security best practices such as implementing multi-factor authentication (MFA), vulnerability management and network segmentation.

Verizon: Increase in Exploited Vulnerabilities for Initial Access

Verizon’s 2025 Data Breach Investigations Report (DBIR), released in April, reported a 34% increase in exploited vulnerabilities (CVEs) as a root cause of cyberbreaches occurring in between October 2023 and December 2024. Exploited vulnerabilities served as the initial access vector in 20% data breaches studied. While the report indicates that ransom payments are down – 64% of victim organizations did not pay the ransoms, compared to 50% two years ago – the rate of ransomware attacks increased by 37%.

Edge devices and VPNs accounted for 22% of exploitation actions – a sharp rise from just 3% the year before. Despite the growing threat, organizations fully remediated only about 54% of these vulnerabilities, with a median time to remediation of 32 days. Furthermore, edge exploitation for initial access reached 70% in espionage-motivated breaches. This trend of edge device exploitation shows no signs of abating; proactive vulnerability management is more critical than ever to reduce exposure and limit the impact of breaches.

Newly Emerging Threats on the Edge in April 2025

The message from cyber landscape reports is clear: organizations need to be acutely aware of their publicly exposed assets. Detection and remediation of vulnerabilities is critical. Below are the highlights of emerging threat activity affecting network edge devices in April 2025. Greenbone is able to detect all emerging threats referenced below and more.

  • SonicWall SMA100 Appliances: CVE-2023-44221 (CVSS 7.2) and CVE-2021-20035 (CVSS 6.5), both OS Command Injection Vulnerabilities [CWE-78] were added to CISA KEV (Cybersecurity and Infrastructure Security Agency; Known Exploited Vulnerabilities). In April, SonicWall also reported that Proof-of-Concept (PoC) exploits are now publicly available for another vulnerability: CVE-2024-53704 (CVSS 9.8).
  • Ivanti Connect Secure, Policy Secure, and ZTA Gateways: CVE-2025-22457 (CVSS 9.8) is a Stack-Based Buffer Overflow [CWE-121] vulnerability now being actively exploited. Google’s Mandiant threat research group attributed attacks to UNC5221, a Chinese (state sponsored) threat actor. Security firm GreyNoise also observed a 9X increase in bots scanning for exposed Connect Secure endpoints.
  • Fortinet FortiOS and FortiProxy: CVE-2025-24472 (CVSS 9.8) is an Authentication Bypass [CWE-288] flaw that could allow a remote attacker to gain super-admin privileges via crafted CSF proxy requests. The CVE is considered actively exploited. Fortinet also detailed new exploitation activity against older critical vulnerabilities in FortiGate devices, including CVE-2022-42475, CVE-2023-27997, and CVE-2024-21762 (all CVSS 9.8).
  • Juniper Junos OS: CVE-2025-21590 (CVSS 6.7) is an actively exploited flaw that allows a local attacker with high privileges to compromise the integrity of the device. Classified as an Improper Isolation or Compartmentalization [CWE-653] weakness, a local attacker with access to the Juniper CLI shell can inject arbitrary code to compromise an affected device.
  • Multiple Cisco Flaws Exploited: Analysts confirmed targeted attacks against unpatched Cisco infrastructure, especially in telecom environments [1][2]. Chinese state-sponsored group Salt Typhoon continues to exploit CVE-2018-0171 (CVSS 9.8) in Smart Install RCE and CVE-2023-20198 (CVSS 10) in Web UI Privilege Escalation.
  • DrayTek Routers: Three CVEs have been observed in exploitation campaigns, including CVE-2020-8515 (CVSS 9.8), CVE-2021-20123 (CVSS 7.5) and CVE-2021-20124 (CVSS 7.5).
  • Microsoft Remote Desktop Gateway Service: CVE-2025-27480 is a Use After Free [CWE-416] flaw that allows an unauthorized attacker to execute code over a network. While active threats have not been observed yet, Microsoft tracks the vulnerability with an “Exploitation More Likely” status.
  • Erlang/OTP SSH has Public PoC Exploit: Multiple PoC exploits [1][2][3] are now publicly available for CVE-2025-32433 (CVSS 10), a new maximum-severity vulnerability in the Erlang/OTP SSH server. Erlang/OTP is a widely used platform for building scalable and fault-tolerant distributed systems and is in use by large technology companies such as Ericsson, Cisco, Broadcom, EMQ Technologies and Apache Software Foundation, among others.
  • Broadcom Brocade Fabric OS (FOS): CVE-2025-1976 (CVSS 6.7) is a Code Injection Vulnerability [CWE-94] both disclosed and actively exploited in April. FOS is a specialized firmware designed for managing Fibre Channel switches within Storage Area Networks (SANs). The flaw allows a local user with administrative privileges to execute arbitrary code with full root privileges.

