IONIX THREAT CENTER

Get up-to-the-minute zero-day exposure information on your assets and respond three times faster to validated exploits.

The information on this page is the same information our customers receive in real-time when there is a new CVE impacting their assets.

Created Date
Source IONIX Threat Lab

CVE-2025-25257 Pre-Auth SQL Injection Leading to RCE In FortiWeb

An improper neutralization of special elements used in an SQL command in FortiWeb may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests. The vulnerability can be further escalated to a Remote Code Execution. The IONIX research team validated the impact through successful exploit reproduction, as detailed in this advisory.

References:
Created Date
Source IONIX Threat Lab

CVE-2025-5777 – Memory Over Read in NetScaler Gateway

A critical vulnerability, CVE-2025-5777, has been identified in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. The flaw is a memory over-read caused by insufficient input validation, which can allow unauthenticated attackers to extract valid session tokens from memory. It affects multiple versions prior to 14.1-43.56 and 13.1-58.32. The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially exposed assets are outlined in this post.

References:
Created Date
Source IONIX Threat Lab

CVE-2025-5349 – Improper Access Control in NetScaler Gateway

A high-severity vulnerability, CVE-2025-5349, has been identified in NetScaler ADC and NetScaler Gateway when the management interface is exposed via NSIP, Cluster Management IP, or site-local GSLB IP. The flaw stems from improper access control and may allow unauthorized users to access sensitive functionality without authentication. This impacts multiple versions prior to 14.1-43.56 and 13.1-58.32. The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially exposed assets are outlined in this post.

References:
Created Date
Source IONIX Threat Lab

CVE-2025-6543 – Memory Overflow in NetScaler Gateway

A critical vulnerability, CVE-2025-6543, has been identified in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. This vulnerability is a memory overflow that may lead to unintended control flow and denial of service (DoS). It affects multiple versions prior to 14.1-47.46 and 13.1-59.19. Public exploitation has been observed, with reports indicating active targeting in the wild. The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially exposed assets are outlined in this post.

References:
Created Date
Source IONIX Threat Lab

CVE-2025-30220 – Unauthenticated XML External Entity (XXE) in GeoServer

A critical vulnerability, CVE-2025-30220, has been identified in GeoServer’s Web Feature Service (WFS), impacting versions 2.27.0, 2.26.0 through 2.26.2, and all versions up to 2.25.6. The flaw originates from the underlying GeoTools library (gt-xsd-core), which mishandles XML parsing by bypassing the intended AllowListEntityResolver. This allows unauthenticated attackers to submit specially crafted XML payloads containing external entity definitions, leading to XML External Entity (XXE) injection. The vulnerability enables remote, unauthenticated exploitation that compromises confidentiality and internal network isolation. The issue also affects dependent systems such as GeoNetwork and the GeoTools WFS-NG datastore. Patched versions have been released for GeoServer (2.27.1, 2.26.3, 2.25.7), GeoTools (33.1, 32.3, 31.7, 28.6.1), and GeoNetwork (4.4.8, 4.2.13). The IONIX research team confirmed the vulnerability and validated the risk through successful exploit reproduction, as detailed in this advisory.

References:
Created Date
Source IONIX Threat Lab

CVE-2025-4009 – Remote Code Execution on Evertz devices

A critical vulnerability, CVE-2025-4009, has been identified in Evertz SDVN 3080ipx-10G and other devices leveraging the webEASY (ewb) management interface. This flaw affects all current versions and arises from a combination of an authentication bypass and unauthenticated command injection in administrative endpoints. By crafting a specially encoded JSON token, attackers can gain unauthorized administrative access. Leveraging this access, they can exploit the feature-transfer-import.php and feature-transfer-export.php endpoints to inject arbitrary system commands. This vulnerability enables unauthenticated remote code execution (RCE) as root on affected devices, potentially allowing full system takeover, disruption of broadcast workflows, and lateral movement within media infrastructure networks. The IONIX research team validated the impact through successful exploit reproduction, as detailed in this advisory.

