{"id":18166,"date":"2023-05-02T14:41:56","date_gmt":"2023-05-02T21:41:56","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?p=18166"},"modified":"2023-05-12T08:48:59","modified_gmt":"2023-05-12T15:48:59","slug":"securins-threat-intelligence-may-2-2023-may-5-2023","status":"publish","type":"post","link":"https:\/\/10.42.32.162\/articles\/securins-threat-intelligence-may-2-2023-may-5-2023\/","title":{"rendered":"Securin&#8217;s Threat Intelligence: May 2, 2023 &#8211; May 5, 2023"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"18166\" class=\"elementor elementor-18166\" data-elementor-post-type=\"post\">\n\t\t\t\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-02c8318 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"02c8318\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-ddbe16e\" data-id=\"ddbe16e\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-a3fa264 elementor-widget elementor-widget-text-editor\" data-id=\"a3fa264\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p dir=\"ltr\" style=\"line-height: 1.8; background-color: #ffffff; margin-top: 0pt; margin-bottom: 0pt; padding: 0pt 0pt 4pt; text-align: left;\"><strong><span style=\"color: #000000;\">This edition brings you early warnings, trending news about cyber threats, and the accurate threat context. Check out which threat group is on the rampage, what vulnerability it could soon weaponize, and more.<\/span><\/strong><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3ca5983 elementor-widget elementor-widget-heading\" data-id=\"3ca5983\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">Watch our security expert David Rushton detail the top 3 threats of this week!<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-896a9e0 elementor-widget elementor-widget-text-editor\" data-id=\"896a9e0\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div style=\"padding:56.25% 0 0 0;position:relative;\"><iframe src=\"https:\/\/player.vimeo.com\/video\/824289106?h=52c88150f3&amp;badge=0&amp;autopause=0&amp;player_id=0&amp;app_id=58479\" frameborder=\"0\" allow=\"autoplay; fullscreen; picture-in-picture\" allowfullscreen style=\"position:absolute;top:0;left:0;width:100%;height:100%;\" title=\"FIN 7 | APT 28 | Earth Longzhi  | Securin Threat Intelligence - May 5\"><\/iframe><\/div><script src=\"https:\/\/player.vimeo.com\/api\/player.js\"><\/script>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0f513b4 elementor-widget elementor-widget-spacer\" data-id=\"0f513b4\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-06e09ce elementor-widget elementor-widget-heading\" data-id=\"06e09ce\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Trending Threats<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d7532f9 elementor-widget elementor-widget-text-editor\" data-id=\"d7532f9\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<ul><li><a href=\"#CISA-Adds-More-Vulnerabilities-to-the-KEV-Catalog\">CISA Adds More Vulnerabilities to the KEV Catalog<\/a><\/li><li><a href=\"#CISA-Adds-More-Vulnerabilities-to-the-KEV-Catalog\">APT28 Lures Targets with Fake \u2018Windows Update\u2019 Guides<\/a><\/li><li><a href=\"#ViperSoftX-Software-gets-an-Upgrade\">ViperSoftX Software gets an Upgrade<\/a><\/li><li><a href=\"#earth-longzhi-new-tricks\">Earth Longzhi has New Tricks up its Sleeve<\/a><\/li><li><a href=\"#1877-kurdish-apt\">1877 Team: New Kurdish Hacker Group\u200b<\/a><\/li><\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-45e16b3 elementor-widget elementor-widget-heading\" data-id=\"45e16b3\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Vulnerabilities to Watch Out For<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-78d7bb2 elementor-widget elementor-widget-text-editor\" data-id=\"78d7bb2\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<ul><li><a href=\"#CVE-2023-21554-Microsoft-Vulnerability\">CVE-2023-21554: Microsoft Vulnerability<\/a><\/li><li><a href=\"#CVE-2023-21707-Microsoft-Exchange-Powershell-Vulnerability\">CVE-2023-21707: Microsoft Exchange Powershell Vulnerability<\/a><\/li><li><a href=\"#CVE-2023-21932-Oracle-Opera-Vulnerability\">CVE-2023-21932: Oracle Opera Vulnerability<\/a><\/li><li><a href=\"#Vulnerabilities-in-Zyxel-Firewall-Devices\">Vulnerabilities in Zyxel Firewall Devices<\/a><\/li><li><a href=\"#tbk-dvr-vulnerability\">TBK DVR Devices under Attack<\/a><\/li><li><a href=\"#CVE-2023-2823\">CVE-2023-28231: Vulnerability in Microsoft Windows DHCPv6 Service<\/a><\/li><li><a href=\"#CVE-2023-20126\">CVE-2023-20126: Critical Cisco Vulnerability<\/a><\/li><\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c5581d4 elementor-widget elementor-widget-spacer\" data-id=\"c5581d4\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1272e27 elementor-widget elementor-widget-heading\" data-id=\"1272e27\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Trending Threats<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-585df2e elementor-widget