New Windows Common Log File System Flaw Used in Ransomware Attacks

A new high severity vulnerability, CVE-2025-29824 (CVSS 7.8) identified in the Microsoft Windows Common Log File System (CLFS) driver allows privilege escalation for local authenticated attackers to gain SYSTEM level access. Furthermore, the vulnerability is being exploited globally in ransomware attacks [1][2], particularly by Storm-2460, to deploy PipeMagic malware payloads.

The Windows CLFS driver has a series of critical privilege escalation vulnerabilities that span multiple years and versions making it a persistent high-value target for attackers. Eight CVEs from 2019 through 2025 have been cataloged in the CISA KEV list with at least four – CVE-2023-28252, CVE-2023-23376, CVE-2022-24521 and CVE-2025-29824 mentioned above – known to be leveraged in ransomware campaigns.

Due to active exploitation of critical vulnerabilities in Microsoft products, it’s essential for organizations to verify that the latest Microsoft security updates have been applied across their IT infrastructure and monitor systems for Indicators of Compromise (IoC). Greenbone can detect vulnerability to all CLFS CVEs mentioned above and missing patch-levels for Microsoft Windows 10 (32-bit & x64), Windows 11 (x64) and Windows Server 2012–2025 endpoints via authenticated Local Security Checks (LSC).

Remote Code Execution Flaw Impacts Craft CMS

CVE-2025-32432 (CVSS 10) is a high impact Remote Code Execution (RCE) vulnerability in Craft CMS (Content Management System) that is considered trivial to exploit. Craft CMS is a website creation framework built on top of the Yii PHP framework. The CVE was reported by Orange Cyberdefense’s CSIRT who discovered it during an incident response. The flaw has been exploited in the wild. Also, technical details and PoC exploits [1][2] including a Metasploit module are publicly available, greatly increasing the threat. Craft CMS is used by prominent organizations including The New York Times, Amazon, Intel, Tesla, NBC, Bloomberg and JPMorgan Chase for creating custom e-commerce and content-driven websites.

Greenbone is able to detect web applications vulnerable to CVE-2025-32432 with an active check that sends a specially crafted POST request and analyzes the response. Craft CMS versions 3.x through 3.9.14, 4.x through 4.14.14, and 5.x through 5.6.16 are affected and users should upgrade to a patched version as soon as possible. If upgrade is not possible the vendor proposes implementing firewall rules to block POST requests to the `actions/assets/generate-transform` endpoint or installing the Craft CMS Security Patches library.

Dualing CVEs in CrushFTP Leveraged by Ransomware

CVE-2025-31161 (CVSS 9.8) poses a severe threat to CrushFTP users. The flaw is an authentication bypass vulnerability [CWE-287] in the HTTP Authorization header that allows remote unauthenticated attackers to authenticate as any existing user account (e.g., crushadmin). The flaw is being leveraged by the Kill threat actor among others in ongoing ransomware attacks.

CVE-2025-31161 affects CrushFTP versions 10.0.0 through 10.8.3 and 11.0.0 through 11.3.0. The vendor has released an advisory with updated instructions. Greenbone is able to detect CVE-2025-31161 with both an active check, and a version detection test.

Initially, this vulnerability was tracked with another identifier (CVE-2025-2825). When a third party CNA published it before, CrushFTP had the opportunity to assess the details. The premature disclosure forced CrushFTP to respond publicly before they had developed a patch. This incident highlights a significant risk: because CrushFTP was not a CVE Numbering Authority (CNA), it lacked the authority to assign CVE identifiers to its own products. Instead CrushFTP needed to rely on the third-party researchers who discovered the flaw to manage CVE disclosure.

In the CVE Program, a CNA can define its scope such that it may assign CVE IDs to vulnerabilities affecting its own products and restrict other parties from doing so. If an application’s vendor is a registered CNA, third-party security researchers must disclose their findings to the vendor directly, allowing more control over the timeline of events and a more strategic disclosure. Considering the risks, software vendors should consider becoming a registered CNA with MITRE’s CVE program.