References:
Created Date
Source IONIX Threat Lab

CVE-2025-46701 – Improper Handling of Case Sensitivity lead to RCE on Apache Tomcat

A high-severity vulnerability, CVE-2025-46701, has been identified in Apache Tomcat, impacting versions 9.0.0.M1 to 9.0.104, 10.1.0-M1 to 10.1.40, and 11.0.0-M1 to 11.0.6. The issue stems from case-insensitive handling of the pathInfo component in CGI servlet mappings, allowing attackers to bypass security constraints by altering URI casing. Under certain conditions, this can lead to remote code execution (RCE). Apache has addressed the flaw in versions 9.0.105, 10.1.41, and 11.0.7. The IONIX research team successfully reproduced and validated the exploit, as detailed in this post.

References:
Created Date
Source IONIX Threat Lab

CVE-2025-34027 Authentication Bypass on Versa Concerto

A critical vulnerability, CVE-2025-34027, has been identified in the Versa Concerto SD-WAN orchestration platform, affecting versions 12.1.2 through 12.2.0. This flaw results from a misconfiguration in the Traefik reverse proxy that enables authentication bypass, granting unauthorized access to administrative endpoints. Exploiting the vulnerable Spack upload endpoint, attackers can leverage a Time-of-Check to Time-of-Use (TOCTOU) race condition to manipulate file paths during load operations. This enables unauthenticated remote code execution (RCE) on the underlying system. The IONIX research team confirmed the impact through controlled exploit validation, as detailed in this post.

References:
Created Date
Source IONIX Threat Lab

CVE-2025-4123 – Cross-Site Scripting (XSS) and Open Redirect in Grafana

A high-severity vulnerability, CVE-2025-4123, has been identified in Grafana (versions 8 and above), affecting both Grafana OSS and Grafana Enterprise. This flaw is a combination of an open redirect and path traversal within custom frontend plugin handling, enabling attackers to craft malicious links that redirect users to attacker-controlled sites and execute arbitrary JavaScript (XSS). If the vulnerable Grafana instance has anonymous access enabled, the attack does not require authentication. In environments with the Grafana Image Renderer plugin, exploitation can escalate to a full read Server-Side Request Forgery (SSRF), allowing attackers to access sensitive internal resources and cloud metadata. The risk includes session hijacking, full account takeover, and exposure of internal assets. Grafana Labs has released patched versions addressing this issue, and immediate upgrading is strongly recommended. The IONIX research team successfully reproduced and validated, , as detailed in this post.

References:Read More
Created Date
Source IONIX Threat Lab

CVE-2025-4428 & CVE-2025-4427 – Remote Code Execution at Ivanti EPMM

A critical remote code execution (RCE) chain, involving CVE-2025-4427 and CVE-2025-4428, has been identified in Ivanti Endpoint Manager Mobile (EPMM) versions up to 12.5.0.0. CVE-2025-4427 allows unauthenticated attackers to bypass authentication controls via the API component, granting access to otherwise protected resources. Chaining this with CVE-2025-4428, attackers with API access can craft malicious requests to execute arbitrary code on the underlying system. The exploitation of this pre-auth RCE chain poses a severe risk of full system compromise. Ivanti has released security updates to address both flaws, and immediate patching is strongly recommended. The IONIX research team successfully validated the attack vector in a controlled environment, as detailed in this post.

References:
Created Date
Source IONIX Threat Lab

CVE-2025-4396 – SQL Injection at Relevanssi (WordPress plugin)

A critical vulnerability, CVE-2025-4396, has been discovered in the Relevanssi – A Better Search plugin for WordPress, affecting all versions up to 4.24.4 (Free) and 2.27.4 (Premium). This flaw stems from insufficient input sanitization and improper SQL query preparation in handling the query parameters, enabling unauthenticated attackers to perform time-based SQL Injection. By exploiting this vulnerability, threat actors can append malicious SQL statements to existing queries, allowing them to extract sensitive data from the underlying WordPress database. Users are strongly advised to update the plugin to a patched version. The IONIX research team confirmed the impact through controlled exploit validation, as detailed in this post.