elementor-widget-spacer\" data-id=\"585df2e\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d252bc8 elementor-widget elementor-widget-menu-anchor\" data-id=\"d252bc8\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div id=\"CISA-Adds-More-Vulnerabilities-to-the-KEV-Catalog\" class=\"elementor-menu-anchor\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-13dc0cf elementor-widget elementor-widget-heading\" data-id=\"13dc0cf\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">CISA Adds More Vulnerabilities to the KEV Catalog<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-32bb1a4 elementor-widget elementor-widget-text-editor\" data-id=\"32bb1a4\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">CISA added the following 3 vulnerabilities on May 1, 2023:<\/span><\/p><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-21839\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2023-21839<\/span><\/a><span style=\"font-weight: 400;\"> is an unspecified vulnerability in Oracle WebLogic Server. It allows an unauthenticated attacker to access critical data and even take over the server.\u00a0<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2021-45046\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2021-45056<\/span><\/a><span style=\"font-weight: 400;\">\u00a0 is the\u00a0 deserialization of untrusted data vulnerability in Apache Log4j2. It was exploited to launch DDoS attacks and execute code remotely.\u00a0 It requires user interaction for exploitation. A <\/span><a href=\"https:\/\/github.com\/4ra1n\/CVE-2023-21839\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">public exploit<\/span><\/a><span style=\"font-weight: 400;\"> is already available.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-1389\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2023-1389<\/span><\/a><span style=\"font-weight: 400;\">\u00a0 is an unauthenticated command injection vulnerability in the local API available via the web management interface. It is exploited by the Mirai botnet group to launch DDoS attacks.<\/span><\/li><\/ul><p><strong><span style=\"color: #000000;\">We warned our customers regarding this vulnerability on Apr 25, 2023.\u00a0<\/span><\/strong><\/p><p><strong>All these vulnerabilities need to be patched by May 22, 2023 according to the CISA guidelines.<\/strong><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0941100 elementor-widget elementor-widget-spacer\" data-id=\"0941100\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d16ead9 elementor-widget elementor-widget-menu-anchor\" data-id=\"d16ead9\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div id=\"APT28-Lures-Targets-with-fake-Windows-Update-Guides\" class=\"elementor-menu-anchor\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-dfd062f elementor-widget elementor-widget-heading\" data-id=\"dfd062f\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">APT28 Lures Targets with Fake \u2018Windows Update\u2019 Guides <\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3690051 elementor-widget elementor-widget-text-editor\" data-id=\"3690051\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">Hackers are utilizing bogus Windows update guides to target the Ukrainian government. Spear-phishing emails are sent to the target that directs them to fake Microsoft websites that provide phony software downloads such as &#8220;Windows Update Assistants.&#8221; Once downloaded, the malware contained in the program enables the attackers to infiltrate the victim&#8217;s systems and steal crucial data. The threat actors use powershell commands to carry out the malicious activities. The attacks are launched by APT28, a Russian state-sponsored threat group and targets officials in the defense and security sectors of the Ukranian country.<\/span><\/p><p><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-23397\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2023-23397<\/span><\/a><span style=\"font-weight: 400;\"> and <\/span><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2017-6742\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2017-6742<\/span><\/a><span style=\"font-weight: 400;\"> are two of the vulnerabilities exploited by APT28 to gain initial access.