Tag Archive for: Ransomware

Joseph Lee

Threat Report May 2025: Hack, Rinse, Repeat

May 2025 was a volcanic month for cybersecurity news, including several large breaches and new critical severity vulnerabilities. The Greenbone blog has already covered some major events, such as new actively exploited vulnerabilities in SAP Netweaver, Commvault Command Center and Ivanti EPMM. In total 4,014 new vulnerabilities were added to MITRE’s CVE (Common Vulnerabilities and Exposures) program. Greenbone added over 2,500 vulnerability tests to the Enterprise Feed, many capable of detecting multiple CVEs.

In this threat report for May 2025, we will round up some of the riskiest new CVEs disclosed this month, review a nation-state backed cyber campaign impacting tech companies around the world, and review how AI is poised to escalate cyber risk with intelligent automation at all stages of the Cyber Kill Chain.

The Inevitable AI-Enabled Attack Cycle: Hack, Rinse, Repeat

AI is now a force multiplier in the cyber attack lifecycle. Threat actors are leveraging AI in two fundamental ways; expediting the conversion of public vulnerability knowledge into exploit tools, and building more convincing social engineering content. Researchers have proposed a long list of additional capabilities that AI can further optimize, including automation of initial access attacks and command-and-control (C2) operations.

Even without AI, skilled human hackers can exfiltrate sensitive information within minutes of initial access. If significant vulnerabilities exist on the LAN side of a victim’s network, manual deployment of ransomware is trivial. In 2017, WannaCry demonstrated that ransomware attacks can be automated and wormable, i.e., capable of spreading between systems autonomously.

According to Norton’s latest Gen Threat Report, data-theft has increased 186% in Q1 2025. As discussed last month, data-theft-related class action filings have risen more than 1,265% over six years. When a victim’s cyber hygiene is non-compliant, multi-million dollar settlements are the norm. The top 10 data-breach class action settlements in 2023 totaled over 515 million dollars; the largest was a 350 million dollar settlement involving T-Mobile. This stolen data is often sold on the dark web, becoming fuel for subsequent cyber attacks. We should expect AI to reach full autonomy at all stages of the Cyber Kill Chain in the near future, resulting in a fully autonomous vicious cycle of exploitation; hack, rinse, repeat.

Russian GRU-Backed Espionage Campaign Hits Global Tech and Logistic Firms

CISA (Cybersecurity and Infrastructure Security Agency) and defense entities from nine other countries have warned of a cyber espionage-oriented campaign. The operation is being conducted by the Russian General Staff Main Intelligence Directorate (GRU), specifically the 85th Main Special Service Center (85th GTsSS), military unit 26165. The group is tracked under several aliases including the well-known FancyBear and APT28.

The full report outlines detailed Tactics, Techniques and Procedures (TTPs) leveraged in the campaign, which includes reconnaissance [TA0043], credential brute forcing [T1110.003], spearphishing to attain credentials and deliver malware [T1566], exploiting trust relationships to gain access [T1199], proxying attacks through compromised devices [T1665] and exploiting known software vulnerabilities – both for initial access [T1190] and privilege escalation [T1068]. The sheer diversity of attack techniques indicates a highly sophisticated threat.

The campaign targets a wide range of small office/home office (SOHO) devices, Microsoft Outlook, RoundCube Webmail and WinRAR as well as undisclosed CVEs in other internet-facing infrastructure – including corporate VPNs and SQL injection flaws. Greenbone includes detection tests for all CVEs referenced in the report. Those CVEs include:

  • CVE-2023-23397 (CVSS 9.8): A privilege escalation vulnerability in Microsoft Outlook that leverages replay of captured Net-NTLMv2 hashes.
  • CVE-2020-12641 (CVSS 9.8): Allows attackers to execute arbitrary code via shell metacharacters in a Roundcube Webmail configuration setting for `im_convert_path` or `im_identify_path`.
  • CVE-2020-35730 (CVSS 5.0): An XSS flaw in Roundcube Webmail via a plain text email message, containing a JavaScript link reference.
  • CVE-2021-44026 (CVSS 9.8): An SQL injection flaw in Roundcube via search or search_params.
  • CVE-2023-38831 (CVSS 7.8): Allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive.

DragonForce Ransomware Spreads its Wings

Emerging in mid-2023, DragonForce transitioned from a hacktivist collective into a financially motivated Ransomware-as-a-Service (RaaS) operation. Fast forward to 2025, and DragonForce has established itself as an apex threat in the ransomware ecosystem.

DragonForce ransomware attacks impacted the following countries:

  • United States – 43 confirmed incidents
  • United Kingdom – including recent May 2025 breaches of Marks & Spencer, Co-op and Harrods
  • Saudi Arabia – a data leak from a major Riyadh construction firm
  • Australia – e.g., Yakult Australia
  • Singapore – Coca-Cola operations
  • Palau – a government breach in March 2024
  • Canada – among the top five most attacked nations
  • India – has faced increased targeting, particularly in the past month

Campaigns have included exploitation of SimpleHelp remote monitoring and management (RMM) [1], Confluence Server and Data Center [2], Log4Shell (aka Log4J), Microsoft Windows vulnerabilities, as well as various flaws in Ivanti products [3]. Greenbone provides multiple active check and version detection tests for all CVEs identified in DragonForce campaigns.

DragonForce has been observed exploiting:

In line with the attack trajectory of other prominent ransomware actors, DragonForce is known to use other techniques in addition to breaching public-facing vulnerabilities such as phishing emails, credential theft, brute-force, and credential stuffing attacks on exposed services and remote management (RMM) tools like AnyDesk, Atera, and TeamViewer, for persistence and lateral movement. Therefore, organizations need comprehensive cybersecurity programs that include user awareness training to prevent social engineering attacks and regular penetration testing to simulate real-world adversarial activity.

CVE-2025-32756: Stack-Based Buffer Overflow Vulnerability in Multiple Fortinet Products

CVE-2025-32756 (CVSS 9.8), published on May 13, 2025, is a critical severity stack-based buffer overflow vulnerability [CWE-12] affecting multiple Fortinet products. It allows remote, unauthenticated attackers to execute arbitrary code via a crafted HTTP cookie. The flaw is being actively exploited in the wild – primarily against FortiVoice systems – and is linked to attacks involving malware deployment, credential theft using cron job, and network reconnaissance. Proof-of-concept details are publicly available, and a full technical analysis has been published increasing the risk factor.

Fortinet flaws have a historically high conversion rate for use in ransomware attacks. A total of 18 vulnerabilities in Fortinet products have been added to CISA Known Exploited Vulnerabilities (KEV) list since late 2021 – 11 of these are known to be leveraged by ransomware operators. In addition to CISA, several other national CERT entities have issued alerts, including CERT-EU, the Centre for Cybersecurity Belgium (CCB), and Germany’s CERT-BUND.

The root cause is a missing length check in the `cookieval_unwrap()` function of libhttputil.so. A malicious AuthHash cookie can induce memory corruption to control the return memory address, allowing an attacker to hijack execution flow at the process level. Greenbone Enterprise Feed provides a vulnerability test to detect affected products and almost 1,000 other tests for detecting other vulnerabilities in Fortinet products.

CVE-2025-32756 affects dozens of firmware versions across multiple FortiNet products, including:

  • FortiVoice (6.4.0 – 7.2.0)
  • FortiMail (7.0.0 – 7.6.2)
  • FortiNDR (1.1 – 7.6.0)
  • FortiRecorder (6.4.0 – 7.2.3)
  • all versions of FortiCamera 1.1 and 2.0 as well as 2.1.0 – 2.1.3

Fortinet advises upgrading to the latest fixed versions immediately. If patching is not feasible, users should disable the HTTP/HTTPS administrative interface to prevent successful attacks.

Trio of SysAid Flaws Now Have CVEs and Public PoC

In May, three critical-severity vulnerabilities were disclosed affecting on-premises SysAid IT Service Management (ITSM) platform. These flaws can be chained, allowing unauthenticated Remote Code Execution (RCE). Full technical details and Proof-of-Concept (PoC) were published by watchTowr. Also, considering that SysAid vulnerabilities have been targeted by ransomware operators in the past, these flaws are especially high risk.

CVE-2025-2775, CVE-2025-2776, and CVE-2025-2777 (each CVSS 9.3) are unauthenticated XML External Entity (XXE) [CWE-611] vulnerabilities, found in the Checkin, Server URL and lshw functions respectively. All allow admin account takeover and arbitrary file read on the victim’s system. SysAid On-Prem versions ≤ 23.3.40 are affected. Notably, the flaws were patched by the vendor in March, but CVE IDs were not reserved or issued. This type of scenario contributes to a less transparent threat landscape for software users, reducing visibility and complicating operational vulnerability management. Greenbone offers detection tests for all aforementioned CVEs.

SysAid has a global presence of over 10,000 customers across 140 countries, including organizations such as Coca-Cola, Panasonic, Adobe, and LG. While it holds a smaller share of the ITSM market compared to larger competitors like ServiceNow or Jira Service Management, it remains a popular solution for mid-sized businesses.

A CVSS 10 in Cisco IOS XE Wireless Controller

CVE-2025-20188 is a new critical-severity (CVSS 10) vulnerability disclosed in May 2025. It affects Cisco’s flagship platform, the Catalyst 9800 Series. Although not known to be actively exploited yet, a full technical walkthrough is now available, which will provide less sophisticated threat actors with a head start.

The root cause of the vulnerability is a hard-coded JSON Web Token (JWT) which could allow the attacker to upload files, perform path traversal, and execute arbitrary commands with root privileges via specially crafted HTTP request. Specifically, a hardcoded fallback secret – the string `notfound` – is used to verify the authenticity of a JWT if `/tmp/nginx_jwt_key` is not present.

Although this key file may be generated at certain times, such as when an administrator logs into the management console, it may not be present at certain times, such as immediately after a device reboot or service start.

Crucially, the flaw does not affect all HTTP endpoints – it is limited to the Out-of-Band Access Point (AP) Image Download feature of Cisco IOS XE Software for WLAN Controllers (WLCs). While Cisco’s advisory claims this service is not enabled by default, Horizon.ai researchers found that it was. Therefore, while there are several conditions affecting the exploitability of CVE-2025-20188, if those conditions are present, exploitation is trivial – and likely affects many organizations.

Cisco has released an advisory which recommends that affected users either upgrade to the patched version, or disable the Out-of-Band AP Image Download feature. Greenbone Enterprise Feed includes a version detection test for identifying affected devices and verifying patch level.

Summary

May 2025 delivered a surge of critical vulnerabilities, major breaches and escalating nation-state activity. It’s important to keep in mind that AI-enhanced attack cycles are destined to become a reality – the chaotic and urgent cybersecurity landscape shows no sign of easing any time soon.

New actively exploited flaws in Cisco, Fortinet, and SysAid products force organizations to maintain vigilant, continuous detection efforts, followed by prioritization and mitigation.

Greenbone’s Enterprise coverage helps security teams see vulnerabilities that threat actors can exploit to stay ahead in a fast-moving threat landscape.

Contact Test Now Buy Here Back to Overview

/by
Joseph Lee

Attackers Advance on Two New Ivanti EPMM Flaws

Just last month, CVE-2025-22457 (CVSS 9.8) affecting Ivanti Connect Secure, Policy Secure, and ZTA Gateways was recognized as a vector for ransomware. Now, two new CVEs have been added to the growing list of high-risk Ivanti vulnerabilities; CVE-2025-4427 and CVE-2025-4428 affecting Ivanti EPMM (Endpoint and Patch Management Mobile) are under active exploitation.