References:
Created Date
Source IONIX Threat Lab

CVE-2025-2775 – Unauthenticated XML External Entity (XXE) vulnerability lead to RCE in SysAid

A critical vulnerability, CVE-2025-2775, has been identified in SysAid On-Prem versions ≤ 23.3.40, exposing the platform to an unauthenticated XML External Entity (XXE) injection flaw within the Checkin processing functionality. This vulnerability allows remote attackers to exploit XML parsing behavior to read arbitrary files from the server or gain access to sensitive information, including administrator credentials. Successful exploitation can lead to full administrative account takeover and further system compromise. SysAid has released a security advisory urging immediate patching. The IONIX research team verified the vulnerability’s impact through exploit simulation, detailed in this post.

References:
Created Date
Source IONIX Threat Lab

CVE-2025-31324 – Executable file upload vulnerability in SAP NetWeaver Application Server

A critical vulnerability, CVE-2025-31324, has been identified in SAP NetWeaver Visual Composer, allowing unauthenticated remote code execution via the Metadata Uploader component. This flaw arises from improper authentication checks, enabling attackers to send crafted HTTP/HTTPS requests to upload malicious binaries. Successful exploitation can result in complete system compromise. The issue affects all SAP NetWeaver 7.xx versions. Users are strongly advised to apply the emergency patch released by SAP. The IONIX research team verified the vulnerability’s impact through exploit simulation, detailed in this post.

References:
Created Date
Source IONIX Threat Lab

CVE-2025-32433 – Remote Code Execution at Erlang/OTP

A critical vulnerability, CVE-2025-32433, has been discovered in the SSH server implementation within Erlang/OTP, allowing unauthenticated remote code execution through malformed SSH messages. This flaw arises from improper handling of protocol messages before authentication is completed, enabling attackers to send crafted payloads that the server processes unsafely. If the SSH daemon is running with elevated privileges, successful exploitation can result in complete system compromise. The issue affects multiple Erlang/OTP branches, including versions prior to OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. In environments where immediate patching is not feasible, administrators should consider disabling SSH temporarily or applying strict network access controls. The IONIX research team developed and tested an exploit simulation on relevant assets to verify the vulnerability’s impact and assess potential exposure. The findings are detailed in this post.

References:
Created Date
Source IONIX Threat Lab

CVE-2025-2825 – Authentication Bypass in CrushFTP

A critical vulnerability, CVE-2025-2825, has been identified in CrushFTP. This vulnerability allows remote unauthenticated access via specially crafted HTTP(S) requests, bypassing authentication checks through a flaw in the loginCheckHeaderAuth() method. It affects instances with S3-compatible API access enabled and can be exploited with knowledge of a valid username. This issue has been patched in CrushFTP 11.3.1, and users are strongly advised to upgrade. The IONIX research team developed and tested an exploit simulation on relevant assets to verify the vulnerability’s impact and assess potential exposure. The findings are detailed in this post.

References:
Created Date
Source IONIX Threat Lab

Multiple Remote Code Execution Vulnerabilities in Ingress NGINX Controller for Kubernetes

A series of critical vulnerabilities (CVE-2025-1974, CVE-2025-1097, CVE-2025-1098 and CVE-2025-24514) have been identified in the Ingress NGINX Controller for Kubernetes. These vulnerabilities allow unauthenticated remote code execution (RCE) via crafted requests to the Validating Admission Controller and admission controller components of ingress-nginx. Exploitation of these vulnerabilities can lead to unauthorized access to all secrets stored across all namespaces in the Kubernetes cluster, potentially resulting in a complete cluster takeover. These issues have been patched in Ingress NGINX versions 1.12.1 and 1.11.5, users are strongly advised to upgrade. The IONIX research team developed and tested an exploit simulation on relevant assets to verify the vulnerability’s impact and assess potential exposure.