<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1d2f398 elementor-widget elementor-widget-spacer\" data-id=\"1d2f398\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-56f9133 elementor-widget elementor-widget-menu-anchor\" data-id=\"56f9133\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div id=\"ViperSoftX-Software-gets-an-Upgrade\" class=\"elementor-menu-anchor\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7433e8f elementor-widget elementor-widget-heading\" data-id=\"7433e8f\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">ViperSoftX Software gets an Upgrade<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e7059ed elementor-widget elementor-widget-text-editor\" data-id=\"e7059ed\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">\u00a0ViperSoftX is a malicious software that has recently updated its tactics to steal sensitive information. The software uses an encryption technique to protect its communication and operations, making it challenging for cybersecurity professionals to detect and prevent its attacks. ViperSoftX&#8217;s malware can bypass antivirus software and steal data such as login credentials, banking information, and cryptocurrency wallets. The threat actors behind it have targeted organizations and individuals worldwide, with a significant focus on the financial sector. The attackers are known to use social engineering techniques such as phishing emails to trick victims into downloading the malware.<\/span><\/p><p><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-24055\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2023-24055<\/span><\/a><span style=\"font-weight: 400;\"> was sometimes abused to extract stored passwords in plain text.<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-33bb994 elementor-widget elementor-widget-menu-anchor\" data-id=\"33bb994\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div id=\"earth-longzhi-new-tricks\" class=\"elementor-menu-anchor\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-fa5aae1 elementor-widget elementor-widget-heading\" data-id=\"fa5aae1\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">Earth Longzhi has New Tricks up its Sleeve<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-df189dc elementor-widget elementor-widget-text-editor\" data-id=\"df189dc\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">Earth Longzhi has launched a sophisticated attack on multiple cybersecurity firms. In this attack they employed advanced tactics, including the use of a legitimate Windows utility named BITSAdmin, to deliver the malware and an encrypted payload that was designed to evade detection. This campaign uses a new variant of the Croxloader malware. The group used spear-phishing emails to gain initial access to the targeted companies. These emails were designed to look legitimate and were personalized to increase the likelihood of the recipient opening the email and clicking on the attachment.<\/span><\/p><p><span style=\"font-weight: 400;\">Once inside the network, the group used stolen credentials to move laterally and gain access to sensitive data.<\/span><\/p><p><span style=\"font-weight: 400;\">Another tool used by the group is SPHijacker which exploits\u00a0 <\/span><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2018-5713\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2018-5713<\/span><\/a><span style=\"font-weight: 400;\">, a vulnerability in the Malwarefox Anti-Malware driver file.\u00a0<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3f7dc3f elementor-widget elementor-widget-menu-anchor\" data-id=\"3f7dc3f\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div id=\"1877-kurdish-apt\" class=\"elementor-menu-anchor\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d588254 elementor-widget elementor-widget-heading\" data-id=\"d588254\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">1877 Team: New Kurdish Hacker Group<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-181e664 elementor-widget elementor-widget-text-editor\" data-id=\"181e664\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">In July 2021, Iraqi Kurdish-founded group, the 1877 Team, took credit for conducting significant doxxing campaigns, website defacements, DDoS attacks, as well as infiltrating servers and databases. The group&#8217;s stated objectives are to exert pressure on governments, propagate public dissent, and gain notoriety. The 1877 Team maintains close connections with hacktivist groups such as Anonymous, AnonGhost, and ALtahrea.<\/span><\/p><p><span style=\"font-weight: 400;\">The 1877 Team deploys a scanning technique to uncover web page vulnerabilities and uses brute force attacks to obtain administrator credentials and infiltrate foreign infrastructure. They conduct extensive reconnaissance to identify weaknesses in the system. The group&#8217;s targets include political entities, national governments, universities, telecommunication companies, defense organizations, and IT corporations.<\/span><\/p><p><span style=\"font-weight: 400;\">Moreover, the 1877 Team has set up various marketplaces for trading hijacked infrastructure, modified malware, and hacking tools. The group exploits the following CVEs: <\/span><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-42805\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2022-42805<\/span><\/a><span style=\"font-weight: 400;\">, <\/span><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-32899\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2022-32899<\/span><\/a><span style=\"font-weight: 400;\">, <\/span><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-32948\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2022-32948<\/span><\/a><span style=\"font-weight: 400;\">, and <\/span><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-32845\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2022-32845<\/span><\/a><span style=\"font-weight: 400;\">.