Greenbone includes active check and version detection tests addressing both new CVEs and many other flaws in Ivanti products, allowing users to identify vulnerable instances, proceed with the patch process and verify security compliance once patches have been applied. In this blog post we will review the technical details of both new CVEs and assess the role that Ivanti has played in the global cyber risk calculus.

Two New CVEs in Ivanti EPMM Combine for Unauthorized Access

At the time of disclosure, Ivanti admitted that on-premises EPMM customers had already been breached. However, cloud security firm Wiz claims that self-managed cloud instances have also been effectively exploited by attackers. A full technical description of the attack chain is publicly available, making exploit development easier for attackers and further increasing the risk.

Here is a brief summary of each CVE:

  • CVE-2025-4427 (CVSS 5.3): An authentication bypass in the API component of Ivanti EPMM 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API.
  • CVE-2025-4428 (CVSS 7.2): Remote Code Execution (RCE) in the API component of Ivanti EPMM 12.5.0.0 and prior allows authenticated attackers to execute arbitrary code via crafted API requests.

Ivanti has released patches to remediate the flaws. Users should update EPMM to at least version 11.12.0.5, 12.3.0.2, 12.4.0.2 or 12.5.0.1. If immediate patching is not possible, Ivanti recommends restricting API access using either the built-in Portal ACLs (Access Control Lists with the “API Connection” type) or an external WAF (Web Application Firewall). Network-based ACLs are discouraged by the vendor, since they may block some EPMM functionality. While these mitigations reduce risk, they can impact functionality for certain EPMM integrations, such as Microsoft Autopilot and Graph API. Ivanti also offers an RPM file which can be used to patch EPMM via SSH command line access.

The Invanti EPMM Exploit Chain

The exploit chain in Ivanti EPMM begins with CVE-2025-4427. Due to an insecure configuration in the application’s security.xml file, certain endpoints (specifically /rs/api/v2/featureusage) partially process requests if the format parameter is provided. This pre-auth processing allowed unauthenticated requests to access functions that should be protected. This access control flaw caused by CVE-2025-4427 sets the stage for RCE via CVE-2025-4428.

CVE-2025-4428 allows RCE via an Expression Language (EL) injection via HTTP requests. If the format parameter supplied in a request is invalid as per the EPMM’s specification (neither “cve” or “json”), its value is appended to an error message without sanitization and logged via Spring Framework’s message templating engine. By supplying specially crafted values in the format parameter, attackers can execute arbitrary Java code because the logged message is evaluated as an EL formatted string.

Researchers have pointed out these risks associated with message templating engines are well documented and rebuked Ivanti’s claims that the vulnerability was due to a flaw in a third-party library, rather than their own oversight. Also, if the conditions leading to exploitation of CVE-2025-4428 sounds familiar, it is reminiscent of the infamous Log4Shell vulnerability. Like Log4Shell, CVE-2025-4428 results from passing unsanitized user input into an expression engine which will interpret special commands from a formatted string. In the case of Log4Shell, malicious string formatting in JNDI lookups (e.g., ${jndi:ldap://…}), could trigger RCE.

Risk Assessment: Attackers Advance on Ivanti Flaws

Ivanti has been in the hot seat for the past few years. Attackers have often exploited flaws in Ivanti’s products to gain initial access to their victim’s networks. Across all product lines, the vendor has been the subject of 61 Critical severity (CVSS >= 9.0) CVEs since the start of 2023. 30 of these have been added to CISA KEV (Known Exploited Vulnerabilities of the Cybersecurity and Infrastructure Security Agency), although the true tally of actively exploited flaws may be higher. Ivanti CVEs have a high conversion rate for use in ransomware attacks; CISA notes 8 CVEs in this category.

In early 2024, the European Commission, ENISA, CERT-EU and Europol issued a joint statement addressing active exploitation of Ivanti Connect Secure and Policy Secure Gateway products. In the US, CISA directed all federal civilian agencies to disconnect these products and assume they had been breached [1][2]. CISA, the FBI and cybersecurity agencies from the UK, Australia and Canada issued a joint advisory warning of ongoing exploitation. By late 2024, CISA had also alerted to active exploitation of Ivanti Cloud Service Appliances (CSA), warning that both state-sponsored and financially motivated threat actors were successfully targeting unpatched systems.

In 2025, on January 8th, CISA warned that newly disclosed CVE-2025-0282 and CVE-2025-0283 in Ivanti Connect Secure, Policy Secure and ZTA Gateways were also under active exploitation. Unfortunately, attackers continue to advance on new flaws in Ivanti’s products well into 2025 including CVE-2025-22457 [3][4] and now, two new CVEs in EPMM discussed above.

Dennis Kozak replaced Jeff Abbott as Ivanti’s CEO effective January 1, 2025 despite a mid-2024 pledge from Mr. Abbot for improved product security. No public statement was made linking the succession to the Utah company’s security challenges, however it happened with only a few weeks’ notice. Executives have not been called to testify before US congress as many other cybersecurity leaders have following high-risk incidents including Sudhakar Ramakrishna (CEO of SolarWinds), Brad Smith (President of Microsoft) and George Kurtz (CEO of CrowdStrike).

Echoes from EPMM’s Past: CVE-2023-35078 and CVE-2023-35082

In addition to the vortex of vulnerabilities discussed above, CVE-2023-35078 (CVSS 9.8) and CVE-2023-35082 (CVSS 9.8), disclosed in July and August 2023 respectively, also provided unauthenticated RCE for Ivanti EPMM. Public exploitation kicked off almost immediately after their disclosure in 2023.

CVE-2023-35078 was exploited to breach the Norwegian government, compromising data from twelve ministries [3][4]. CISA issued an urgent advisory (AA23-214A) citing confirmed exploitation by Advanced Persistent Threat (APT) actors and advising all federal agencies to take immediate mitigation steps. Even back in 2023, the speed and breadth of the attacks underscored Ivanti’s growing profile as a repeat offender, enabling espionage and financially motivated cybercrime.

Summary

Ivanti EPMM is susceptible to two new vulnerabilities; CVE-2025-4427 and CVE-2025-4428 can be combined for unauthorized remote code execution. Now under active exploitation, they underscore a troubling pattern of high-severity flaws in Ivanti products. Ivanti has released patches to remediate the flaws and users should update EPMM to at least version 11.12.0.5, 12.3.0.2, 12.4.0.2 or 12.5.0.1.

Greenbone’s vulnerability detection capabilities extend to include tests for CVE-2025-4427 and CVE-2025-4428 allowing Ivanti EPMM users to identify all vulnerable instances and verify security compliance once patches have been applied.

/by
Greenbone AG

Greenbone Reduces the Blast Radius of a Cyber Breach

Cyber attacks, like other types of security incidents, range dramatically in scope and impact. When defenders are prepared, an incident may be contained, damage limited, and recovery swift. When caught unprepared, a single incident may result in days or weeks of downtime, lost revenue, tarnished reputation, regulatory penalties or class action settlements [1][2]. In May 2024, Change Healthcare forecasted an expected loss of 1.6 billion Dollar. As of January 2025, the total cost of the Change Healthcare ransomware attack has reached almost 3 billion Dollar [3][4].

The totality of damage caused by an IT security breach, known as the “blast radius”, depends on many factors. These factors include whether vulnerabilities are being managed, if a defense in depth approach to cybersecurity has been applied, network segmentation, effective backup strategies and more. Negligent security hygiene is an open invitation to attackers, resulting in more costly outcomes like extensive data theft, ransomware extortion and even destructive wiper attacks used for industrial sabotage. A recent report found that once inside a network, attackers now deploy ransomware within 48 minutes on average and CVE disclosures are being weaponized into exploits within 18 days.

This article explores the concept of a cyber attack “blast radius” and the role that effective Vulnerability Management plays in containing the fallout from cyber intrusions. With the right controls in place, the damage from a cyber breach can be minimized and worst-case outcomes prevented

What is the “Blast Radius” of a Cyber Breach?

The term “blast radius” is military jargon referring to the physical area damaged by an exploding bomb. In digital systems, the term similarly refers to the extent of damage caused by a cyber attack. How many systems did an attacker compromise? Were they able to subsequently compromise critical systems after initial access? Did they breach adjacent networks or cloud assets?

Far-reaching damage is not a foregone conclusion when hackers gain initial access. Defenders can effectively cut off the attack at an early stage, preventing malicious actors from achieving their ultimate objectives or causing far reaching damage.

The Consequences of a Bigger Blast Radius

While forfeiting unauthorized access to an adversary is bad, it’s the subsequent stages of an attack that keeps IT security managers up at night. The latter stages of a cyber breach such as installing malware on critical assets, exfiltrating sensitive data, or encrypting files have the most profound implications for organizations. As blast radius increases, it is much more likely that an organization will experience a significantly negative impact.

Increased blast radius can result in:

  • Longer “Dwell Time”: Lateral movement and persistence techniques can allow attackers to remain undetected for extended periods, gathering intelligence and preparing subsequent attacks.
  • Increased financial losses: Service disruptions and ransomware attacks contribute to higher financial losses, lost revenue from downtime, risk of regulatory penalties and erode business relationships.
  • Increased operational downtime: The impact of operational downtime can reverberate across an organization causing delays, frustration and desynchronizing operations.
  • Loss of sensitive data: Attackers seek to exfiltrate sensitive data to support espionage campaigns or extort victims into paying ransom.
  • Compromised trust: Unauthorized access to messaging systems or third-party assets can erode trust among stakeholders, including customers, employees and business partners.

Greenbone Reduces the Blast Radius of a Cyber Breach

Vulnerability Management is a powerful factor in reducing the so-called “blast radius”. Effective mitigation of security gaps can leave an adversary with no easily accessible means to extend their initial foothold. Vulnerability management is most efficiently and effectively implemented by automatically scanning for security weaknesses throughout a network infrastructure and remediating the attack surface. In doing so, organizations can greatly reduce the potential blast radius of a successful cyber attack and also reduce probability of being breached in the first place.

Threat Mapping helps IT security teams understand their attack surfaces, the locations where adversaries may be able to enter a network. Greenbone’s core capabilities support Threat Mapping efforts with system and service discovery scans and by scanning both network and host attack surfaces allowing defenders to reduce their attack surface by 99%. Furthermore, Greenbone provides real-time reporting and alerts to keep security teams informed of emerging threats, enabling a proactive cybersecurity posture and timely remediation. This proactive, layered approach to cybersecurity reduces the potential blast radius and results in better security outcomes. Defenders are afforded more time to detect an attacker’s presence and eliminate it before catastrophic damage can be done.

The Strongest Defenses with Greenbone Enterprise Feed

The strongest defenses come from Greenbone’s industry leading Enterprise Vulnerability Feed. In total, the Greenbone Enterprise Feed has approximately 180,000 vulnerability tests and counting which can detect both general security compliance weaknesses and application specific vulnerabilities. Our Enterprise Feed adds hundreds of new tests each week to detect the newest emerging threats.

