Malwarebytes

MAY 6, 2022

April 2022 was most notable for the emergence of three new ransomware-as-a-service ( RaaS ) groups— Onyx , Mindware , and Black Basta —as well as the unwelcome return of REvil , one of the world’s most notorious and dangerous ransomware operations. Ransomware attacks in April 2022. Known ransomware attacks in April 2022 by country.

Ransomware 98

Ransomware Encryption Accountability Technology 98

Security Affairs

NOVEMBER 10, 2022

The vulnerability, CVE-2022-0902 (CVSS score: 8.1), is a path-traversal issue that can be exploited by an attacker to inject and execute arbitrary code. “Team82 found a high-severity path-traversal vulnerability (CVE-2022-0902) in ABB’s TotalFlow Flow Computers and Remote Controllers. .”

Firmware 145

Firmware Authentication Passwords Manufacturing 145

Security Affairs

AUGUST 22, 2024

The identity authentication bypass vulnerability found in some Dahua products during the login process. “The The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.”

Authentication 137

Authentication Firmware Hacking Engineering 137

Security Affairs

APRIL 1, 2022

Networking equipment vendor Zyxel has pushed security updates for a critical flaw, tracked as CVE-2022-0342 (CVSS 9.8), that affects some of its business firewall and VPN products. “Zyxel has released patches for products affected by the authentication bypass vulnerability. Patch 5 in May 2022. Patch 5 in May 2022.

Firewall 110

Firewall VPN Firmware Authentication 110

The Last Watchdog

MAY 23, 2022

They require integrity, authentication, trusted identity and encryption. Protocols and policies setting new parameters for trusted connections are being hammered out and advanced encryption, authentication and data protection solutions are being ramped up. Related: Leveraging PKI to advance electronic signatures.

Digital transformation 214

Digital transformation Cybersecurity Computers and Electronics Encryption 214

Security Affairs

APRIL 28, 2023

The vulnerability is an improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.50

Firewall 98

Firewall Firmware VPN Authentication 98

Malwarebytes

JANUARY 12, 2022

Microsoft yesterday released the first patch Tuesday security updates of the year 2022. Microsoft has a technology called Active Directory that allows workstations to authenticate with a “domain controller.” It’s unclear if Server 2022 is similarly impacted. CVE-2022-21836 allows an attacker to bypass a security feature.

Authentication 137

Authentication Firmware Passwords Technology 137

Security Affairs

MAY 25, 2023

D-Link fixed two critical flaws in its D-View 8 network management suite that could lead to authentication bypass and arbitrary code execution. in its D-View 8 network management suite that could be exploited by remote attackers to bypass authentication and execute arbitrary code. ” reads the advisory published by ZDI.

Firmware 98

Firmware Authentication Software Hacking 98

Security Affairs

MARCH 9, 2022

Two of the TLStorm vulnerabilities reside in the TLS implementation used by Cloud-connected Smart-UPS devices, while the third one is a design flaw in the firmware upgrade process of Smart-UPS devices. The researchers discovered that the firmware upgrades are not properly signed and validated.

Firmware 101

Firmware IoT Authentication Backups 101

eSecurity Planet

JULY 8, 2022

“With a cyberattack, it’s more than just data that needs protecting—at risk is really the entire physical infrastructure from applications and operating systems down to low-level firmware and BIOS. Identity and access management with role-based access control and multi-factor authentication is available.

Backups 135

Backups Ransomware Technology Marketing 135

Security Affairs

AUGUST 14, 2023

The procedures allow administrators to provide device information such as server addresses, account information, and firmware updates. The server is used to provide configurations and firmware updates to the devices. In this scenario, an attacker can act as a rogue server and distribute malicious firmware.

Firmware 98

Firmware Authentication Passwords Hacking 98

Thales Cloud Protection & Licensing

MARCH 17, 2022

Enhance your security posture by detecting risks on authenticator devices. Thu, 03/17/2022 - 09:46. Not only are mobile devices used as end points to access corporate mail and other enterprise applications, they are also frequently used as authentication devices. Anonymous (not verified). Continuous Risk Detection.

Authentication 77

Authentication Risk Mobile Computers and Electronics 77

Malwarebytes

APRIL 5, 2022

On April 4 2022, the Cybersecurity & Infrastructure Security Agency (CISA) added CVE-2021-45382 to its known exploited vulnerabilities catalog. As a general policy, when products reach EOS/EOL, they can no longer be supported, and all firmware development for these products cease. CISA catalog.