<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-36afe28 elementor-widget elementor-widget-spacer\" data-id=\"36afe28\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0937f84 elementor-widget elementor-widget-heading\" data-id=\"0937f84\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Vulnerabilities to Watch Out For<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d574dff elementor-widget elementor-widget-spacer\" data-id=\"d574dff\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ba4d590 elementor-widget elementor-widget-menu-anchor\" data-id=\"ba4d590\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div id=\"CVE-2023-21554-Microsoft-Vulnerability\" class=\"elementor-menu-anchor\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ad4baf0 elementor-widget elementor-widget-heading\" data-id=\"ad4baf0\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">CVE-2023-21554: Microsoft Vulnerability<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-00ae11d elementor-widget elementor-widget-text-editor\" data-id=\"00ae11d\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">This is an unauthenticated remote code execution (RCE) vulnerability in the Message Queuing (MSMQ) service. By default, the vulnerable component is not found, but it is frequently installed on Windows servers. <strong>Microsoft fixed this vulnerability and released a <\/strong><\/span><strong><a href=\"https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2023-21554\" target=\"_blank\" rel=\"noopener\">patch<\/a> for it. <\/strong><a href=\"https:\/\/gist.github.com\/tothi\/e9ad022453b713681faa684af9005bef\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Here\u2019s how<\/span><\/a><span style=\"font-weight: 400;\"> you can check if you have MSMQ enabled in your system.<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7809102 elementor-widget elementor-widget-spacer\" data-id=\"7809102\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-24b7b2e elementor-widget elementor-widget-menu-anchor\" data-id=\"24b7b2e\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div id=\"CVE-2023-21707-Microsoft-Exchange-Powershell-Vulnerability\" class=\"elementor-menu-anchor\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ae37a28 elementor-widget elementor-widget-heading\" data-id=\"ae37a28\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">CVE-2023-21707: Microsoft Exchange Powershell Vulnerability<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-db6ef01 elementor-widget elementor-widget-text-editor\" data-id=\"db6ef01\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">A security flaw has been discovered in the PowerShell Remoting feature of Microsoft Exchange, which could be exploited by a malicious actor to remotely execute code on the system. The vulnerability, identified as <\/span><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-21707\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2023-21707<\/span><\/a><span style=\"font-weight: 400;\">, arises from the deserialization of untrusted data by the Exchange PowerShell process. It impacts all versions of Microsoft Exchange that support the PowerShell feature.\u00a0<\/span><\/p><p><strong>It is recommended that users take measures to mitigate the risk of exploitation by installing the necessary <a href=\"https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2023-21707\" target=\"_blank\" rel=\"noopener\">patches<\/a>.<\/strong><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8036a50 elementor-widget elementor-widget-spacer\" data-id=\"8036a50\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-59aa188 elementor-widget elementor-widget-menu-anchor\" data-id=\"59aa188\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div id=\"CVE-2023-21932-Oracle-Opera-Vulnerability\" class=\"elementor-menu-anchor\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-02378b2 elementor-widget elementor-widget-heading\" data-id=\"02378b2\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">CVE-2023-21932: Oracle Opera Vulnerability<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-630f60c elementor-widget elementor-widget-text-editor\" data-id=\"630f60c\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">A security flaw has been identified in Oracle Opera that could result in remote code execution. The vulnerability, tracked as <a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2023-27135\" target=\"_blank\" rel=\"noopener\">CVE-2023-27131<\/a> does not require any authentication to exploit.\u00a0<\/span><\/p><p><strong>To avoid exploitation, users are advised to apply the recommended <a href=\"https:\/\/www.oracle.com\/security-alerts\/cpuapr2023.html\" target=\"_blank\" rel=\"noopener\">patch<\/a> to their Oracle software.