Here is a list of IT assets that Greenbone is designed to scan:

  • Internal network infrastructure: Scanning internal network devices with any type of exposed service, such as databases, file shares, SNMP enabled devices, firewalls, routers, VPN gateways and more.
  • On-premises and cloud servers: Attesting server configurations to ensure compliance with security policies and standards.
  • Workstations: Greenbone scans workstations and other endpoints across all major operating system (Windows, Linux, and macOS) to identify the presence of known software vulnerabilities attesting compliance with cybersecurity standards like CIS Benchmark
  • IoT and peripheral devices: IoT and peripheral devices, such as printers, use the same network protocols for communication as other network services. This allows them to be easily scanned for device and application specific vulnerabilities and common misconfigurations similarly to other network endpoints.

Reducing Network Attack Surface

Network attack surface consists of exposed network services, APIs and websites within an organization’s internal network environment and public facing infrastructure. To scan network attack surfaces, Greenbone builds an inventory of endpoints and listening services within target IP range(s) or a list of hostnames, then scans for known vulnerabilities.

Greenbone’s network vulnerability tests (NVTs) consist of version checks and active checks. Version checks query the service for a version string and then compare it for matching CVEs. Active checks use network protocols to interact with the exposed service to verify whether known exploit techniques are effective. These active checks use the same network communication techniques as real world cyber attacks, but do not seek to exploit the vulnerability. Instead, they simply notify the security team that a particular attack is possible. Anything an attacker can reach via the internet or local network, Greenbone can scan for vulnerabilities.

Reducing Host Attack Surface

Host attack surface is the software and configurations within individual systems that cannot be accessed directly via the network. Reducing the host attack surface minimizes what an attacker can do with initial access. Greenbone’s authenticated scans conduct Local Security Checks (LSC) to assess a system’s internal components for known weaknesses and non-compliant configurations that could allow attackers to escalate their privilege level, access sensitive information, install additional malware or move laterally to other systems.

Greenbone’s Enterprise Feed includes families of LSC for each major operating system including Ubuntu, Debian, Fedora, Red Hat, Huawei, SuSE Linux distributions, Microsoft Windows, macOS and many more.

Post-Breach Tactics: the Second Stage of Cyber Intrusions

Once attackers gain a foothold within a victim’s network, they engage in secondary exploitation techniques to deepen their access and achieve their objectives. In the modern cybercrime ecosystem, Initial Access Brokers (IABs) specialize in gaining unauthorized access. IABs then sell this access to other cybercriminal groups that specialize in second-stage attack tactics such as deploying ransomware or data theft. Similar to breaching the walls of a fortress, after initial access, an organization’s internal network becomes more accessible to attackers.

Some tactics used during the second stage of cyber attack include:

  • Privilege escalation [TA0004]: Attackers seek ways to elevate their access rights, allowing them access to more sensitive data or to execute administrative actions.
  • Lateral movement [TA0008]: Attackers compromise other systems within the victim’s network, extending their access to high-value resources.
  • Persistent remote access [TA0028]: Creating new accounts, deploying backdoors or using compromised credentials, attackers seek to maintain their access even if the initial vulnerability is remediated or their presence is detected.
  • Credential theft [TA0006]: Stolen sensitive data can be processed offline by attackers attempting to crack passwords, break into protected resources or plan social engineering attacks.
  • Accessing messaging systems [T1636]: Accessing organizational messaging platforms or collaboration tools gives access to sensitive information which can be used to conduct social engineering attacks such as spear phishing, even targeting external partners or customers.
  • Encryption for impact [T1486]: Identifying critical assets, financially motivated adversaries seek to maximize impact by deploying ransomware and extorting the victim to return access to the encrypted data.
  • Data exfiltration [TA0010]: Downloading a victim’s sensitive data can be used for espionage and also gives attackers leverage to extort victims into paying to not release it publicly.
  • Denial of Service attacks [T0814]: Service disruption can be used for further extortion or as a distraction to execute other attacks within the victim’s network.

Summary

Blast radius refers to the scope of damage that an adversary imposes during a cyber attack. As attacks progress, adversaries seek to penetrate deeper, gaining access to more sensitive systems and data. Lack of cyber hygiene gives attackers free reign to steal data, deploy ransomware and cause service disruptions and complicates detection and recovery. Minimizing attack surface is crucial for reducing the potential impact of a cyber breach and helps ensure a better security outcome.

Greenbone’s core contribution to cybersecurity is to increase security visibility in real-time, alerting defenders to vulnerabilities and giving them the opportunity to close security gaps, preventing hackers from exploiting them. This includes both network attack surface: public-facing assets, internal network infrastructure, cloud assets and host attack surface: internal software applications, packages and common misconfigurations.

By delivering industry-leading vulnerability detection, Greenbone empowers real-time threat visibility, empowering defenders to proactively ensure that adversaries are decisively neutralized.

Contact Test Now Buy Here Back to Overview

/by
Joseph Lee

April 2025 Threat Report: The Consequences Are Real

In the early days of digital, hacking was often fame or prank driven. Fast forward to 2025; hacking has been widely monetized for illicit gains. Cybercrime is predicted to cost the global economy 10.5 trillion Dollar in 2025. Globally, the trend of increasing geocriminality is pushing individual countries and entire economic regions [1][2] to make deeper commitments to cyber defenses. An accelerating threat environment underscores the urgency for proactive, well-funded cybersecurity strategies across all sectors, in all regions of the world.

The continuous deluge of critical vulnerabilities, novel attack techniques, active ransomware and espionage campaigns signal the need for comprehensive cybersecurity measures to prevent the most catastrophic consequences. In this month’s threat report, we will review the post pressing threats from the cybersecurity landscape that emerged in April 2025. Without further ado, let’s get started!

Considering the Consequences

Dire consequences loom for those unprepared to weather sophisticated cyber attacks. Ransomware is widely considered the biggest existential cyber threat business, but data breach lawsuits are escalating dramatically. Breach related class action filings have risen more than 1,265% over six years, with filings in the U.S. more than doubling from 604 in 2022 to 1,320 in 2023. Robust backups can help a victim escape paying ransom, and a well executed incident response plan may minimize downtime, but breach victims have little recourse from costs related to regulatory or legal action.

Equifax’s 2019 settlements are the highest in history for a cybersecurity-related incident – with a total cost estimated at 1.5 billion Dollar. Failure to patch CVE-2017-5638 in Apache Struts, was implicated as the root cause of the breach. In April 2025, U.S. defense contractor Raytheon agreed to pay an 8.5 million Dollar settlement for failing to implement required security measures for 29 of their Department of Defense (DoD) contracts.

Healthcare providers are especially hard-hit because personal healthcare information fetches roughly 1,000 Dollar per record on darkweb marketplaces, compared to 5 Dollar per record for payment card data due to its effective use in identifying fraud. In 2023, the U.S. healthcare sector reported 725 data breaches, exposing over 133 million records. Most recently, on April 23, 2025, the U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) announced a 600,000 Dollar settlement with PIH Health, Inc. due to inadequate technical safeguards. However, legal consequences for cyber breaches are impacting organizations across all industries. Data breach-related securities class actions have also seen substantial settlements, with three of the top ten largest settlements occurring in 2024, totaling 560 million Dollar.

Considering the consequences, organizations should carefully assess their posture to cyber hygiene, paying special attention to core IT security best practices such as implementing multi-factor authentication (MFA), vulnerability management and network segmentation.

Verizon: Increase in Exploited Vulnerabilities for Initial Access

Verizon’s 2025 Data Breach Investigations Report (DBIR), released in April, reported a 34% increase in exploited vulnerabilities (CVEs) as a root cause of cyberbreaches occurring in between October 2023 and December 2024. Exploited vulnerabilities served as the initial access vector in 20% data breaches studied. While the report indicates that ransom payments are down – 64% of victim organizations did not pay the ransoms, compared to 50% two years ago – the rate of ransomware attacks increased by 37%.

Edge devices and VPNs accounted for 22% of exploitation actions – a sharp rise from just 3% the year before. Despite the growing threat, organizations fully remediated only about 54% of these vulnerabilities, with a median time to remediation of 32 days. Furthermore, edge exploitation for initial access reached 70% in espionage-motivated breaches. This trend of edge device exploitation shows no signs of abating; proactive vulnerability management is more critical than ever to reduce exposure and limit the impact of breaches.

Newly Emerging Threats on the Edge in April 2025

The message from cyber landscape reports is clear: organizations need to be acutely aware of their publicly exposed assets. Detection and remediation of vulnerabilities is critical. Below are the highlights of emerging threat activity affecting network edge devices in April 2025. Greenbone is able to detect all emerging threats referenced below and more.

  • SonicWall SMA100 Appliances: CVE-2023-44221 (CVSS 7.2) and CVE-2021-20035 (CVSS 6.5), both OS Command Injection Vulnerabilities [CWE-78] were added to CISA KEV (Cybersecurity and Infrastructure Security Agency; Known Exploited Vulnerabilities). In April, SonicWall also reported that Proof-of-Concept (PoC) exploits are now publicly available for another vulnerability: CVE-2024-53704 (CVSS 9.8).
  • Ivanti Connect Secure, Policy Secure, and ZTA Gateways: CVE-2025-22457 (CVSS 9.8) is a Stack-Based Buffer Overflow [CWE-121] vulnerability now being actively exploited. Google’s Mandiant threat research group attributed attacks to UNC5221, a Chinese (state sponsored) threat actor. Security firm GreyNoise also observed a 9X increase in bots scanning for exposed Connect Secure endpoints.
  • Fortinet FortiOS and FortiProxy: CVE-2025-24472 (CVSS 9.8) is an Authentication Bypass [CWE-288] flaw that could allow a remote attacker to gain super-admin privileges via crafted CSF proxy requests. The CVE is considered actively exploited. Fortinet also detailed new exploitation activity against older critical vulnerabilities in FortiGate devices, including CVE-2022-42475, CVE-2023-27997, and CVE-2024-21762 (all CVSS 9.8).
  • Juniper Junos OS: CVE-2025-21590 (CVSS 6.7) is an actively exploited flaw that allows a local attacker with high privileges to compromise the integrity of the device. Classified as an Improper Isolation or Compartmentalization [CWE-653] weakness, a local attacker with access to the Juniper CLI shell can inject arbitrary code to compromise an affected device.
  • Multiple Cisco Flaws Exploited: Analysts confirmed targeted attacks against unpatched Cisco infrastructure, especially in telecom environments [1][2]. Chinese state-sponsored group Salt Typhoon continues to exploit CVE-2018-0171 (CVSS 9.8) in Smart Install RCE and CVE-2023-20198 (CVSS 10) in Web UI Privilege Escalation.
  • DrayTek Routers: Three CVEs have been observed in exploitation campaigns, including CVE-2020-8515 (CVSS 9.8), CVE-2021-20123 (CVSS 7.5) and CVE-2021-20124 (CVSS 7.5).
  • Microsoft Remote Desktop Gateway Service: CVE-2025-27480 is a Use After Free [CWE-416] flaw that allows an unauthorized attacker to execute code over a network. While active threats have not been observed yet, Microsoft tracks the vulnerability with an “Exploitation More Likely” status.
  • Erlang/OTP SSH has Public PoC Exploit: Multiple PoC exploits [1][2][3] are now publicly available for CVE-2025-32433 (CVSS 10), a new maximum-severity vulnerability in the Erlang/OTP SSH server. Erlang/OTP is a widely used platform for building scalable and fault-tolerant distributed systems and is in use by large technology companies such as Ericsson, Cisco, Broadcom, EMQ Technologies and Apache Software Foundation, among others.
  • Broadcom Brocade Fabric OS (FOS): CVE-2025-1976 (CVSS 6.7) is a Code Injection Vulnerability [CWE-94] both disclosed and actively exploited in April. FOS is a specialized firmware designed for managing Fibre Channel switches within Storage Area Networks (SANs). The flaw allows a local user with administrative privileges to execute arbitrary code with full root privileges.

