eSecurity Planet

SEPTEMBER 11, 2023

Alarmingly, this API lacks any form of authentication, allowing virtually anyone, even a malicious website you might visit, to send commands to the CLI. They can be remotely exploited without authentication, potentially enabling remote code execution, service disruptions, and arbitrary operations on the routers. via port 8076.

VPN 113

VPN Firmware Authentication Phishing 113

eSecurity Planet

JANUARY 22, 2024

The problem: The Unified Extensible Firmware Interface (UEFI) specification has an open-source network implementation, EDK II, with nine discovered vulnerabilities. The vulnerability also exists on GitHub Enterprise Server, but it can only be exploited by an authenticated user with an organization owner role. EPMM versions 11.10, 11.9

Authentication 113

Authentication Malware VPN Mobile 113

eSecurity Planet

SEPTEMBER 9, 2024

Encryption and secure communication protocols: Protecting data in transit between ICS components. Patch management: Keeping software and firmware up to date to close security gaps. Firmware manipulation is particularly dangerous because it often remains undetected until significant damage occurs.

Firmware 109

Firmware Encryption Manufacturing Risk 109

eSecurity Planet

SEPTEMBER 2, 2024

Devices running SonicWall Firewall Gen5, Gen6, and Gen 7 are vulnerable to network-based threats that require no user interaction or authentication. The fix: Upgrade to SonicWall’s firmware updates for Gen 5 (to version 5.9.2.14-13o), 13o), Gen 6 (to version 6.5.4.15.116n), and Gen 7 (to any version above 7.0.1-5035).

Risk 57

Risk Firewall Firmware Engineering 57

eSecurity Planet

AUGUST 13, 2024

If exploited, the vulnerability would allow a threat actor to execute their own code within the processor’s firmware using System Management Mode (SMM). FreeBSD, an open-source operating system project, released a security bulletin about the vulnerability, which occurs in a signal handler in sshd(8).

Firmware 109

Firmware Software Wireless Security Defenses 109

eSecurity Planet

MAY 27, 2024

GitHub Enterprise Server and GitLab patched their authentication bypass and XSS issues. Immediately update your QNAP devices to the most recent firmware to mitigate these issues. May 21, 2024 GitHub Enterprise Server Update Fixes SAML Authentication Bypass Type of vulnerability: Authentication bypass.

Backups 67

Backups Authentication DDOS Engineering 67

eSecurity Planet

AUGUST 13, 2024

If exploited, the vulnerability would allow a threat actor to execute their own code within the processor’s firmware using System Management Mode (SMM). FreeBSD, an open-source operating system project, released a security bulletin about the vulnerability, which occurs in a signal handler in sshd(8).

Firmware 104

Firmware Software Wireless Security Defenses 104

eSecurity Planet

NOVEMBER 6, 2023

The Problem: Three flaws discovered by the Kubernetes security community carry CVSS severity scores of 7.6 Non-privileged threat actors can exploit these drivers to gain complete device control, execute arbitrary code, modify firmware, and escalate operating system privileges, posing a significant security risk.

Software 112

Software Education Ransomware Firmware 112

eSecurity Planet

OCTOBER 24, 2023

Strengthen Router Security: Enhance your router’s security by changing default login credentials. Regularly update router firmware to patch vulnerabilities and close potential avenues of attack. Android users should disable installations from unknown sources, ensuring app authenticity.

Malware 122

Malware Antivirus Software Passwords 122

eSecurity Planet

JUNE 10, 2024

The exploit combines an authentication bypass ( CVE-2024-4358 ) with a deserialization issue ( CVE-2024-1800 ). The authentication bypass permits the establishment of rogue admin accounts, but the deserialization flaw allows remote code execution, potentially giving attackers complete control over the affected servers.

Malware 80

Malware Authentication Software Telecommunications 80

eSecurity Planet

MAY 20, 2024

doesn’t always require authentication for SSID during a Wi-Fi session. Note that some DIR-600 devices are end of life, so D-Link won’t release any firmware updates for these. This attack can occur on any operating system and Wi-Fi client.

VPN 62

VPN Firmware Malware Software 62

eSecurity Planet

FEBRUARY 21, 2024

Check the Firewall Hardware & Operating System After you’ve prepared all the documentation and know everyone’s roles, one of the early steps in a firewall audit process is a hardware and firmware check. Look at the hardware to see whether it fits your company’s standards and security requirements.

Firewall 113

Firewall Firmware Software Risk 113

eSecurity Planet

DECEMBER 7, 2023

The three innovators and MIT patented the RSA algorithm, a proprietary system available through RSA Security until its public release in 2000. The RSA algorithm remains the most popular public key cryptographic system today and introduced the concept of digital signatures for authentication outside of academia.

Encryption 109

Encryption Authentication Passwords Password Management 109

eSecurity Planet

MAY 2, 2024

Password manager : Stores passwords securely, enforces quality, permits safe internal and external sharing, and ties into HR software for effective off-boarding of users. Multi-factor authentication : Protects stolen credentials against use by requiring more than a simple username and password combination for access to resources.

Cybersecurity 121

Cybersecurity DDOS Penetration Testing Passwords 121

eSecurity Planet

JULY 8, 2024

OpenSSH resolved a signal handler race problem, Juniper Networks managed an authentication bypass, and CocoaPods faced supply chain attack concerns. Regularly update and follow secure development methods, particularly in open-source projects. Cisco discovered a command injection issue, while a side-channel attack exposed Intel CPUs.

Risk 62

Risk Authentication Firmware Surveillance 62

eSecurity Planet

MARCH 4, 2024

February 27, 2024 Ransomware Gangs Target Unpatched ScreenConnect Servers Type of vulnerability: Authentication bypass and path traversal. Read more about how websites and application vulnerability scanners can proactively help development teams catch issues.

IoT 117

IoT Internet Internet Ransomware 117