Menu
AppCheck presents our weekly roundup of critical vulnerabilities being actively exploited ‘in the wild’ by organised threat actors, during the week ending 6th December 2024. Organisations in both the public and private sectors can use the list each week as an input to their vulnerability management prioritisation framework: ‘Known Exploited Vulnerabilities’ are vulnerabilities that are confirmed as being actively used to target and exploit organisations around the globe within the last seven days. As such, they represent perhaps the greatest ongoing cybersecurity risk to businesses, and a very real and present threat. The vulnerabilities are often being exploited by highly organised criminal groups for direct financial gain, via techniques such as malware and ransomware installation. AppCheck summarises the details of each known ongoing exploitation below, but for full details – including impact, versions affected, and any remediation or mitigation guidance – check out AppCheck’s free ‘Detections Service’ at https://detections.appcheck-ng.com/ – you can click on the title of any of the exploitations below to see more information from this service.
This week: Of the four alerts that CISA have published this week, AppCheck has beaten CISA to the punch and already alerted customers to the ongoing exploitation of the vulnerabilities in earlier round-Ups – critical flaws in CyberPanel (CVE-2024-51378) and ProjectSend (CVE-2024-11680). The only CISA alert this week that AppCheck hasn’t yet covered is the exploitation of a flaw in North Grid’s Proself software by attackers from the threat group known as ‘Earth Kasha’.
CISA (America’s Cyber Defense Agency) maintains a catalogue of ‘KEV’s (Known Exploited Vulnerabilities), publishing alerts of known exploitations on an often-daily basis. Although intended primarily as advisories for US governmental and federal agencies, the list is openly published for the benefit of the wider cybersecurity community and network defenders, and to help every organisation better manage vulnerabilities to keep pace with a volatile and shifting threat landscape.
Trend Micro recently published analysis highlighting the activities of ‘Earth Kasha’, a China-linked cyber espionage group, in exploiting multiple vulnerabilities to deploy the group’s signature malware, ‘LODEINFO’. CISA have now officially published an advisory warning of the group expanding its activities to target a critical XXE vulnerability within Proself software from North Grid.
Although CISA provides a generally broad coverage of the highest profile exploitations, it can sometimes lag behind the curve in time to initial report for emerging exploitations. It can also sometimes deliberately not publish some exploitations if it feels that there is limited threat to US government and federal agencies, due to its operational remit. AppCheck therefore uses numerous alternate threat intelligence sources to enrich its coverage of high profile exploitations and 0-days reported elsewhere. AppCheck processes and aims to prioritise the addition of detection for known-exploited vulnerabilities highlighted in non-CISA sources, in exactly the same way as for CISA-published ones.
Already under attack following an earlier vulnerability last week (CVE-2024-42057), Zyxel leaped out of the frying pan and straight back into the fire, with a second 0-day being exploited in the wild. This time around, the new vulnerability allows the arbitrary file upload/download of files to vulnerable devices. In a significant escalation from last week, it was reported that the company’s own firewall installations (presumably running best-proactive implementations, if anyone is) were themselves also hacked, in addition to those of a number of high-profile customers.
To keep up to date with future high-profile advisories for critical ongoing exploitations that may threaten your technical estate, tune in next Friday for next week’s KEV roundup.
We now offer additional coverage of critical security updates from several key vendors too, including:
AppCheck is a software security vendor based in the UK, offering a leading security scanning platform that automates the discovery of security flaws within organisations websites, applications, network, and cloud infrastructure. AppCheck are authorized by the Common Vulnerabilities and Exposures (CVE) Program as a CVE Numbering Authority (CNA).
No software to download or install.
Contact us or call us 0113 887 8380
AppCheck is a software security vendor based in the UK, offering a leading security scanning platform that automates the discovery of security flaws within organisations websites, applications, network and cloud infrastructure. AppCheck are authorized by te Common Vulnerabilities and Exposures (CVE) Program aas a CVE Numbering Authority (CNA)