New Windows Common Log File System Flaw Used in Ransomware Attacks

A new high severity vulnerability, CVE-2025-29824 (CVSS 7.8) identified in the Microsoft Windows Common Log File System (CLFS) driver allows privilege escalation for local authenticated attackers to gain SYSTEM level access. Furthermore, the vulnerability is being exploited globally in ransomware attacks [1][2], particularly by Storm-2460, to deploy PipeMagic malware payloads.

The Windows CLFS driver has a series of critical privilege escalation vulnerabilities that span multiple years and versions making it a persistent high-value target for attackers. Eight CVEs from 2019 through 2025 have been cataloged in the CISA KEV list with at least four – CVE-2023-28252, CVE-2023-23376, CVE-2022-24521 and CVE-2025-29824 mentioned above – known to be leveraged in ransomware campaigns.

Due to active exploitation of critical vulnerabilities in Microsoft products, it’s essential for organizations to verify that the latest Microsoft security updates have been applied across their IT infrastructure and monitor systems for Indicators of Compromise (IoC). Greenbone can detect vulnerability to all CLFS CVEs mentioned above and missing patch-levels for Microsoft Windows 10 (32-bit & x64), Windows 11 (x64) and Windows Server 2012–2025 endpoints via authenticated Local Security Checks (LSC).

Remote Code Execution Flaw Impacts Craft CMS

CVE-2025-32432 (CVSS 10) is a high impact Remote Code Execution (RCE) vulnerability in Craft CMS (Content Management System) that is considered trivial to exploit. Craft CMS is a website creation framework built on top of the Yii PHP framework. The CVE was reported by Orange Cyberdefense’s CSIRT who discovered it during an incident response. The flaw has been exploited in the wild. Also, technical details and PoC exploits [1][2] including a Metasploit module are publicly available, greatly increasing the threat. Craft CMS is used by prominent organizations including The New York Times, Amazon, Intel, Tesla, NBC, Bloomberg and JPMorgan Chase for creating custom e-commerce and content-driven websites.

Greenbone is able to detect web applications vulnerable to CVE-2025-32432 with an active check that sends a specially crafted POST request and analyzes the response. Craft CMS versions 3.x through 3.9.14, 4.x through 4.14.14, and 5.x through 5.6.16 are affected and users should upgrade to a patched version as soon as possible. If upgrade is not possible the vendor proposes implementing firewall rules to block POST requests to the `actions/assets/generate-transform` endpoint or installing the Craft CMS Security Patches library.

Dualing CVEs in CrushFTP Leveraged by Ransomware

CVE-2025-31161 (CVSS 9.8) poses a severe threat to CrushFTP users. The flaw is an authentication bypass vulnerability [CWE-287] in the HTTP Authorization header that allows remote unauthenticated attackers to authenticate as any existing user account (e.g., crushadmin). The flaw is being leveraged by the Kill threat actor among others in ongoing ransomware attacks.

CVE-2025-31161 affects CrushFTP versions 10.0.0 through 10.8.3 and 11.0.0 through 11.3.0. The vendor has released an advisory with updated instructions. Greenbone is able to detect CVE-2025-31161 with both an active check, and a version detection test.

Initially, this vulnerability was tracked with another identifier (CVE-2025-2825). When a third party CNA published it before, CrushFTP had the opportunity to assess the details. The premature disclosure forced CrushFTP to respond publicly before they had developed a patch. This incident highlights a significant risk: because CrushFTP was not a CVE Numbering Authority (CNA), it lacked the authority to assign CVE identifiers to its own products. Instead CrushFTP needed to rely on the third-party researchers who discovered the flaw to manage CVE disclosure.

In the CVE Program, a CNA can define its scope such that it may assign CVE IDs to vulnerabilities affecting its own products and restrict other parties from doing so. If an application’s vendor is a registered CNA, third-party security researchers must disclose their findings to the vendor directly, allowing more control over the timeline of events and a more strategic disclosure. Considering the risks, software vendors should consider becoming a registered CNA with MITRE’s CVE program.

Summary

April 2025 highlighted ongoing threats from edge device vulnerabilities, ransomware activity and newly exploited flaws in widely used software like Craft CMS, Microsoft CLFS and CrushFTP. These developments reinforce the need for organizations to maintain visibility over exposed assets, apply timely patches and stay vigilant against emerging threats that can escalate quickly from initial access to full compromise.

Contact Test Now Buy Here Back to Overview

/by
Joseph Lee

CVE-2025-34028: Commvault Command Center Actively Exploited for RCE

CVE-2025-34028 (CVSS 10) is a maximum severity flaw in Commvault Command Center, a popular admin console for managing IT security services such as data protection and backups across enterprise environments. As of April 28th, CVE-2025-34028 has been flagged as actively exploited. CVE-2025-34028 also presents heightened risk due to the existence of publicly available proof-of-concept (PoC) exploit code and the fact that Command Center manages the backups and other security configurations for many prominent organizations.

The flaw allows unauthenticated attackers to perform Remote Code Execution (RCE) and to take complete control of a Command Center environment. Given the sensitivity and criticality of IT tasks managed by Commvault, forfeiting complete control has a high potential for disastrous impacts. For example, if backups are disabled, an organization could lose their ability to recover from a ransomware attack. This makes CVE-2025-34028 an attractive target for ransomware operators and financially motivated attackers.

The vulnerability, discovered by Sonny Macdonald of watchTowr Labs, exploits a server-side request forgery (SSRF) [CWE-918] weakness in Command Center’s deployWebpackage.do endpoint. In a successful attack, an adversary uploads a poisoned ZIP archive to a publicly accessible path. The malicious ZIP file is automatically extracted allowing attackers to trigger execution via HTTP GET request to the extracted payload.

CVE-2025-34028 affects versions 11.38.0 to 11.38.19 on both Linux and Windows platforms. Greenbone is able to detect CVE-2025-34028 with an active check that sends a crafted HTTP POST request and checks if the target connects back to the scanner host indicating that it is vulnerable to exploitation. Users of affected versions are urged to apply patches immediately. Let’s further examine the risk posed by CVE-2025-34028.

What is Commvault Command Center?

Commvault Command Center is a web-based interface written in Java that enables organizations to manage data protection, backup, and recovery operations across enterprise environments. Commvault markets itself as a single platform with modular components such as Commvault Complete Backup & Recovery, Commvault HyperScale X and Commvault Disaster Recovery. Most of Commvault’s products rely on the Command Center as their primary management interface. As such, Command Center is used to configure backup jobs, monitor systems, restore data and administer user roles and access.

As of 2025, Commvault maintains roughly 6.2% of the Backup And Recovery market share category, serving over 10,000 organizations globally, across various industries such as banking, healthcare, government and technology. Most of its customers are large enterprises, with 42% having more than 1,000 employees. With Commvault’s adoption among critical sectors including healthcare, government and Fortune 500 companies, the potential impact of this vulnerability is widespread and significant.

A Technical Description of CVE-2025-34028

The discovery and disclosure of CVE-2025-34028 was accompanied by a full technical description and PoC code. Here is a brief summary of the root cause and attack vector for CVE-2025-34028:

The root cause of CVE-2025-34028 is classified as Server-Side Request Forgery (SSRF) [CWE-918]. SSRF vulnerabilities arise when an application is tricked into accessing a remote resource without properly validating it. By exploiting SSRF flaws, an attacker can potentially bypass access controls [CWE-284] such as firewalls that prevent the attackers from accessing the URLs directly. You can think of it as “bouncing” a request off the target in order to bypass security measures. In the case of CVE-2025-34028, the SSRF flaw allows an Unrestricted Upload of File with Dangerous Type [CWE-434].

Here is how the exploit process for CVE-2025-34028 works:

Mixed among the Command Center application endpoints, the researcher found 58 that do not require any form of authentication. Inspecting these unrestricted APIs, researchers discovered the deployWebpackage.do endpoint included a parameter named commcellName, which was used to define the hostname of a URL and which was not filtered for scope. Another parameter, servicePack, defines the local path where the HTTP response to that URL should be stored.

Using a simple directory traversal technique, i.e. prepending the servicePack parameter with “../../” the researcher was able to achieve arbitrary file upload to a custom destination. The Command Center application used a hardcoded filename dist-cc.zip, indicating that the program was expecting a ZIP archive.

When supplying a ZIP archived Java executable (.jsp file), and specifying an unauthenticated route via the servicePack param, a malicious .jsp payload was uploaded, automatically extracted, where it could be accessed directly via an HTTP GET request. This results in execution of the .jsp file by Command Center’s Apache Tomcat web server and unauthenticated, arbitrary RCE on behalf of the attacker.

Mitigating CVE-2025-34028

CVE-2025-34028 affects Commvault Command Center versions 11.38.0 through 11.38.19 on both Linux and Windows platforms and has been resolved in versions 11.38.20 and 11.38.25, with patches released on April 10, 2025. For those unable to update immediately, Commvault recommends isolating the Command Center installation from external network access as a temporary mitigation.

Commvault’s Innovation releases, which are frequent, feature-rich update tracks, are typically updated automatically by the system on a predefined schedule without requiring user action. This is in contrast to Long Term Support (LTS) versions which require manual updates.

Summary

CVE-2025-34028 is a critical severity unauthenticated RCE flaw in Commvault Command Center that doesn’t require user interaction. The vulnerability has been flagged as actively exploited by CISA as of April 2025. CVE-2025-34028 affects Command Center versions 11.38.0–11.38.19 and enables attackers to take full control of backup systems. Commvault is relied upon by many large companies globally for key backup and restoration capabilities making CVE-2025-34028 a hot target for ransomware threat actors. Greenbone is able to detect affected Command Center instances with an active test that uses an HTTP POST request to verify vulnerability.

Contact Test Now Buy Here Back to Overview

/by
Joseph Lee

March 2025 Threat Report: Who Do You Trust?

When it comes to protecting your organization from digital threats, who should you trust? Reality dictates that high-resilience IT security is forged from a network of strong partnerships, defense in depth; layered security controls, and regular auditing. Defensive posture needs to be monitored, measured and continuously improved. While vulnerability management has always been a core security control, it is nonetheless a fast moving target. In 2025, continuous and prioritized mitigation of security threats can have a big impact on security outcomes as adversarial time-to-exploit diminishes.

In March 2025’s monthly Threat Report, we will highlight the importance of vulnerability management and Greenbone’s industry leading vulnerability detection by reviewing the most recent critical threats. But these new threats only scratch the surface. In March 2025, Greenbone added 5,283 new vulnerability tests to our Enterprise Feed. Let’s jump into some of the important insights from a highly active threat landscape.

The US Treasury Breach: How Did It Happen?

In late December 2024, the U.S. Treasury Department disclosed that its network was breached by Chinese state-backed hackers and subsequently leveraged sanctions in early January 2025. Forensic investigations have tracked the root-cause to a stolen BeyondTrust API key. The vendor has acknowledged 17 other customers breached by this flaw. Deeper investigation has revealed that the API key was stolen via a flaw in a PostgreSQL built-in function for escaping untrusted input.

