2024, Firewall and Firmware - Cyber Security Informer

SonicWall warns of an exploitable SonicOS vulnerability

Security Affairs

JANUARY 8, 2025

SonicWall warns customers to address an authentication bypass vulnerability in its firewall’s SonicOS that is “susceptible to actual exploitation.” The same firmware upgrade contains mitigations for additional, less-critical vulnerabilities.” hardware firewalls: SonicOS 6.5.5.1-6n 6n or newer Gen 6 / 6.5

Firewall

Firewall Firmware VPN Authentication

A new campaign is likely targeting a zero-day in Fortinet FortiGate firewalls

Security Affairs

JANUARY 14, 2025

Experts warn of a new campaign targeting an alleged zero-day in Fortinet FortiGate firewalls with management interfaces exposed online. Arctic Wolf researchers observed a campaign targeting Fortinet FortiGate firewalls with exposed management interfaces, likely exploiting a zero-day vulnerability. ” continues the advisory.

Firewall

Firewall VPN Accountability Firmware

Zyxel firewalls targeted in recent ransomware attacks

Security Affairs

NOVEMBER 25, 2024

Zyxel warns that a ransomware group has been observed exploiting a recently patched command injection issue in its firewalls. Zyxel warns that a ransomware gang has been observed exploiting a recently patched command injection vulnerability, tracked as CVE-2024-42057, in its firewalls for initial compromise.

Firewall

Firewall Ransomware VPN Firmware

Webinars

How to Avoid Pitfalls In Automation: Keep Humans In the Loop

MORE WEBINARS

SonicWall addressed an improper access control issue in its firewalls

Security Affairs

AUGUST 26, 2024

SonicWall addressed a critical flaw in its firewalls that could allow attackers to achieve unauthorized access to the devices. SonicWall has released security updates to address a critical vulnerability, tracked as CVE-2024-40766 (CVSS score: 9.3), in its firewalls. However SonicWall recommends youinstall the latest firmware.

Firewall

Firewall Firmware Malware Internet

Mirai botnet targets SSR devices, Juniper Networks warns

Security Affairs

DECEMBER 19, 2024

Juniper Networks warns that a Mirai botnet is targeting SSR devices with default passwords after unusual activity was reported on December 11, 2024. Multiple customers reported anomalous activity on their Session Smart Network (SSN) platforms on December 11, 2024. ” read the report published by Juniper Networks.

DDOS

DDOS Firmware Firewall Passwords

U.S. CISA adds SonicWall SonicOS and Palo Alto PAN-OS flaws to its Known Exploited Vulnerabilities catalog

Security Affairs

FEBRUARY 18, 2025

The two vulnerabilities are: CVE-2025-0108 Palo Alto PAN-OS Authentication Bypass Vulnerability CVE-2024-53704 SonicWall SonicOS SSLVPN Improper Authentication Vulnerability Researchers recently warned that threat actors exploit a recently disclosed vulnerability, CVE-2025-0108, in Palo Alto Networks PAN-OS firewalls. states GreyNoise.

Firewall

Firewall Firmware Authentication VPN

VulnRecap 1/16/24 – Major Firewall Issues Persist

eSecurity Planet

JANUARY 16, 2024

Keep an eye out for security announcements from your firewall vendors; it’s possible additional similar vulnerabilities will come to light. January 10, 2024 Thousands of WordPress Sites Vulnerable to Malware Injection Type of vulnerability: Cross-site scripting flaw in Popup Builder that allows a malware injection.

Firewall

Firewall Firmware IoT Authentication

U.S. CISA adds ProjectSend, North Grid Proself, and Zyxel firewalls bugs to its Known Exploited Vulnerabilities catalog

Security Affairs

DECEMBER 3, 2024

Cybersecurity and Infrastructure Security Agency (CISA) adds ProjectSend, North Grid Proself, and Zyxel firewalls bugs to its Known Exploited Vulnerabilities catalog. Last week, VulnCheck researchers warned that ProjectSend vulnerability CVE-2024-11680 (CVSS score: 9.8) appears to have been exploited by attackers in the wild.