Firmware 145

Firmware Software Risk Authentication 145

Malwarebytes

APRIL 4, 2022

Zyxel says the vulnerability, listed as CVE-2022-0342 , is an authentication bypass vulnerability caused by the lack of a proper access control mechanism, which has been found in the CGI program of some firewall versions. The flaw could allow an attacker to bypass the authentication and obtain administrative access of the device.

Firewall 97

Firewall Firmware VPN Authentication 97

Security Affairs

JANUARY 14, 2024

The vulnerability is an improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35. reported the SektorCERT. “An

Firewall 140

Firewall Firmware Cyber Attacks VPN 140

Security Affairs

MAY 11, 2023

.” The vulnerabilities, tracked as CVE-2023-27357 , CVE-2023-27367 , CVE-2023-27368 , CVE-2023-27369 , CVE-2023-27370 , were demonstrated by Claroty researchers during the 2022 Pwn2Own Toronto hacking contest as part of an exploit. “NETGEAR strongly recommends that you download the latest firmware as soon as possible.”

Hacking 98

Hacking Firmware Authentication DNS 98

Malwarebytes

FEBRUARY 16, 2023

Security researcher Yerodin Richards has found an authenticated remote code execution (RCE) vulnerability in Arris routers. According to Richards, when he contacted Arris (acquired by CommScope), the company said the devices running the vulnerable firmware are end-of-life (EOL) and are no longer supported by the company.

Firmware 98

Firmware Authentication Passwords Internet 98

Security Affairs

AUGUST 22, 2024

The identity authentication bypass vulnerability found in some Dahua products during the login process. “The The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.”

Authentication 104

Authentication Firmware Hacking Engineering 104

Security Affairs

MAY 4, 2023

In order to exploit the flaw, an attacker has to upgrade an affected device to a crafted version of the firmware. “This vulnerability is due to a missing authentication process within the firmware upgrade function.” “Cisco has not released firmware updates to address this vulnerability.

Firmware 98

Firmware Education Media Authentication 98

Malwarebytes

OCTOBER 18, 2022

Europol said it's supported the investigation since March 2022 by providing extensive analysis and the dissemination of intelligence packages to each of the affected countries. Vulnerabilities in the keyless entry systems have been found in the firmware of other car manufactures. Mitigation.

Firmware 98

Firmware Manufacturing Software Authentication 98

SecureList

SEPTEMBER 29, 2022

In 2020, CVE-2020-28212 , a vulnerability affecting this software, was reported, which could be exploited by a remote unauthorized attacker to gain control of a PLC with the privileges of an operator already authenticated on the controller. The procedure acts as authentication. In firmware versions prior to 2.7

Firmware 113

Firmware Passwords Authentication Engineering 113

Malwarebytes

MARCH 9, 2022

The updates for Microsoft’s March 2022 Patch Tuesday should fix 92 vulnerabilities, including three zero-day vulnerabilities. CVE-2022-21990 : A Remote Desktop Client remote code execution vulnerability. CVE-2022-24512 : A.NET and Visual Studio Remote Code Execution vulnerability. Remote Desktop Client. Exchange Server.

Authentication 98

Authentication Firmware Accountability 98

Security Affairs

MARCH 22, 2023

The experts discovered four vulnerabilities in the Netgear Orbi mesh wireless system, the most critical one is a critical remote code vulnerability, tracked as CVE-2022-37337 (CVSS v3.1: “An attacker can make an authenticated HTTP request to trigger this vulnerability.” ” states Talos. on January 19, 2023.

Wireless 98

Wireless Firmware Authentication Passwords 98

Krebs on Security

JUNE 15, 2023

The directive applies to any networking devices — such as firewalls, routers and load balancers — that allow remote authentication or administration. “This is reachable pre-authentication, on every SSL VPN appliance,” French vulnerability researcher Charles Fol tweeted. “Patch your #Fortigate.”

Risk 243

Risk VPN Internet Internet 243

Thales Cloud Protection & Licensing

MARCH 17, 2022

Enhance your security posture by detecting risks on authenticator devices. Thu, 03/17/2022 - 09:46. Not only are mobile devices used as end points to access corporate mail and other enterprise applications, they are also frequently used as authentication devices. Anonymous (not verified). Continuous Risk Detection.

Authentication 62

Authentication Risk Mobile Computers and Electronics 62

Security Affairs

JUNE 27, 2022

Two of these vulnerabilities, tracked as CVE-2022-31805 and CVE-2022-31806, have been rated critical (CVSS scores: 9.8), 7 as high risk, and 2 as medium risk. recommending vendors who use CODESYS V2 Runtime to investigate themselves in time, and actively to fix and release the patched version of firmware.