When invalid two-byte UTF-8 characters are submitted to a vulnerable PostgreSQL function, only the first byte is escaped, allowing a single quote to pass through unsanitized which can be leveraged to trigger an SQL Injection [CWE-89] attack. The exploitable functions are PQescapeLiteral(), PQescapeIdentifier(), PQescapeString() und PQescapeStringConn(). All versions of PostgreSQL before 17.3, 16.7, 15.11, 14.16, and 13.19 are affected as well as numerous products that depend on these functions.

CVE-2024-12356, (CVSS 9.8) and CVE-2024-12686, (CVSS 7.2) have been issued for BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) and CVE-2025-1094 (CVSS 8.1) addresses the flaw in PostgreSQL. The issue is the subject of several national CERT advisories including Germany’s BSI Cert-Bund (WID-SEC-2024-3726) and the Canadian Centre for Cybersecurity (AV25-084). The flaw has been added to CISA’s known exploited vulnerabilities (KEV) list, and a Metasploit module that exploits vulnerable BeyondTrust products is available, increasing the risk. Greenbone is able to detect the CVEs (Common Vulnerabilities and Exposures) discussed above both in BeyondTrust products or instances of PostgreSQL vulnerable to CVE-2025-1094.

Advanced fined 3.1 Million Pound for Lack of Technical Controls

This month, the UK’s Information Commissioner’s Office (ICO) imposed a 3.07 million Pound fine on Advanced Computer Software Group Ltd. under the UK GDPR for security failures. The case is evidence of how the financial damage caused by a ransomware attack can be further exacerbated by regulatory fines. The initial proposed amount was even higher at 6.09 million Pound. However, since the victim exhibited post-incident cooperation with the NCSC (National Cyber Security Centre), NCA (National Crime Agency) and NHS (National Health Service), a voluntary settlement of 3,076,320 Pound was approved. While operational costs and extortion payments have not been publicly disclosed, they likely add between 10 to 20 million Pound to the incident’s total costs.

Advanced is a major IT and software provider to healthcare organizations including the NHS. In August 2022, Advanced was compromised, attackers gained access to its health and care subsidiary resulting in a serious ransomware incident. The breach disrupted critical services including NHS 111 and prevented healthcare staff from accessing personal data on 79,404 individuals, including sensitive care information.

The ICO concluded that Advanced had incomplete MFA coverage, lacked comprehensive vulnerability scanning and had deficient patch management practices at the time of the incident – factors that collectively represented a failure to implement appropriate technical and organizational measures. Organizations processing sensitive data must treat security controls as non-negotiable. Inadequate patch management remains one of the most exploited gaps in modern attack chains.

Double Trouble: Backups Are Critical to Ransomware Mitigation

Backups are an organization’s last defense against ransomware and most sophisticated advanced persistent threat (APT) actors are known to target their victim’s backups. If a victim’s backups are compromised, submission to ransom demands is more likely. In 2025, this could mean multi-million Dollar losses. In March 2025, two new significant threats to backup services were revealed; CVE-2025-23120, a new critical severity flaw in Veeam was disclosed, and campaigns targeting CVE-2024-48248 in NAKIVO Backup & Replication were observed. Identifying affected systems and patching them is therefore an urgent matter.

In October 2024, our threat report alerted about another vulnerability in Veeam (CVE-2024-40711) being used in ransomware attacks. Overall, CVEs in Veeam Backup and Replication have a high conversion rate for active exploitation, PoC (Proof of Concept) exploits, and use in ransomware attacks. Here are the details for both emerging threats:

  • CVE-2024-48248 (CVSS 8.6): Versions of NAKIVO Backup & Replication before 11.0.0.88174 allow unauthorized Remote Code Execution (RCE) via a function called getImageByPath which allows files to be read remotely. This includes database files containing cleartext credentials for each system that NAKIVO connects to and backs up. A full technical description and proof-of-concept is available and this vulnerability is now tracked as actively exploited.
  • CVE-2025-23120 (CVSS 9.9): Attackers with domain user access can trigger deserialization of attacker-controlled data through the .NET Remoting Channel. Veeam attempts to restrict dangerous types via a blacklist, but researchers discovered exploitable classes (xmlFrameworkDs and BackupSummary) not on the list. These extend .NET’s DataSet class – a well-known RCE vector – allowing arbitrary code execution as SYSTEM on the backup server. The flaw is the subject of national CERT alerts globally including HK, CERT.be, and CERT-In. As per Veeam’s advisory, upgrading to version 12.3.1 is the recommended way to mitigate the vulnerability.

Greenbone is able to detect vulnerable NAKIVO and Veeam instances. Our Enterprise Feed has an active check [1] and version check [2] for CVE-2024-48248 in NAKIVO Backup & Replication, and a remote version check [3] for the Veeam flaw.

IngressNightmare: Unauthenticated Takeover in 43% of Kubernetes Clusters

Kubernetes is the most popular enterprise container orchestration tool globally. Its Ingress feature is a networking component that manages external access to services within a cluster, typically HTTP and HTTPS traffic. A vulnerability dubbed IngressNightmare has exposed an estimated 43% of Kubernetes clusters to unauthenticated remote access – approximately 6,500 clusters, including Fortune 500 companies.

The root-cause is excessive default privileges [CWE-250] and unrestricted network accessibility [CWE-284] in the Ingress-NGINX Controller tool, based on NGINX reverse proxy. IngressNightmare allows attackers to gain complete unauthorized control over workloads, APIs or sensitive resources in multi-tenant and production-grade clusters. A full technical analysis is available from the researchers at Wiz, who pointed out that K8 Admission Controllers are directly accessible without authentication by default, presenting an appealing attack surface to hackers.

The full attack trajectory to achieve arbitrary RCE against an affected K8 instance requires exploiting Ingress-NGINX. First, CVE-2025-1974 (CVSS 9.8) to upload a binary payload as the request body. It should be larger than 8kb in size while specifying a Content-Length header larger than the actual content size. This triggers NGINX to store the request body as a file, and the incorrect Content-Length header means the file will not be deleted as the server waits for more data [CWE-459].

The second stage of this attack requires exploiting CVE-2025-1097, CVE-2025-1098, or CVE-2025-24514 (CVSS 8.8). These CVEs all similarly fail to properly sanitize input [CWE-20] submitted to Admission Controllers. Ingress-NGINX converts Ingress objects to configuration files and validates them with the nginx -t command, allowing attackers to execute a limited set of NGINX configuration directives. Researchers found the ssl_engine module can be triggered to load the shared library binary payload uploaded in the first stage. Although exploitation is not trivial and no public PoC code exists yet, sophisticated threat actors will easily convert the technical analysis into effective exploits.

The Canadian Centre for Cyber Security has issued a CERT advisory (AV25-161) for IngressNightmare. Patched Ingress-NGINX versions 1.12.1 and 1.11.5 are available and users should upgrade as soon as possible. If upgrading the Ingress NGINX Controller is not immediately possible, temporary workarounds can help reduce risk. Strict network policies can restrict access to a cluster’s Admission Controllers allowing access to only the Kubernetes API Server. Alternatively, the Admission Controller component of Ingress-NGINX can be disabled entirely.

Greenbone is able to detect IngressNightmare vulnerabilities with an active check that verifies the presence of all CVEs mentioned above [1][2].

CVE-2025-29927: Next.js Framework Under Attack

A new vulnerability in Next.js, CVE-2025-29927 (CVSS 9.4) is considered high risk due the framework’s popularity and the simplicity of exploitation [1][2]. Adding to the risk, PoC exploit code is publicly available and Akamai researchers have observed active scans probing the Internet for vulnerable apps. Several national CERTs (Computer Emergency Response Teams) have issued alerts for the issue including CERT.NZ, Australian Signals Directorate (ASD), Germany’s BSI Cert-Bund (WID-SEC-2025-062), and the Canadian Centre for Cyber Security (AV25-162).

Next.js is a React middleware framework for building full-stack web applications. Middleware refers to components that sit between two or more systems and handle communication and orchestration. For web-applications, middleware converts incoming HTTP requests into responses and is often also responsible for authentication and authorization. Due to CVE-2025-29927, attackers can bypass Next.js middleware authentication and authorization simply by setting a malicious HTTP header.

If using HTTP headers seems like a bad idea for managing a web application’s internal process flow, CVE-2025-29927 is the evidence. Considering user-provided headers were not correctly distinguished from internal ones, this vulnerability should attain the status of egregious negligence. Attackers can bypass authentication by simply adding the `x‑middleware‑subrequest` header to a request and overloading it with at least as many values as the MAX_RECURSION_DEPTH which is 5. For example:

`x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware`

The flaw is fixed in Next.js versions 15.2.3, 14.2.25, 13.5.9 and 12.3.5, and users should follow the vendor’s upgrade guide. If upgrading is infeasible, it is recommended to filter the `x-middleware-subrequest` header from HTTP requests. Greenbone is able to detect vulnerable instances of Next.js with an active check and a version check.

Summary

The March 2025 threat landscape was shaped by vulnerable and actively exploited backup systems, unforgivably weak authentication logic, high-profile regulatory fines and numerous other critical software vulnerabilities. From the U.S. Treasury breach to the Advanced ransomware fallout, the theme is clear: trust doesn’t grow on trees. Cybersecurity resilience must be earned; forged through layered security controls and backed up by accountability.

Greenbone continues to play a vital role by providing timely detection tests for new emerging threats and standardized compliance audits that support a wide array of enterprise architectures. Organizations that want to stay ahead of cyber crime need to proactively scan their infrastructure and close security gaps as they appear.

Contact Test Now Buy Here Back to Overview

/by
Joseph Lee

Escalating Attacks Targeting CVE-2024-4577 in PHP-CGI for Windows

CVE-2024-4577 (CVSS 9.8 Critical) is currently climbing the winners’ podium of the most malicious security vulnerabilities. Disclosed in early June 2024 by Devcore security researchers, weaponization began within a mere 48 hours. It is a PHP-CGI OS Command Injection vulnerability [CWE-78] impacting PHP for Windows. Attacks distributing “TellYouThePass” ransomware were immediately observed and the CVE added to CISA’s KEV list (Known Exploited Vulnerabilities of the Cybersecurity and Infrastructure Security Agency). Several months later, exploitation of CVE-2024-4577 suddenly continues to escalate.

Greenbone provided vulnerability tests (VTs) to detect systems impacted by CVE-2024-4577 since it was released in June 2024. This allows defenders to identify affected systems across public-facing or internal network infrastructure. Let’s look deeper into the threat of CVE-2024-4577.

Exploiting CVE-2024-4577 for RCE and Lateral Movement

Proof of concept (PoC) exploit code and a full technical breakdown has long been published by watchTowr Labs, and a Metasploit module was also released in mid-2024. National CERT advisories have recently been issued by CERT New Zealand (CERT NZ) and the Canadian Center for Cyber Security. However, the flaw had already been alerted by CERT-EU, and CERT-FR (French Government CERT) back in June 2024.

Due to CVE-2024-4577, the PHP-CGI (Common Gateway Interface) may misinterpret certain characters as PHP options, which may allow a malicious user to pass options to the php.exe binary. This trick can reveal the source code of scripts or run arbitrary PHP code on the server. CVE-2024-4577 is considered a bypass of a long-ago patched vulnerability in PHP, CVE-2012-1823.

In the case that attackers gain initial access to a victim’s network through social engineering or a different software vulnerability, CVE-2024-4577 can provide an attacker with the opportunity for lateral movement, or covert persistence, penetrating deeper into a victim’s infrastructure and increasing the blast radius of a cyber attack.