Firewall

Firewall Authentication Accountability Firmware

Aquabot variant v3 targets Mitel SIP phones

Security Affairs

JANUARY 29, 2025

The bot targets the command injection vulnerability CVE-2024-41710 that impacts Mitel models. ” The malware targets the flaw CVE-2024-41710 that affects Mitel 6800, 6900, and 6900w series SIP phones, including the 6970 Conference Unit through R6.4.0.HF1 Named after the Aqua filename, it was first reported in November 2023.

DDOS

DDOS Firmware Malware Firewall

Your Network Is Showing – Time to Go Stealth

Security Boulevard

APRIL 17, 2025

The Old Guard: Firewalls, VPNs and Exposed Control Planes Cyberattacks have evolved beyond the perimeter. No longer limited to opportunistic breaches, attackers are now executing coordinated campaigns that target the very foundations of enterprise network infrastructure firewalls, VPNs, and control planes. The takeaway?

Firewall

Firewall VPN Encryption Architecture

Ransomware and Cyber Extortion in Q4 2024

Digital Shadows

JANUARY 14, 2025

Key Findings The last quarter of 2024 proved to be a pivotal period for ransomware activity, marked by emerging threats and unexpected shifts among established groups. In our Q3 2024 ransomware report , we predicted activity would reach its peak in the last quarter of the year.

Ransomware

Ransomware Social Engineering Phishing VPN

SonicWall warns that SonicOS bug exploited in attacks

Security Affairs

SEPTEMBER 6, 2024

Recently fixed access control SonicOS vulnerability, tracked as CVE-2024-40766, is potentially exploited in attacks in the wild, SonicWall warns. SonicWall warns that a recently fixed access control flaw, tracked as CVE-2024-40766 (CVSS v3 score: 9.3), in SonicOS is now potentially exploited in attacks. 5035 and older versions. .

Firewall

Firewall Passwords Internet Internet

IT threat evolution Q1 2024

SecureList

JUNE 3, 2024

IT threat evolution Q1 2024 IT threat evolution Q1 2024. Mobile statistics IT threat evolution Q1 2024. Since it is not used by the firmware, we have no idea how the attackers learned to use it. There is no shortage of utilities that can be used to create a network tunnel between two systems.

Banking

Banking Malware Computers and Electronics Mobile

2024 State of Cybersecurity: Reports of More Threats & Prioritization Issues

eSecurity Planet

MAY 2, 2024

Most organizations express confidence in their current status and budgets, but also expect to experience at least one data breach in 2024. Deny-lists (aka: blacklist) : Blocks specific websites or IP addresses by adding them to a list for firewalls to ignore; very difficult to manage at scale. globally, +19.8%

Cybersecurity

Cybersecurity DDOS Penetration Testing Passwords

Vulnerability Recap 9/9/24 – Exploited Vulnerabilities Persist

eSecurity Planet

SEPTEMBER 9, 2024

September 2, 2024 RansomHub Exploits Multiple Vulnerabilities to Attack Critical Sectors Type of vulnerability: Multiple security flaws from major organizations. September 3, 2024 D-Link Vulnerability Enables Remote Code Execution Type of vulnerability: Stack-based buffer overflow. All impacted models must be updated to version 7.00

Firmware

Firmware Backups Firewall Risk

Russia-linked APT28 compromised Ubiquiti EdgeRouters to facilitate cyber operations

Security Affairs

FEBRUARY 28, 2024

” In February 2024, a court order allowed US authorities to neutralize the Moobot botnet, a network of hundreds of small office/home office (SOHO) routers under the control of the Russia-linked group APT28. The operation reversibly modified the routers’ firewall rules to block remote management access to the devices.