References:
Created Date
Source IONIX Threat Lab

Authentication Bypass in Kentico Xperience CMS < 13.0.173 (CVE has not been assigned yet)

A critical authentication bypass vulnerability has been identified in Kentico Xperience CMS versions prior to 13.0.173. The vulnerability stems from an issue in the staging endpoint /CMSPages/Staging/SyncServer.asmx that allows attackers to forge requests and bypass authorization controls.
This vulnerability can be exploited to gain full control over affected Xperience instances, specifically those with staging enabled and configured to use username and password authentication. Instances using X.509 certificate-based authentication are not affected. The findings are detailed in this post. Kentico has released a hotfix addressing this vulnerability.

References:
Created Date
Source IONIX Threat Lab

Authentication Bypass in Kentico Xperience CMS < 13.0.178 (CVE has not been assigned yet)

An authentication bypass vulnerability has been identified in Kentico Xperience CMS versions prior to 13.0.178. The vulnerability stems from a third-party library used by the product, allowing attackers to bypass the staging authentication mechanism. This issue affects only instances with staging enabled. Importantly, this vulnerability involves a distinct attack vector from the one addressed in hotfix 13.0.173. Administrators are advised to apply hotfix 13.0.178. For instances not using staging, an additional protective measure is to restrict access to the staging endpoint /CMSPages/Staging/SyncServer.asmx. This can be done by editing the node in the /CMS/CMSPages/Web.config file. To fully block access, set the authorization setting to . The findings are detailed in this post.

Created Date
Source IONIX Threat Lab

CVE-2025-24813 – Path Equivalence lead to Remote Code Execution in Apache Tomcat

A critical vulnerability, CVE-2025-24813, has been identified in Apache Tomcat. This vulnerability allows unauthenticated remote code execution (RCE) via crafted partial PUT requests, exploiting path equivalence issues in the default servlet when write permissions are enabled, and Tomcat’s file based session persistence (FileStore), having both configured should be relatively rare, nonetheless, Tomcat’s widespread. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98.
The IONIX research team developed and tested an exploit simulation on relevant assets to verify the vulnerability’s impact and assess potential exposure. The findings are detailed in this post.

References:
Created Date
Source IONIX Threat Lab

CVE-2025-24893 – Remote Code Execution in XWiki

A critical vulnerability, CVE-2025-24893, has been identified in XWiki Platform. This vulnerability allows unauthenticated remote code execution (RCE) via crafted requests to the SolrSearch endpoint, embedding Groovy script execution within the search query parameters. It impacts the confidentiality, integrity, and availability. This issue has been patched in XWiki 15.10.11, 16.4.1, and 16.5.0RC1, and users are strongly advised to upgrade. The IONIX research team developed and tested an exploit simulation on relevant assets to verify the vulnerability’s impact and assess potential exposure. The findings are detailed in this post.

References:
Created Date
Source IONIX Threat Lab

CVE-2025-0108 – Authentication Bypass in Palo Alto Networks PAN-OS

A critical vulnerability, CVE-2025-0108, has been identified in Palo Alto Networks PAN-OS, affecting versions 10.1.0 through 10.1.14, 10.2.0 through 10.2.13, 11.1.0 through 11.1.6, and 11.2.0 through 11.2.4. This vulnerability arises from an authentication bypass that allows an unauthenticated attacker with network access to the management web interface to circumvent authentication controls and invoke specific PHP scripts. While this flaw does not directly enable remote code execution (RCE), it significantly impacts the integrity and confidentiality of PAN-OS by exposing sensitive administrative functions.
The IONIX research team developed and tested an exploit simulation on relevant assets to verify the vulnerability’s impact and assess potential exposure. The findings are detailed in this post. Palo Alto Networks has released upgrade addressing this vulnerability. Organizations are advised to upgrade to the latest versions to mitigate potential risks.