Summary

April 2025 highlighted ongoing threats from edge device vulnerabilities, ransomware activity and newly exploited flaws in widely used software like Craft CMS, Microsoft CLFS and CrushFTP. These developments reinforce the need for organizations to maintain visibility over exposed assets, apply timely patches and stay vigilant against emerging threats that can escalate quickly from initial access to full compromise.

Contact Test Now Buy Here Back to Overview

/by
Joseph Lee

CVE-2025-34028: Commvault Command Center Actively Exploited for RCE

CVE-2025-34028 (CVSS 10) is a maximum severity flaw in Commvault Command Center, a popular admin console for managing IT security services such as data protection and backups across enterprise environments. As of April 28th, CVE-2025-34028 has been flagged as actively exploited. CVE-2025-34028 also presents heightened risk due to the existence of publicly available proof-of-concept (PoC) exploit code and the fact that Command Center manages the backups and other security configurations for many prominent organizations.

The flaw allows unauthenticated attackers to perform Remote Code Execution (RCE) and to take complete control of a Command Center environment. Given the sensitivity and criticality of IT tasks managed by Commvault, forfeiting complete control has a high potential for disastrous impacts. For example, if backups are disabled, an organization could lose their ability to recover from a ransomware attack. This makes CVE-2025-34028 an attractive target for ransomware operators and financially motivated attackers.

The vulnerability, discovered by Sonny Macdonald of watchTowr Labs, exploits a server-side request forgery (SSRF) [CWE-918] weakness in Command Center’s deployWebpackage.do endpoint. In a successful attack, an adversary uploads a poisoned ZIP archive to a publicly accessible path. The malicious ZIP file is automatically extracted allowing attackers to trigger execution via HTTP GET request to the extracted payload.

CVE-2025-34028 affects versions 11.38.0 to 11.38.19 on both Linux and Windows platforms. Greenbone is able to detect CVE-2025-34028 with an active check that sends a crafted HTTP POST request and checks if the target connects back to the scanner host indicating that it is vulnerable to exploitation. Users of affected versions are urged to apply patches immediately. Let’s further examine the risk posed by CVE-2025-34028.

What is Commvault Command Center?

Commvault Command Center is a web-based interface written in Java that enables organizations to manage data protection, backup, and recovery operations across enterprise environments. Commvault markets itself as a single platform with modular components such as Commvault Complete Backup & Recovery, Commvault HyperScale X and Commvault Disaster Recovery. Most of Commvault’s products rely on the Command Center as their primary management interface. As such, Command Center is used to configure backup jobs, monitor systems, restore data and administer user roles and access.

As of 2025, Commvault maintains roughly 6.2% of the Backup And Recovery market share category, serving over 10,000 organizations globally, across various industries such as banking, healthcare, government and technology. Most of its customers are large enterprises, with 42% having more than 1,000 employees. With Commvault’s adoption among critical sectors including healthcare, government and Fortune 500 companies, the potential impact of this vulnerability is widespread and significant.

A Technical Description of CVE-2025-34028

The discovery and disclosure of CVE-2025-34028 was accompanied by a full technical description and PoC code. Here is a brief summary of the root cause and attack vector for CVE-2025-34028:

The root cause of CVE-2025-34028 is classified as Server-Side Request Forgery (SSRF) [CWE-918]. SSRF vulnerabilities arise when an application is tricked into accessing a remote resource without properly validating it. By exploiting SSRF flaws, an attacker can potentially bypass access controls [CWE-284] such as firewalls that prevent the attackers from accessing the URLs directly. You can think of it as “bouncing” a request off the target in order to bypass security measures. In the case of CVE-2025-34028, the SSRF flaw allows an Unrestricted Upload of File with Dangerous Type [CWE-434].

Here is how the exploit process for CVE-2025-34028 works:

Mixed among the Command Center application endpoints, the researcher found 58 that do not require any form of authentication. Inspecting these unrestricted APIs, researchers discovered the deployWebpackage.do endpoint included a parameter named commcellName, which was used to define the hostname of a URL and which was not filtered for scope. Another parameter, servicePack, defines the local path where the HTTP response to that URL should be stored.

Using a simple directory traversal technique, i.e. prepending the servicePack parameter with “../../” the researcher was able to achieve arbitrary file upload to a custom destination. The Command Center application used a hardcoded filename dist-cc.zip, indicating that the program was expecting a ZIP archive.

When supplying a ZIP archived Java executable (.jsp file), and specifying an unauthenticated route via the servicePack param, a malicious .jsp payload was uploaded, automatically extracted, where it could be accessed directly via an HTTP GET request. This results in execution of the .jsp file by Command Center’s Apache Tomcat web server and unauthenticated, arbitrary RCE on behalf of the attacker.