A Brief Technical Explanation of CVE-2024-4577

In a nutshell, exploitation of CVE-2024-4577 works by leveraging Unicode character conversion to inject malicious command-line arguments to the php.exe process. On a high-level, web servers behave differently when CGI mode is enabled. A webserver will normally parse HTTP requests and pass them to a PHP script for processing. However, when CGI mode is enabled, attributes are extracted from the URL and passed as arguments to the executable PHP binary (php.exe on Windows). This PHP-CGI process is known to introduce distinct security risks.

Although PHP-GCI is supposed to sanitize shell meta characters (such as hyphens, double-hyphens, ampersands, and equal signs) before being passed, this still opens a pathway to command injection if attackers can find a way to bypass the sanitization process. PHP-CGI encoding was also the target of exploiting CVE-2012-1823. Furthermore, similar character encoding battles are continuously waged resulting in new ways for attackers to execute XSS and SQL injection vulnerabilities.

In the current iteration of this attack, using a soft hyphen (0xAD) instead of a standard hyphen (0x2D), attackers can initiate PHP directives to achieve Remote Code Execution (RCE). This is because Windows uses the UCS-2 character set, converts all characters to the UCS-2 code-point value and also executes an additional “best-fit” conversion. In the case of CVE-2024-4577, it is the best-fit schema that converts soft hyphens into standard hyphens. This allows injecting php.exe with arguments to prepend and execute the HTTP request body itself by adding the command “-d allow_url_include=1 -d auto_prepend_file=php://input” using URL encoded soft hyphens to the HTTP GET string. Soft hyphens are typically invisible UTF-8 characters used to specify locations word breaks, but only when necessary to fit the text on the line. Thanks to Windows’ best-fit conversion, they are effectively converted into command line flags.

CVE-2024-4577 is Being Leveraged Globally in 2025

According to new reports released in March 2025, attacks leveraging CVE-2024-4577 are ongoing,  widespread and escalating. Cisco detected exploitation of CVE-2024-4577 in January 2025, targeting Japanese education, ecommerce and telecommunications companies. After gaining initial access via PHP, attackers installed Cobalt Strike’s ‘TaoWu’ plugins and modified Windows registry keys to establish persistent access through scheduled tasks.

Another recent report from GreyNoise reveals that mass exploitation of CVE-2024-4577 has extended to targets in the US, UK, Singapore, Indonesia, Taiwan, Hong Kong, India, Spain and Malaysia. Germany and China were reportedly the primary sources of attacks, accounting for 43% globally. GreyNoise also maintains a honeynet that detected over 1,089 unique IPs attempting exploitation in January 2025 alone, and counted 79 publicly available, specialized exploit kits. The cybersecurity firm warned of growing attack volume in February 2025, driven by automated scanning and signaling a rapidly escalating cyber threat.

Mitigation for CVE-2024-4577

CVE-2024-4577 affects all PHP versions (including PHP 5 and PHP 7 which are end-of-life) before 8.1.29, 8.2.20 and 8.3.8 on Windows. The best mitigation is to upgrade to a patched version with urgency. For environments where immediate patching isn’t feasible, defenders may disable the execution of PHP-CGI mode in favor of PHP-FPM (FastCGI Process Manager) or alternatively, utilize a web-application firewall (WAF) to filter and block exploitation attempts. PHP system administrators should also note several additional security risks associated with CGI and review them for optimal security.

Greenbone has provided vulnerability tests (VTs) to detect systems impacted by CVE-2024-4577 since it was first disclosed in June 2024. This early detection capability allows defenders to identify affected systems across public facing or internal network infrastructure. Greenbone’s detection tests include remote version detections [1][2], and a remote active check [3].

Summary

CVE-2024-4577 is a critical PHP-CGI vulnerability affecting PHP installations on Windows, that allows remote code execution (RCE). The flaw was weaponized within 48 hours of disclosure and used in TellYouThePass ransomware attacks. According to reports from Cisco and GreyNoise, mass exploitation of CVE-2024-4577 has been escalating globally, and multiple national CERT advisories have been issued. Defenders need to identify where affected products are operating within their infrastructure, and immediately update to a fixed version of PHP, disable PHP-CGI completely or switch to PHP-FPM (FastCGI Process Manager).

Contact Test Now Buy Here Back to Overview

/by
Joseph Lee

February 2025 Threat Report: Tectonic Technology

Cyber threats are evolving at breakneck speed, but the fundamental weaknesses attackers exploit remain strikingly unchanged. So far in 2025, many analysts have published landscape reviews of 2024 and outlooks for 2025. The cost of cyber breaches is ticking upwards, but overall, cyber breach root-causes have not changed. Phishing [T1566] and exploiting known software vulnerabilities [T1190] continue to top the list. Another key observation is that attackers are weaponizing public information faster, converting CVE (Common Vulnerabilities and Exposures) disclosures into viable exploit code within days or even hours. Once inside a victim’s network, they are executing precision second-stage objectives faster too, deploying ransomware within minutes.

In this month’s edition of the Greenbone Threat Report, we will briefly review the disclosed chats of the Black Basta ransomware group and highlight Greenbone’s coverage of their now exposed techniques. We will also review a report from Greynoise about mass exploitation attacks, a new actively exploited vulnerability in Zimbra Collaboration Suite and new threats to edge networking devices.

The Era of Tectonic Technology

If security crises are like earthquakes, then the global tech ecosystem is the underlying tectonic plates. The global technology ecosystem would be best represented as the Paleozoic Era of geological history. Rapid innovative and competitive market forces are pushing and pulling at the fabric of IT security like the colliding supercontinents of Pangea; continuous earthquakes constantly forcing continental shift.

Entirely new paradigms of computing such as generative AI and quantum computing are creating advantages and risks; volcanoes of value and unstable ground. Global governments and tech giants are wresting for access to citizen’s sensitive personal data, adding gravity. These struggles have significant implications for privacy, security and how society will evolve. Here are some of the major forces destabilizing IT security today:

  • Rapidly evolving technologies are driving innovation, forcing technical change.
  • Organizations are both forced to change as technologies and standards depreciate and motivated to change to remain competitive.
  • Fierce market competition has accelerated product development and release cycles.
  • Strategic planned obsolescence has been normalized as a business strategy for reaping financial gain.
  • Pervasive lack of accountability for software vendors has led to prioritization of performance over “security-first” design principles.
  • Nation-states weaponize technology for Cyber Warfare, Information Warfare and Electronic Warfare.

Due to these forces, well-resourced and well-organized cyber criminals find a virtually unlimited number of security gaps to exploit. The Paleozoic Era lasted 300 million years. Hopefully, we won’t have to wait that long for product vendors to show accountability and employ secure design principles [1][2][3] to prevent so-called “unforgivable” vulnerabilities of negligence [4][5]. The takeaway is that organizations need to develop technical agility and efficient patch management programs. Continuous prioritized vulnerability management is a must.

Black Basta Tactics Revealed: Greenbone Has Coverage

Leaked internal chat logs belonging to Black Basta ransomware group have provided insight into the group’s tactics and inner workings. The logs were leaked by an individual using the alias “ExploitWhispers” who claimed the release was in response to Black Basta’s controversial targeting of Russian banks, allegedly creating internal conflicts within the group. Since its emergence in April 2022, Black Basta has reportedly amassed over $100 million in ransom payments from more than 300 victims worldwide. 62 CVEs referenced in leaked documents reveal the group’s tactics for exploiting known vulnerabilities. Of these 62, Greenbone maintains detection tests for 61, covering 98% of the CVEs.

The Greynoise 2025 Mass Exploitation Report

Mass exploitation attacks are fully automated network attacks against services that are accessible via internet. This month, Greynoise published a comprehensive report summarizing the mass exploitation landscape including the top CVEs attacked by the largest botnets (unique IPs), the most exploited product vendors and top CVEs included in the CISA’s (Cybersecurity and Infrastructure Security Agency) KEV (Known Exploited Vulnerabilities) catalog and exploited by botnets. Greenbone Enterprise Feed has detection tests for 86% of all CVEs (86 total) referenced in the report. When considering only CVEs issued in 2020 or later (66 total), our Enterprise Feed has 90% detection coverage.

Additional findings include:

  • 60% of CVEs exploited in mass exploitation attacks were published in 2020 or later.
  • Attackers are exploiting vulnerabilities within hours of disclosure.
  • 28% of vulnerabilities in CISA KEV are exploited by ransomware threat actors.

Zimbra Collaboration Suite

CVE-2023-34192 (CVSS 9.0) is a high-severity Cross-Site Scripting (XSS) vulnerability in Zimbra Collaboration Suite (ZCS) version 8.8.15. The flaw allows authenticated remote attackers to execute arbitrary code via crafted scripts targeting the `/h/autoSaveDraft` function. CISA added CVE-2023-34192 to its KEV catalog, indicating that it has been actively exploited in real-world attacks. Proof-of-concept (PoC) exploit code is publicly available, allowing low-skilled attackers to join the fray. CVE-2023-34192 has held a very high EPSS since its disclosure in 2023. For defenders leveraging EPSS for remediation prioritization, this indicates a high priority to patch.

Zimbra Collaboration Suite (ZCS) is an open-source office productivity platform that integrates email, calendar, contacts, tasks and collaboration tools but holds a niche market share of less than 1% of all email and messaging platforms.

Living on the Edge: New Critical Networking Device Flaws

In our monthly threat report we have been tracking the persistent threat to edge network devices. Earlier this-month, we reported on a perfect security storm affecting end-of-life (EOL) Zyxel routers and firewalls. In this section we will review new security risks that fall into the “edge networking” category. Greenbone has detection capabilities for all CVEs discussed below.

Chinese Hackers Exploit Palo Alto’s PAN-OS for Ransomware

CVE-2024-0012 (CVSS 9.8), a vulnerability in Palo Alto PAN-OS disclosed last November, is considered one of the most exploited vulnerabilities of 2024. The CVE is also reportedly being used by Chinese state-backed threat actors for ransomware attacks. Another new flaw affecting PAN-OS, CVE-2025-0108 (CVSS 9.1), was just disclosed this month and immediately tagged as actively exploited by CISA. CVE-2025-0108 is an authentication bypass in the management web-interface and can be chained together with CVE-2024-9474 (CVSS 7.2), a separate privilege escalation vulnerability to gain unauthenticated root control over an unpatched PAN-OS device.

SonicWall Patches a Critical Actively Exploited CVE in SonicOS

CVE-2024-53704, a critical severity vulnerability in SonicWall devices, has been recently added to CISA’s KEV list. Astoundingly, CISA lists 8 SonicWall CVEs that are known to be actively exploited in ransomware attacks. CVE-2024-53704 (CVSS 9.8) is an Improper Authentication vulnerability [CWE-287] in the SSLVPN authentication mechanism of SonicWall’s SonicOS versions 7.1.1-7058 and older, 7.1.2-7019, and 8.0.0-8035. It allows remote attackers to bypass authentication and and hijack active SSL VPN sessions, potentially gaining unauthorized network access. A full technical analysis is available from BishopFox. An advisory from SonicWall also names additional high severity CVEs in SonicOS that have been patched along with CVE-2024-53704.

Sophos’ CyberroamOS and EOL XG Firewalls Actively Exploited

Sophos, which acquired Cyberoam in 2014, has issued an alert and patch for CVE-2020-29574. CyberoamOS is part of Sophos’ product ecosystem. Aside from this CVE, Sophos XG Firewall, soon to be EOL, is also the subject of an active exploitation alert.