Energy and Utilities

Energy and Utilities Government Firewall Malware

Vulnerability Recap 9/2/24 – Big Companies Upgrade vs Risks

eSecurity Planet

SEPTEMBER 2, 2024

SonicWall dealt with a serious access control vulnerability that affected its firewall systems. August 26, 2024 SonicWall Identifies Access Control Vulnerability Type of vulnerability: Improper access control. The problem: CVE-2024-40766 , a critical access control vulnerability with a 9.3

Risk

Risk Firewall Firmware Engineering

VulnRecap 3/4/24 – Ivanti, Ubiquiti, AppLocker Under Attack

eSecurity Planet

MARCH 4, 2024

February 26, 2024 FCKeditor Used for SEO Poisoning on Government, University Sites Type of vulnerability: Malicious URL redirect. February 27, 2024 Ransomware Gangs Target Unpatched ScreenConnect Servers Type of vulnerability: Authentication bypass and path traversal. The fix: Apply Windows patches ASAP.

IoT

IoT Internet Internet Ransomware

Advanced threat predictions for 2025

SecureList

NOVEMBER 25, 2024

In this article in the KSB series, we review the trends of the past year, reflect on the predictions we made for 2024 , and offer insights into what we can expect in 2025. As expected, we continued to observe attacks in 2024 involving exploits for Apple devices. For instance, in Q2 2024, we saw a 23% increase in BYOVD usage.

IoT

IoT Energy and Utilities Phishing Cryptocurrency

Vulnerability Recap 7/1/24 – Apple, GitLab, AI Platforms at Risk

eSecurity Planet

JULY 1, 2024

June 24, 2024 Ollama AI’s Probllama Vulnerability Enables RCE Type of vulnerability: Multiple, including remote code execution (RCE), path traversal, and insufficient input validation. The problem: A security flaw in the Ollama AI infrastructure platform, identified as CVE-2024-37032 , enabled attackers to do RCE.

Risk

Risk Authentication Firmware Software

VulnRecap 1/22/24 – Watch Chrome, Ivanti, Citrix Issues

eSecurity Planet

JANUARY 22, 2024

January 16, 2024 Open-Source UEFI Implementation Sees 9 Vulnerabilities Type of vulnerability: Weaknesses in the network boot process of UEFI’s network implementation. The problem: The Unified Extensible Firmware Interface (UEFI) specification has an open-source network implementation, EDK II, with nine discovered vulnerabilities.

Authentication

Authentication Malware VPN Mobile

2.9 Billion Records Exposed in NPD Breach: How to Stay Safe

eSecurity Planet

AUGUST 20, 2024

District Court claims that NPD experienced a data breach around April 2024, alleging the following: Sensitive data , such as full names, current and previous addresses (going back at least 30 years), Social Security numbers, and details about family members, including some who have been deceased for nearly two decades, were compromised.

Identity Theft

Identity Theft Data breaches Passwords Encryption

Vulnerability Recap 7/8/24 – Intel, Cisco & More Face Risks

eSecurity Planet

JULY 8, 2024

July 1, 2024 OpenSSH Releases Security Updates to Address RCE Type of vulnerability: Signal handler race condition in OpenSSH server. The problem: CVE-2024-6387 is a signal handler race issue within OpenSSH’s server (sshd) that affects glibc-based Linux systems. The fix: OpenSSH issued updates to address CVE-2024-6387.

Risk

Risk Authentication Firmware Surveillance

Unraveling Raspberry Robin's Layers: Analyzing Obfuscation Techniques and Core Mechanisms

Security Boulevard

NOVEMBER 19, 2024

0x110000Retrieves the firmware table using the Windows information class SystemFirmwareTableInformation, iterates the table, and checks if any of its values are present in an embedded blocklist.Uses the Windows information class SystemVhdBootInformation and reads the structure member OsDiskIsVhd to verify if the disk is virtual.0x120000Checks

Antivirus

Antivirus Encryption Firewall Malware

Beware the Cyber Ghouls: Spooky Threats Lurking in Digital Shadows

SecureWorld News

OCTOBER 31, 2024

Warding off zombies : Regularly update device firmware, patch IoT devices, and monitor for unusual traffic patterns. Spooky fact : Sophos says the average ransom in 2024 is $2.73 Phishing phantoms: masters of disguise Phishing scams have become more sophisticated.