References:

Created Date
Source IONIX Threat Lab

CVE-2024-55591 – Authentication Bypass in FortiOS and FortiProxy

A critical Authentication Bypass vulnerability has been identified in FortiOS and FortiProxy, allowing remote attackers to gain super-admin privileges via crafted requests to the Node.js WebSocket module. Affected versions include FortiOS 7.0.0 through 7.0.16, FortiProxy 7.0.0 through 7.0.19, and FortiProxy 7.2.0 through 7.2.12. Reports indicate that this vulnerability is being actively exploited in the wild.
Indicators of compromise include the creation of suspicious new admin users with six-character random strings (e.g., Gujhmk, Ypda8a). Additionally, attackers have been observed using the following IPs: 45.55.158.47, 87.249.138.47, 155.133.4.175, 37.19.196.65, and 149.22.94.37.
The IONIX research team is actively monitoring the situation and will provide updates if a public exploit becomes available. Meanwhile, the list of potentially impacted assets can be found in this post. For detailed guidance, refer to Fortinet’s Upgrade Tool and follow the provided workaround instructions.

References:
Created Date
Source IONIX Threat Lab

CVE-2024-50603 – Remote Code Execution in Aviatrix Controller

A critical vulnerability, CVE-2024-50603, has been identified in Aviatrix Controller versions prior to 7.1.4191 and 7.2.x versions prior to 7.2.4996. This vulnerability stems from the improper neutralization of special elements used in OS commands, allowing an unauthenticated attacker to execute arbitrary code. Exploitation is possible by sending shell metacharacters to the /v1/api endpoint in the cloud_type parameter for list_flightpath_destination_instances or the src_cloud_type parameter for flightpath_connection_test. The IONIX research team developed and tested an exploit simulation on relevant assets to verify the vulnerability’s impact and assess potential exposure. The findings are detailed in this post

References:
Created Date
Source IONIX Threat Lab

CVE-2025-0282 – Remote Code Execution in Ivanti

A critical vulnerability CVE-2025-0282 has been identified in Ivanti Connect Secure prior to 22.7R2.5, Ivanti Policy Secure prior to 22.7R1.2, and Ivanti Neurons for ZTA gateways prior to 22.7R2.3. The vulnerability is a stack-based buffer overflow that can lead to remote code execution (RCE).
While no public exploit is currently available, there are reports of environments being targeted. The IONIX research team is actively monitoring the situation and will provide updates if an exploit becomes publicly available. Ivanti has released a patch addressing this vulnerability

References:
Created Date
Source IONIX Threat Lab

CVE-2024-52875 – Multiple vulnerabilities enable 1-Click RCE at Kerio Control

A critical vulnerability, CVE-2024-52875, has been identified in Kerio Control versions 9.2.5 through 9.4.5 including, affecting the security of systems using these versions. This vulnerability arises from two distinct issues: CRLF injection and Reflected Cross-Site Scripting (XSS), both caused by improper input sanitization on specific web pages. CRLF injection allows attackers to manipulate HTTP headers, which can lead to various response-splitting attacks, while XSS enables malicious scripts to execute in the context of a user’s browser. When these two issues are exploited in combination, they provide attackers with a pathway to escalate privileges and achieve 1 click remote code execution (RCE), significantly increasing the severity and impact of the vulnerability.

References:

Created Date
Source IONIX Threat Lab

CVE-2024-55956 – File Upload Vulnerability In Cleo Harmony

In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.

References:
Created Date
Source IONIX Threat Lab

Unauthenticated arbitrary file read in Mitel MiCollab (CVE has not been assigned yet)

The Mitel Collab Arbitrary File Read Vulnerability, combining CVE-2024-41713 and another yet-to-be-assigned issue, allows unauthenticated attackers to remotely and easily exploit the system to read arbitrary files from the underlying file system of a Mitel Collab server. By sending specially crafted requests, attackers can bypass access controls and retrieve sensitive files due to improper input validation and directory traversal flaws. To mitigate this vulnerability, follow the vendor advisory for CVE-2024-41713, ensuring the application properly validates and sanitizes user input to prevent directory traversal attacks.