<\/strong><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-749418c elementor-widget elementor-widget-spacer\" data-id=\"749418c\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8120bbd elementor-widget elementor-widget-menu-anchor\" data-id=\"8120bbd\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div id=\"Vulnerabilities-in-Zyxel-Firewall-Devices\" class=\"elementor-menu-anchor\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0942f78 elementor-widget elementor-widget-heading\" data-id=\"0942f78\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">Vulnerabilities in Zyxel Firewall Devices<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-28267ca elementor-widget elementor-widget-text-editor\" data-id=\"28267ca\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">Zyxel has released patches for the following vulnerabilities:<\/span><\/p><ul><li><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-28771\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2023-28771<\/span><\/a><span style=\"font-weight: 400;\"> &#8211; Critical RCE vulnerability. It allows an unauthenticated attacker to execute some OS commands remotely through the exploitation of improper error message handling in some firewall versions by sending crafted packets to an affected device.<\/span><\/li><li><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-27991\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2023-27991<\/span><\/a><span style=\"font-weight: 400;\"> &#8211; Post-authentication command injection vulnerability. Allows an authenticated attacker to execute some OS commands remotely.<\/span><\/li><li><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-43389\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2022-43389<\/span><\/a><span style=\"font-weight: 400;\"> &#8211; A buffer overflow vulnerability impacting 5G NR\/4G LTE CPE devices. It leads to arbitrary code execution and does not require authentication.<\/span><\/li><\/ul><p><span style=\"font-weight: 400;\"><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-22913\" target=\"_blank\" rel=\"noopener\">CVE-2023-22913<\/a>,\u00a0 <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-22914\" target=\"_blank\" rel=\"noopener\">CVE-2023-22914<\/a>, <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-22915\" target=\"_blank\" rel=\"noopener\">CVE-2023-22915<\/a>,\u00a0 <a href=\"https:\/\/www.tenable.com\/cve\/CVE-2023-22916\" target=\"_blank\" rel=\"noopener\">CVE-2023-22916<\/a>, <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-22917\" target=\"_blank\" rel=\"noopener\">CVE-2023-22917<\/a> and <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-22918\" target=\"_blank\" rel=\"noopener\">CVE-2023-22918<\/a> impact several firewalls and access point (AP) devices. They allow remote code execution and can even cause a denial-of-service (DoS) condition. <\/span><\/p><p><span style=\"font-weight: 400;\"><strong>Zyxel released a <a href=\"https:\/\/www.zyxel.com\/global\/en\/support\/security-advisories\/zyxel-security-advisory-for-multiple-vulnerabilities-of-firewalls-and-aps\" target=\"_blank\" rel=\"noopener\">security advisory<\/a> for these vulnerabilities.<\/strong><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c8e766d elementor-widget elementor-widget-menu-anchor\" data-id=\"c8e766d\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div id=\"tbk-dvr-vulnerability\" class=\"elementor-menu-anchor\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f30b3ac elementor-widget elementor-widget-heading\" data-id=\"f30b3ac\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">TBK DVR Devices under Attack<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6aba460 elementor-widget elementor-widget-text-editor\" data-id=\"6aba460\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">CVE-2018-9995 is a 5 year old unpatched vulnerability that is actively being exploited by some threat actors. The TBK devices are deployed in government and private organizations and can easily be exploited to gain access to the organizations\u2019 networks. CVE-2018-9995 allows attackers to bypass authentication and obtain administrative privileges, eventually leading to access to camera video feeds. There is a public proof-of-concept available which the threat actors are taking advantage of. Another vulnerability that is being exploited is CVE-2016-20016, a remote code execution vulnerability impacting MVPower TV-7104HE and TV-7108HE DVRs. It allows attackers to perform unauthenticated command execution using malicious HTTP requests. It also remains unpatched by the vendor.