Software 115

Software Manufacturing Firmware Risk 115

SecureList

JUNE 8, 2022

Number of router vulnerabilities according to cve.mitre.org, 2010–2022 ( download ). Number of router vulnerabilities according to nvd.nist.gov, 2010–2022 ( download ). search for smart devices with the default password in the summer of last year revealed more than 27,000 hits, a similar search in April 2022 returned only 851.

DDOS 134

DDOS Passwords IoT Firmware 134

SecureList

JUNE 20, 2023

The findings of the study reveal a number of serious security issues, including the use of hard-coded credentials, and an insecure firmware update process. We later managed to extract the firmware from the EEPROM for further static reverse engineering. Further hardware analysis of the circuit board helped us identify chips.

Firmware 112

Firmware Passwords Manufacturing Mobile 112

Security Affairs

AUGUST 18, 2022

The PoC exploit code for a critical stack-based buffer overflow issue, tracked as CVE-2022-27255 (CVSS 9.8), affecting networking devices using Realtek’s RTL819x system on a chip was released online. ” reads the advisory published by Realtek, which published the issue in March 2022. exploits_nexx t: PoC and exploit code.

Firmware 112

Firmware IoT Hacking Authentication 112

Security Affairs

FEBRUARY 28, 2024

“As early as 2022, APT28 actors had utilized compromised EdgeRouters to facilitate covert cyber operations against governments, militaries, and organizations around the world.” Since September 2022, Moobot botnet was spotted targeting vulnerable D-Link routers. Upgrade to the latest firmware version.

Energy and Utilities 138

Energy and Utilities Government Firewall Malware 138

Malwarebytes

OCTOBER 6, 2022

The critical Qualcomm vulnerabilities all relate to the WLAN component and have the following CVEs: CVE-2022-25748 has a CVSS score of 9.8 CVE-2022-25718 has a CVSS score of 9.1 CVE-2022-25720 has a CVSS score of 9.8 CVE-2022-25720 has a CVSS score of 9.8

Wireless 98

Wireless Mobile Encryption Firmware 98

Security Affairs

APRIL 25, 2022

The alert includes indicators of compromise (IoCs) associated with BlackCat/ALPHV, as of mid-February 2022. Install updates/patch operating systems, software, and firmware as soon as updates/patches are released. Use multifactor authentication where possible. hard drive, storage device, the cloud).

Ransomware 140

Ransomware Antivirus Passwords Malware 140

Security Affairs

AUGUST 13, 2023

The CVE-2022-47391 received a severity rating of 7.5, The experts pointed out that the exploiting the vulnerabilities requires user authentication, as well as deep knowledge of the proprietary protocol of CODESYS V3 and the structure of the different services that the protocol uses. ” reads the advisory published by Microsoft.

Authentication 98

Authentication Firmware Hacking Passwords 98

eSecurity Planet

JANUARY 16, 2024

Potential results of the exploits include authentication bypass and command injection. January 11, 2024 Smart Thermostat from Bosch Puts Offices in Danger Type of vulnerability: Malicious commands sent from an attacker to the thermostat, including potentially replacing firmware with rogue code. Versions 9.x

Firewall 105

Firewall Firmware IoT Authentication 105

Malwarebytes

DECEMBER 16, 2021

No form of authentication is required for exploitation. Once installed, use the Update & security section of the app to download and install the latest firmware. When the second phase of Windows updates become available in Q1 2022, customers will be notified via a revision to the security vulnerability.

Wireless 126

Wireless Passwords Firmware Authentication 126

Malwarebytes

DECEMBER 19, 2023

According to the FBI, Play made around 300 victims between June 2022 and October 2023 among a wide range of businesses and critical infrastructure in North America, South America, and Europe. This means they steal data as well as encrypting systems and then threaten to publish the stolen data on their Dark Web leak site.

Ransomware 110

Ransomware Backups Encryption Firmware 110

Security Affairs

MARCH 3, 2023

Both vulnerabilities were reported in November 2022 by cybersecurity firm Quarkslab. “An authenticated, local attacker could send maliciously crafted commands to a vulnerable TPM allowing access to sensitive data. In some cases, the attacker can also overwrite protected data in the TPM firmware. ” states Quarkslab.

Firmware 98

Firmware IoT Authentication Hacking 98