  • CVE-2020-29574 (CVSS 9.8): A critical SQL injection [CWE-89] vulnerability identified in the WebAdmin interface of CyberoamOS versions up to December 4, 2020. This flaw allows unauthenticated attackers to remotely execute arbitrary SQL statements, potentially gaining complete administrative access to the device. A hotfix patch has been issued, which also extends to some affected end-of-life (EOL) products.
  • CVE-2020-15069 (CVSS 9.8) is a critical Buffer Overflow vulnerability in Sophos XG Firewall versions 17.x through v17.5 MR12, allowing unauthenticated RCE via the HTTP/S Bookmarks feature for clientless access. This vulnerability, published in 2020 is now being actively exploited and has been added to CISA KEV indicating heightened risk. Sophos released an advisory in 2020 when the vulnerability was disclosed, along with a hotfix affected firewalls. The XG Series hardware appliances are soon scheduled to reach end-of-life (EOL) on March 31, 2025.

PrivEsc and Auth Bypasses in Fortinet FortiOS and FortiProxy

Fortinet disclosed two critical vulnerabilities, both affecting FortiOS and FortiProxy. The Canadian Center for Cybersecurity and the Belgian Center for Cybersecurity have issued advisories. Fortinet acknowledges active exploitation of CVE-2024-55591 and has released official guidance that includes details on affected versions and recommended updates. ​

  • CVE-2024-55591 (CVSS 9.8): An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS allows a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module. Multiple PoC exploits are available [1][2] increasing the risk of exploitation by low-skilled attackers.
  • CVE-2024-40591 (CVSS 8.8): Allows an authenticated administrator with Security Fabric permissions to escalate their privileges to super-admin by connecting the targeted FortiGate device to a malicious upstream FortiGate under their control.

Cisco Flaws Implicated as Initial Access Vectors in Telecom Hacks

In the past few months, China’s Salt Typhoon espionage group has routinely exploited at least two critical vulnerabilities in Cisco IOS XE devices to gain persistent access to telecommunications networks. Victims include Italian ISP, a South African telecom, and a large Thai telecom, and twelve universities worldwide including UCLA, Indonesia’s Universitas Negeri Malang and Mexico’s UNAM among others. Previously, Salt Typhoon had compromised at least nine U.S. telecoms, including Verizon, AT&T and Lumen Technologies. U.S. authorities claim Salt Typhoon’s goal is surveilling high-profile individuals, political figures and officials related to Chinese political interests.

CVEs exploited by Salt Typhoon include:

  • CVE-2023-20198 (CVSS 10): A privilege escalation flaw in Cisco IOS XE’s web interface. Used for initial access, allowing attackers to create an admin account.
  • CVE-2023-20273 (CVSS 7.2): Another privilege escalation flaw, used after gaining admin access to escalate privileges to root and establish a GRE (Generic Routing Encapsulation) tunnel for persistence.

Also, two other CVEs in Cisco products entered the radar in February 2025:

  • CVE-2023-20118 (CVSS 7.2): A command injection vulnerability in the web-based management interface of Cisco Small Business Routers allows authenticated, remote attackers to execute arbitrary commands with root-level privileges by sending crafted HTTP requests. CISA added CVE-2023-20118 to its KEV catalog, indicating evidence of active exploitation.
  • CVE-2023-20026 (CVSS 7.2): A command injection vulnerability in the web-based management interface of Cisco Small Business Routers RV042 Series allows authenticated, remote attackers with valid administrative credentials to execute arbitrary commands on the device. The flaw is due to improper validation of user input within incoming HTTP packets. While CVE-2023-20026 is not known to be exploited in any active campaigns, Cisco’s Product Security Incident Response Team (PSIRT) is aware that PoC exploit code for this vulnerability exists.

Ivanti Patches Four Critical Flaws

Four critical vulnerabilities were identified, affecting Ivanti Connect Secure (ICS), Policy Secure (IPS), and Cloud Services Application (CSA). No reports of active attacks in the wild or PoC exploits have emerged yet. Ivanti advises users to promptly update to the newest versions to address these critical vulnerabilities.

Here is a brief technical summary:

  • CVE-2025-22467 (CVSS 8.8): Attackers with credentials can achieve remote code execution (RCE) due to a stack-based buffer overflow [CWE-121] flaw in ICS versions prior to 22.7R2.6.
  • CVE-2024-38657 (CVSS 9.1): Attackers with credentials can write arbitrary files due to an external control of file name vulnerability in ICS versions before 22.7R2.4 and IPS versions before 22.7R1.3.
  • CVE-2024-10644 (CVSS 9.1): A code injection flaw in ICS (pre-22.7R2.4) and IPS (pre-22.7R1.3), allows arbitrary RCE to authenticated administrators. ​
  • CVE-2024-47908 (CVSS 7.2): An operating system command injection vulnerability [CWE-78] in CSA’s admin web console (versions before 5.0.5), allows arbitrary RCE to authenticated administrators.

Summary

This month’s Threat Report highlights key cybersecurity developments, including the evolving tactics of ransomware groups like Black Basta and the pervasive critical threat to edge network devices. With the support of AI tools, attackers are exploiting vulnerabilities faster-sometimes within hours of disclosure. Organizations must remain vigilant by adopting proactive security measures, continuously updating their defenses and leveraging threat intelligence to stay ahead of emerging threats.

Contact Test Now Buy Here Back to Overview

/by
Joseph Lee

The “Perfect Storm” for Zyxel: EOL Routers and Ransomware Attacks

Every product has a due date, but customers often have little warning and no recourse when a vendor decides to sunset a product. Once a vendor designates a product as end-of-life (EOL) or end-of-service (EOS), managing associated risks becomes more complex. Risk is magnified when cyber criminals find and exploit vulnerabilities that will never be patched. If an EOL product becomes vulnerable in the future, its users need to implement additional security controls on their own.

Digital illustration of storm clouds and a trash bin with a router symbol, representing end-of-life IT products and increasing ransomware risks.

If the vendor is found to be still selling these vulnerable EOL products, it may be considered the “perfect storm” or the maximum disaster. In this article we will investigate several security alerts for Zyxel products including some designated EOL and another flaw exploited in ransomware attacks.

An Overview of Recent Vulnerabilities in Zyxel Products

CVE-2024-40891 (CVSS 8.8), a high severity Remote Code Execution (RCE) flaw in Zyxel’s telnet implementation has been known since mid-2024. Yet, almost six months later, Zyxel has not issued a patch, claiming the affected products are EOS and EOL. Early in 2025, Greynoise observed active exploitation of CVE-2024-40891 against vulnerable Zyxel CPE networking devices. That CVE (Common Vulnerabilities and Exposures) and another RCE flaw, CVE-2024-40890 (CVSS 8.8), were both added to CISA’s Known Exploited Vulnerabilities (KEV) list by mid-February. While both CVEs (Cybersecurity and Infrastructure Security Agency) were post-authentication RCE flaws, a third security gap, CVE-2025-0890 (CVSS 9.8), published on February 4th, provided the final piece to the puzzle: extremely weak default credentials for remotely accessible services – that is, on top of the already unencrypted Telnet authentication process.

Researchers at VulnCheck who originally discovered the flaws also pointed out that the vendor continues to sell the faulty devices despite being aware of active exploitation and having no intention to issue patches. As of February 25th, 2025, some of the affected products were still being sold from Zyxel’s official Amazon store [1][2]. On top of these, another vulnerability in Zyxel products, CVE-2024-11667, is being actively exploited in ransomware attacks by the Helldown threat actor.

In the telecom technologies sector, Zyxel holds an estimated market share of 4.19%, serving around 2,277 companies including the world’s biggest tech giants. Zyxel Group, headquartered in Hsinchu Science Park, Taiwan, is a prominent provider of networking solutions for both businesses and home users, operating globally in over 150 countries.

A Timeline of Events

  • 2024-07-13: VulnCheck notified Zyxel about vulnerabilities in CPE series products.
  • 2024-07-31: VulnCheck published information about CVE-2024-40890 and CVE-2024-40891 on their blog.
  • 2025-01-28: Active exploitation of CVE-2024-40891 was reported by GreyNoise.
  • 2025-02-03: VulnCheck released further information highlighting the risk presented by Zyxel’s position and providing evidence that vulnerable devices were still being sold online by the vendor.
  • 2025-02-04: Zyxel released a security advisory labelling affected products as EOL and stating they will not receive updates.

Technical Descriptions of Recent Zyxel Vulnerabilities

Aside from Zyxel’s slow response to security researchers and their decision to continue selling EOL products with exploitable vulnerabilities, there are additional lessons to learn from a technical assessment of the flaws themselves. Namely, how product vendors continue to market products with unforgivable security flaws while skirting accountability.                                                                                

  • CVE-2024-40891 (CVSS 8.8 High): Authenticated users can exploit Telnet command injection due to improper input validation in `libcms_cli.so`. Commands are passed unchecked to a shell execution function, allowing arbitrary RCE. Aside from checking that the command string starts with an approved command, the `prctl_runCommandInShellWithTimeout` function has no filtering, allowing command chaining and arbitrary command injection.
  • CVE-2024-40890 (CVSS 8.8 High): A post-authentication command injection vulnerability in the CGI program of the legacy DSL Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device by sending a crafted HTTP POST request.
  • CVE-2025-0890 (CVSS 9.8 Critical): Devices use weak default credentials such as usernames and passwords admin:1234, zyuser:1234, and supervisor:zyad1234. None of these accounts are visible via the web interface but can be found in the device’s `/etc/default.cfg` These default credentials are now well-known by attackers. The “supervisor” and “zyuser” accounts can both access devices remotely via Telnet. “supervisor” has hidden privileges, granting full system access, while “zyuser” can still exploit CVE-2024-40891 for RCE. Use of such default credentials violate CISA’s Secure by Design pledge and the EU’s upcoming Cyber Resilience Act (CRA).

The affected products include Zyxel VMG1312-B Series (VMG1312-B10A, VMG1312-B10B, VMG1312-B10E, VMG3312-B10A, VMG3313-B10A, VMG3926-B10B, VMG4325-B10A, VMG4380-B10A, VMG8324-B10A, VMG8924-B10A) and two Zyxel Business Gateway Series routers (SBG3300, and SBG3500). The Zyxel CPE (Customer Premises Equipment) series devices are designed for home and small business internet connectivity, such as DSL, fiber and wireless gateways. As such, they are typically installed at a customer’s location to connect them to an Internet  Service Provider’s (ISP) network and are therefore not easily protected from the Internet by firewalls. Considering the nature of Zyxel CPE devices and the vulnerabilities in question, it would not be surprising if tens of thousands or more Zyxel devices were participating in malicious botnet activity.

Greenbone is able to detect EOL Zyxel devices that are vulnerable to the aforementioned CVEs.

CVE-2024-11667: Zyxel Firewalls Exploited in Ransomware Attacks

CVE-2024-11667 (CVSS 9.8 Critical), published in late December 2024, is a path traversal flaw [CWE-22] in the web-management console of Zyxel ATP and USG FLEX firewall series. The vulnerability is known to be exploited by the Helldown threat actor in ransomware attacks and the subject of several national cybersecurity advisories [1][2].

The Helldown ransomware group emerged in August 2024 as a notable threat actor in the cybersecurity landscape. This group employs a double extortion strategy, wherein they exfiltrate sensitive data from targeted organizations and subsequently deploy ransomware to encrypt the victims’ systems. If the ransom demands are not met, Helldown threatens to publicly release the stolen data on their data leak site. In addition to exploiting these Zyxel flaws, Helldown is known to exploit Windows OS vulnerabilities, VMware ESX,  and Linux environments, often using compromised VPN credentials to move laterally within networks.