<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4345a45 elementor-widget elementor-widget-menu-anchor\" data-id=\"4345a45\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div id=\"CVE-2023-2823\" class=\"elementor-menu-anchor\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6b05e48 elementor-widget elementor-widget-heading\" data-id=\"6b05e48\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">CVE-2023-28231: Vulnerability in Microsoft Windows DHCPv6 Service\n<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d8d4812 elementor-widget elementor-widget-text-editor\" data-id=\"d8d4812\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">Microsoft DHCPv6 Server has been found to have a heap-based buffer overflow caused by the improper handling of DHCPv6 Relay-forward messages. An attacker located remotely can take advantage of this weakness by sending modified DHCPv6 Relay-forward messages to the targeted server. If successful, this could lead to the execution of arbitrary code with administrative privileges.<\/span><\/p><p>\u00a0<\/p><p><b>Microsoft <\/b><a href=\"https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2023-28231\" target=\"_blank\" rel=\"noopener\"><b>released a patch<\/b><\/a><b> for this vulnerability in April 2023 and recommends users to apply it.<\/b><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ad93d1c elementor-widget elementor-widget-menu-anchor\" data-id=\"ad93d1c\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div id=\"CVE-2023-20126\" class=\"elementor-menu-anchor\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f3d664d elementor-widget elementor-widget-heading\" data-id=\"f3d664d\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">CVE-2023-20126: Critical Cisco Vulnerability<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0c5ccc8 elementor-widget elementor-widget-text-editor\" data-id=\"0c5ccc8\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">The vulnerability known as CVE-2023-20126, which has been assigned a critical CVSS score of 9.8, is a result of a firmware upgrade function that lacks proper authentication. This makes it possible for an attacker to take advantage of the vulnerability by installing a manipulated version of firmware on an impacted device. If successful, the attacker would be able to run arbitrary code on the affected device with complete privileges.<\/span><\/p><p><b>CISCO addressed this vulnerability in its <\/b><a href=\"https:\/\/sec.cloudapps.cisco.com\/security\/center\/content\/CiscoSecurityAdvisory\/cisco-sa-spa-unauth-upgrade-UqhyTWW\"><b>security advisory<\/b><\/a><b>.<\/b><\/p><p><b>Microsoft <\/b><a href=\"https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2023-28231\" target=\"_blank\" rel=\"noopener\"><b>released a patch<\/b><\/a><b> for this vulnerability in April 2023 and recommends users to apply it.<\/b><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9c3359d elementor-widget elementor-widget-spacer\" data-id=\"9c3359d\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-5661ac2 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"5661ac2\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-12cd24e\" data-id=\"12cd24e\" data-element_type=\"column\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-6a79af4 elementor-widget elementor-widget-spacer\" data-id=\"6a79af4\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f8edd1c elementor-widget elementor-widget-text-editor\" data-id=\"f8edd1c\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p style=\"text-align: center;\"><strong><span style=\"color: #000000;\">Follow our weekly blog and podcast to get proactive alerts on trending threats.<\/span><\/strong><\/p><p style=\"text-align: center;\"><strong>Leverage our expertise and manage your threats continuously to stay safe from attackers. <\/strong><a href=\"\/contact-us\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Talk to Us!<\/span><\/a><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-56b9a97 elementor-widget elementor-widget-spacer\" data-id=\"56b9a97\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>We bring you threats that are currently trending as well as new vulnerabilities that hackers are exploiting.<\/p>\n","protected":false},"author":1,"featured_media":13471,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"content-type":""},"categories":[80,146],"tags":[672,662,107,264,89,220,673,150,664,674,663,139,665],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/posts\/18166"}],"collection":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/comments?post=18166"}],"version-history":[{"count":28,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/posts\/18166\/revisions"}],"predecessor-version":[{"id":18492,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/posts\/18166\/revisions\/18492"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/media\/13471"}],"wp:attachment":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/media?parent=18166"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/categories?post=18166"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/tags?post=18166"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}