IoT

IoT Phishing DDOS Backups

Avtech camera vulnerability actively exploited in the wild, CISA warns

Security Affairs

AUGUST 2, 2024

Cybersecurity and Infrastructure Security Agency (CISA) published an advisory to warn of a vulnerability, tracked as CVE-2024-7029 (CVSS base score of 8.8), in Avtech camera that has been exploited in the wild. ” The vulnerability impacts Avtech AVM1203 IP cameras running firmware versions FullImg-1023-1007-1011-1009 and prior. .”

Firmware

Firmware Firewall Risk Authentication

Attackers exploit a new zero-day to hijack Fortinet firewalls

Security Affairs

FEBRUARY 11, 2025

Fortinet warned of attacks using a now-patched zero-day vulnerability in FortiOS and FortiProxy to hijack Fortinet firewalls. Fortinet warned that threat actors are exploiting a new zero-day vulnerability, tracked as CVE-2025-24472 (CVSS score of 8.1), in FortiOS and FortiProxy to hijack Fortinet firewalls. through 7.0.16

Firewall

Firewall Firmware VPN Authentication

Mercedes-Benz Head Unit security research report

SecureList

JANUARY 17, 2025

Firmware The MMB runs on Linux, and its filesystems are located on the eMMC. Custom IPC Inside the head unit, firmware services use custom IPC protocols for communication between their own threads, other services and other ECUs. CVE-2024-37601 The process of decoding files with the *.ud2 SMR-F files, but uncompressed.

Backups

Backups Architecture Firmware Software

Security Affairs newsletter Round 503 by Pierluigi Paganini – INTERNATIONAL EDITION

Security Affairs

DECEMBER 22, 2024

BadBox rapidly grows, 190,000 Android devices infected Romanian national was sentenced to 20 years in prison for his role in NetWalker ransomware attacks Sophos fixed critical vulnerabilities in its Firewall product U.S.

Data breaches

Data breaches Cybercrime Spyware Firmware

Cyber Security Informer

SonicWall warns of an exploitable SonicOS vulnerability

A new campaign is likely targeting a zero-day in Fortinet FortiGate firewalls

Webinars

Trending Sources

Zyxel firewalls targeted in recent ransomware attacks

Webinars

SonicWall addressed an improper access control issue in its firewalls

Mirai botnet targets SSR devices, Juniper Networks warns

U.S. CISA adds SonicWall SonicOS and Palo Alto PAN-OS flaws to its Known Exploited Vulnerabilities catalog

VulnRecap 1/16/24 – Major Firewall Issues Persist

U.S. CISA adds ProjectSend, North Grid Proself, and Zyxel firewalls bugs to its Known Exploited Vulnerabilities catalog

Aquabot variant v3 targets Mitel SIP phones

Your Network Is Showing – Time to Go Stealth

Ransomware and Cyber Extortion in Q4 2024

SonicWall warns that SonicOS bug exploited in attacks

IT threat evolution Q1 2024

2024 State of Cybersecurity: Reports of More Threats & Prioritization Issues

Vulnerability Recap 9/9/24 – Exploited Vulnerabilities Persist

Russia-linked APT28 compromised Ubiquiti EdgeRouters to facilitate cyber operations

Vulnerability Recap 9/2/24 – Big Companies Upgrade vs Risks

VulnRecap 3/4/24 – Ivanti, Ubiquiti, AppLocker Under Attack

Advanced threat predictions for 2025

Vulnerability Recap 7/1/24 – Apple, GitLab, AI Platforms at Risk

VulnRecap 1/22/24 – Watch Chrome, Ivanti, Citrix Issues

2.9 Billion Records Exposed in NPD Breach: How to Stay Safe

Vulnerability Recap 7/8/24 – Intel, Cisco & More Face Risks

Unraveling Raspberry Robin's Layers: Analyzing Obfuscation Techniques and Core Mechanisms

Beware the Cyber Ghouls: Spooky Threats Lurking in Digital Shadows

Avtech camera vulnerability actively exploited in the wild, CISA warns

Attackers exploit a new zero-day to hijack Fortinet firewalls

Mercedes-Benz Head Unit security research report

Security Affairs newsletter Round 503 by Pierluigi Paganini – INTERNATIONAL EDITION

Stay Connected