Zyxel has released an advisory acknowledging the ransomware attacks and patches for affected products. Greenbone is able to detect Zyxel products affected by CVE-2024-11667 with three separate product specific version detection tests [1][2][3].

Summary

The situation with Zyxel seems to be a perfect storm leading to an important question: What recourse do customers have when a vendor fails to patch a security gap in their product? Zyxel’s EOL networking devices remain actively exploited, with vulnerabilities that can be combined for unauthorized arbitrary RCE and other unauthorized actions. CVE-2024-40891, CVE-2024-40890, and CVE-2025-0890 are now in CISA’s KEV list, while CVE-2024-11667 has been linked to ransomware attacks. The researchers from VulnCheck, who discovered several of these CVEs, have criticized Zyxel for poor communication and further for selling unpatched EOL devices. Greenbone detects affected products enabling a proactive approach to vulnerability management and the opportunity for users to mitigate exposure.

Contact Test Now Buy Here Back to Overview

/by
Joseph Lee

January 2025 Threat Report: Fortune Favors the Prepared

This year, many large organizations around the world will be forced to reckon with the root-cause of cyber intrusions. Many known vulnerabilities are an open gateway to restricted network resources. Our first Threat Report of 2025 reviews some disastrous breaches from 2024 and then dives into some pressing cybersecurity vulnerabilities from this past month.

However, to be clear, the vulnerabilities discussed here merely scratch the surface. In January 2025, over 4,000 new CVEs (Common Vulnerabilities and Exposures) were published; 22 with the maximum CVSS score of 10, and 375 rated critical severity. The deluge of critical severity flaws in edge networking devices has not abated. Newly attacked flaws in products from global tech giants like Microsoft, Apple, Cisco, Fortinet, Palo Alto Networks, Ivanti, Oracle and others have been appended to CISA’s (Cybersecurity and Infrastructure Security Agency) Known Exploited Vulnerabilities (KEV) catalog.

Software Supply Chain: the User’s Responsibility

We are all running software we didn’t design ourselves. This places a huge emphasis on trust. Where trust is uncertain – whether due to fears of poor diligence, malice or human error – cybersecurity responsibility still rests on the end-user. Risk assurances depend heavily on technical knowledge and collective effort. Defenders need to remember these facts in 2025.

When supply chain security fails, ask why! Did the software vendor provide the required tools to take control of your own security outcomes? Is your IT security team executing diligent vulnerability discovery and remediation? Are your resources segmented with strong access controls? Have employees been trained to identify phishing attacks? Are other reasonable cybersecurity measures in place? Organizations need to mature their ransomware-readiness, implement regular vulnerability assessments and prioritized patch management. And they should verify reliable backup strategies can meet recovery targets and prioritize other fundamental security controls to protect sensitive data and prevent downtime.

Fortune Favors the Prepared

Assessing 2024, the UK’s NCSC (National Cyber Security Center) annual review painted a grim picture; significant cyberattacks had increased three times compared to 2023. For a birds-eye view, CSIS (The Center for International Strategic & International Studies) has posted an extensive list of the most significant cyber incidents of 2024. The landscape has been shaped by the Russia Ukraine conflict and an accelerated shift from globalization to adversarialism.

Check Point Research found that 96% of all vulnerabilities exploited in 2024 were over a year old. These are positive findings for proactive defenders. Entities conducting vulnerability management will fare much better against targeted ransomware and mass exploitation attacks. One thing is clear: proactive cybersecurity reduces the cost of a breach.

Let’s review two of the most significant breaches from 2024:

  • The Change Healthcare Breach: Overall in 2024, breaches of healthcare entities were down from 2023’s record setting year. However, the ransomware attack against Change Healthcare set a new record for the number of affected individuals at 190 million, with total costs so far reaching 2,457 billion Dollar. The State of Nebraska has now filed a lawsuit against Change Healthcare for operating outdated IT systems that failed to meet enterprise security standards. According to IBM, breaches in the healthcare industry are the most costly, averaging 9.77 million Dollar in 2024.
  • Typhoon Teams Breach 9 US Telecoms: The “Typhoon” suffix is used by Microsoft’s threat actor naming convention for groups with Chinese origins. The Chinese state-sponsored adversary known as Salt Typhoon infiltrated the networks of at least nine major U.S. telecommunications companies, accessing user’s call and text metadata and audio recordings of high-profile government officials. Volt Typhoon breached Singapore Telecommunications (SingTel) and other telecom operators globally. The “Typhoons” exploited vulnerabilities in outdated network devices, including unpatched Microsoft Exchange Server, Cisco routers, Fortinet and Sophos Firewalls and Ivanti VPN appliances. Greenbone is able to detect all known software vulnerabilities associated with Salt Typhoon and Volt Typhoon attacks [1][2].

UK May Ban Ransomware Payments in Public Sector

The UK government’s framework to combat ransomware has proposed a ban on ransom payments by public sector entities and critical infrastructure operators with hopes to deter cyber criminals from targeting them in the first place. However, a new report from The National Audit Office (NAO), the UK’s independent public spending watchdog, says “cyber threat to UK government is severe and advancing quickly”.

The FBI, CISA and NSA all advise against paying ransoms. After all, paying a ransom does not guarantee the recovery of encrypted data or prevent the public release of stolen data, and may even encourage further extortion. On the flip side IBM’s security think-tank acknowledges that many SME organizations could not fiscally survive the downtime imposed by ransomware. While both sides make points here, could enriching cyber criminals while failing to shore-up local talent result in a positive outcome?

Vulnerability in SonicWall SMA 1000 Actively Exploited

Microsoft Threat Intelligence has uncovered active exploitation of SonicWall SMA 1000 gateways via CVE-2025-23006 (CVSS 9.8 Critical). The flaw is caused by improper handling of untrusted data during deserialization [CWE-502]. It could allow an unauthenticated attacker with access to the internal Appliance Management Console (AMC) or Central Management Console (CMC) interface to execute arbitrary OS commands. SonicWall has released hotfix version 12.4.3-02854 to address the flaw.

While no publicly available exploit code has been identified, numerous government agencies have issued alerts including Germany’s BSI CERT-Bund, Canadian Center for Cybersecurity, CISA, and the UK’s NHS (National Health Service). Greenbone is able to detect SonicWall systems impacted by CVE-2025-23006 by remotely checking the version identified from the service banner.

CVE-2024-44243 for Persistent Rootkit in macOS

January 2025 was a firestorm month for Apple security. Microsoft Threat Intelligence has found time to security test macOS, discovering a vulnerability that could allow installed apps to modify the OS System Integrity Protection (SIP). According to Microsoft, this could allow attackers to install rootkits, persistent malware and bypass Transparency, Consent and Control (TCC) which grants granular access permissions to applications on a per-folder basis. While active exploitation has not been reported, Microsoft has released technical details on their findings.

As January closed, a batch of 88 new CVEs, 17 with critical severity CVSS scores were published affecting the full spectrum of Apple products. One of these, CVE-2025-24085, was observed in active attacks and added to CISA’s KEV catalog. On top of these, dual speculative execution vulnerabilities in Apple’s M-series chips dubbed SLAP and FLOP were disclosed but have not yet been assigned CVEs. For SLAP, researchers leveraged chip flaws to exploit Safari WebKit’s heap allocation techniques and manipulated JavaScript string metadata to enable out-of-bounds speculative reads, allowing them to extract sensitive DOM content from other open website tabs. For FLOP, researchers demonstrated that sensitive data can be stolen from Safari and Google Chrome; bypassing Javascript type checking in Safari WebKit and Chrome’s Site Isolation via WebAssembly.

Furthermore, five high severity vulnerabilities were also published affecting Microsoft Office for macOS. Each potentially forfeiting Remote Code Execution (RCE) to an attacker. Affected products include Microsoft Word (CVE-2025-21363), Excel (CVE-2025-21354 and CVE-2025-21362) and OneNote (CVE-2025-21402) for macOS. While no technical details about these vulnerabilities are yet available, all have high CVSS ratings and users should update as soon as possible.

The Greenbone Enterprise Feed includes detection for missing macOS security updates and many other CVEs affecting applications for macOS including the five newly disclosed CVEs in Microsoft Office for Mac.

6 CVEs in Rsync Allow Both Server and Client Takeover

The combination of two newly discovered vulnerabilities may allow the execution of arbitrary code on vulnerable rsyncd servers while having only anonymous read access. CVE-2024-12084, a heap buffer overflow and CVE-2024-12085, an information leak flaw are the culprits. Public mirrors using rsyncd represent the highest risk since they inherently lack access control.

The researchers also found that a weaponized rsync server can read and write arbitrary files on connected clients. This can allow theft of sensitive information and potentially execution of malicious code by modifying executable files.

Here is a summary of the new flaws ordered by CVSS severity:

Collectively, these flaws present serious risk of RCE, data exfiltration and installing persistent malware on both rsyncd servers and unsuspecting clients. Users must update to the patched version, thoroughly look for any Indicators of Compromise (IoC) on any systems that have used rsync, and potentially redeploy file sharing infrastructure. Greenbone is able to detect all known vulnerabilities in rsync and non-compliance with critical security updates.

CVE-2025-0411: 7-Zip Offers MotW Bypass

On January 25, 2025, CVE-2025-0411 (CVSS 7.5 High) was published affecting 7-Zip archiver. The flaw allows bypassing the Windows security feature Mark of the Web (MotW) via specially crafted archive files. MoTW tags files downloaded from the internet with a Zone Identifier alternate data stream (ADS), warning when they originate from an untrusted source. However, 7-Zip versions before 24.09 do not pass the MotW flag to files within nested archives. Exploiting CVE-2025-0411 to gain control of a victim’s system requires human interaction. Targets must open a trojanized archive and then further execute a malicious file contained within.

Interestingly, research from Cofence found government websites around the world have been leveraged for credential phishing, malware delivery and command-and-control (C2) operations via CVE-2024-25608, a Liferay digital platform vulnerability. This flaw allows attackers to redirect users from trusted .gov URLs to malicious phishing sites. Combining redirection from a trusted .gov domain with the 7-Zip flaw has significant potential for stealthy malware distribution.

Considering the risks, users should manually upgrade to version 24.09, which has been available since late 2024. As discussed in the introduction above, software supply chain security often lies in a grey zone, we all depend on software beyond our control. Notably, prior to the publication of CVE-2025-0411, 7-Zip had not alerted users to a security flaw. Furthermore, although 7-Zip is open-source, the product’s GitHub account does not reveal many details or contact information for responsible disclosure.

Furthermore, the CVE has triggered DFN-CERT and BSI CERT-Bund advisories [1][2]. Greenbone is able to detect the presence of vulnerable versions of 7-Zip.

Summary

This edition of our monthly Threat Report reviewed major breaches from 2024 and newly discovered critical vulnerabilities in January 2025. The software supply chain presents elevated risk to all organizations large and small from both open-source and closed-source products. However, open-source software offers transparency and the opportunity for stakeholders to engage proactively in their own security outcomes, either collectively or independently. While cybersecurity costs are significant, advancing technical capabilities will increasingly be a determinant factor in both enterprise and national security. Fortune favors the prepared.

Contact Test Now Buy Here Back to Overview

/by