Mitigating CVE-2025-34028

CVE-2025-34028 affects Commvault Command Center versions 11.38.0 through 11.38.19 on both Linux and Windows platforms and has been resolved in versions 11.38.20 and 11.38.25, with patches released on April 10, 2025. For those unable to update immediately, Commvault recommends isolating the Command Center installation from external network access as a temporary mitigation.

Commvault’s Innovation releases, which are frequent, feature-rich update tracks, are typically updated automatically by the system on a predefined schedule without requiring user action. This is in contrast to Long Term Support (LTS) versions which require manual updates.

Summary

CVE-2025-34028 is a critical severity unauthenticated RCE flaw in Commvault Command Center that doesn’t require user interaction. The vulnerability has been flagged as actively exploited by CISA as of April 2025. CVE-2025-34028 affects Command Center versions 11.38.0–11.38.19 and enables attackers to take full control of backup systems. Commvault is relied upon by many large companies globally for key backup and restoration capabilities making CVE-2025-34028 a hot target for ransomware threat actors. Greenbone is able to detect affected Command Center instances with an active test that uses an HTTP POST request to verify vulnerability.

Contact Test Now Buy Here Back to Overview

/by
Greenbone AG

Intuitive and Clear: Complete Overview of the Security Situation of Your IT Infrastructure – for all Decision-Making Levels

Our newly developed product OPENVAS REPORT integrates the data from practically any number of Greenbone Enterprise Appliances and brings it into a clearly structured dashboard. The user-friendly and comprehensive interface considerably simplifies the protection and safeguarding of even large networks.

Greenbone AG has been developing leading open source technologies for automated vulnerability management since 2008. More than 100,000 installations worldwide rely on the Greenbone community and enterprise editions to strengthen their cyber resilience.

“OPENVAS REPORT stands for innovation from the open source market leader.”

With our new product, we are decisively shortening the path from current security knowledge to the ability to act – faster, clearer and more flexible than ever before,” explains Dr. Jan-Oliver Wagner, CEO of Greenbone AG.

Recognize Hazardous Situations Faster and More Effectively

To protect your digital infrastructures, it is crucial to keep up to date with security-relevant events and to keep the response time to critical incidents as short as possible.

OPENVAS REPORT provides a daily updated, complete overview of the security situation of your IT infrastructure – for all decision-making levels.

Thanks to the connected Greenbone Enterprise Appliances, OPENVAS REPORT automatically recognizes computers and software in the company. Users can mark these with keywords and group and sort them as required – thus maintaining an overview even in very large networks.

Modern, User-friendly Dashboard

The OPENVAS REPORT Dashboard offers modern, user-friendly and highly flexible access for users who work with it on a daily basis. For example, filtering or sorting according to the general severity or specific risk of the vulnerabilities is possible. Companies can thus put together their own customized views, which always show an up-to-date picture of the risk situation in the company network.

Complete Overview

OPENVAS REPORT allows you to record and evaluate your company’s security situation at a glance. Thanks to its simple, clear user guidance, it prepares even the most complex data in a readable and understandable way, thus speeding up decision-making in critical situations.

With flexible and customizable filter options, OPENVAS REPORT considerably simplifies the day-to-day work of administrators and security officers.

Flexible Interfaces

The extensive export functions allow OPENVAS REPORT to be integrated even more deeply into the infrastructure, for example to process external data with OPENVAS REPORT.

Function Added value for your company
Comprehensive asset visibility Complete overview of all IT assets and their vulnerabilities in a single interface – for a complete assessment of your current security situation.
User-friendly dashboards A clearly structured, interactive dashboard makes complex vulnerability information understandable at a glance and accelerates well-founded decisions.
Flexible data processing A wide range of export, API and automation options can be seamlessly integrated into existing workflows and adapted to individual operational requirements.
Efficient data consolidation Aggregates results from multiple scanners and locations in a central database – reduces administrative effort and improves response time.
Customizable classification of vulnerabilities The severity levels and freely definable tags make it possible to precisely map internal compliance and risk models.
Extended reporting functions Target group-specific reports (C-Level, Audit, Operations) can be generated at the touch of a button: filters and drill-down links provide focused insights into critical security problems.

Learn More

Are you interested in a demo or a quote? Contact our sales team and find out more about OPENVAS REPORT. Write to us:sales@greenbone.net or contact us directly. We will be happy to help you!

Contact Test Now Buy Here Back to Overview

/by