References:
Created Date
Source IONIX Threat Lab

CVE-2024-0012 – Authentication Bypass at Palo Alto Networks PAN-OS

An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities. The risk of this issue is greatly reduced if you secure access to the management web interface by restricting access to only trusted internal IP addresses according to our recommended best practice deployment guidelines (see references) This issue is applicable only to PAN-OS 10.2, PAN-OS 11.0, PAN-OS 11.1, and PAN-OS 11.2 software. Cloud NGFW and Prisma Access are not impacted by this vulnerability. References:
Created Date
Source IONIX Threat Lab

CVE-2024-10924 – Authentication Bypass at Really Simple Security (WordPress plugin)

The Really Simple Security (Free, Pro, and Pro Multisite) plugin for WordPress is vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1 when the “Two-Factor Authentication” setting is enabled. This is due to improper user check error handling in the two-factor REST API actions with the ‘check_login_and_get_user’ function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator. References:
Created Date
Source IONIX Threat Lab

CVE-2024-8068 and CVE-2024-8069: Citrix Session Recording Vulnerability (claimed to be RCE)

Citrix vulnerability (denoted as two issues: CVE-2024-8068 and CVE-2024-8069) is claimed to lead to unauthenticated remote code execution.
According to the vendor, privilege escalation to NetworkService Account access in Citrix Session Recording and limited remote code execution with privilege of a NetworkService Account access in Citrix Session Recording is possible when an attacker is an authenticated user in the same intranet.

IONIX research team created an exploit simulation module based on available exploits to the issue.
Based on scanning of thousands of Citrix instances in the attack surface of IONIX customers, IONIX research team believes that most of the Citrix instances cannot be attacked remotely (without authentication) with the currently available exploits.

References:
Created Date
Source IONIX Threat Lab

CVE-2024-50340 – Remote Access to Symfony Profiler via Injected Arguments

A security issue in Symfony versions =6, =7, <7.1.7 of the Symfony Runtime component allows unauthorized access to sensitive resources. When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by the kernel when handling the request. The vulnerability is easy to exploit remotely. Although assigned a 7.3 CVSS score, IONIX research team witnesses several vulnerable instances that leaked critically sensitive information.

References:
Created Date
Source IONIX Threat Lab

Remote Code Execution in CyberPanel (Update: CVE was assigned: CVE-2024-51378)

CyberPanel is a free and open-source control panel for Linux servers, designed to simplify web hosting and server management tasks.
A recent vulnerability was discovered in CyberPanel, allowing an easy remote code execution on the affected machines.

The vulnerability is known to be exploited in the wild and an exploit is publicly available.

We recommend to upgrade to the latest version available and follow the referenced vendor’s advisory (Github patch is referenced).

References:
Created Date
Source IONIX Threat Lab

CVE-2024-47575 – FortiManager Remote Code Execution

A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FortiManager 7.0.0 through 7.0.12, FortiManager 6.4.0 through 6.4.14, FortiManager 6.2.0 through 6.2.12, Fortinet FortiManager Cloud 7.4.1 through 7.4.4, FortiManager Cloud 7.2.1 through 7.2.7, FortiManager Cloud 7.0.1 through 7.0.13, FortiManager Cloud 6.4.1 through 6.4.7 allows attacker to execute arbitrary code or commands via specially crafted requests.

Cisa marked this vulnerability as exploited.

References:
Created Date
Source IONIX Threat Lab

CVE-2024-23113 – FortiOS Remote Code Execution

A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, FortiPAM versions 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiSwitchManager versions 7.2.0 through 7.2.3, 7.0.0 through 7.0.3 allows attacker to execute unauthorized code or commands via specially crafted packets.

CISA marked this vulnerability as known exploited.

As of now, IONIX marked assets as potentially affected, if they are known to be running FortiOS, or a technology that implies FortiOS with high probability.

References:
Created Date
Source IONIX Threat Lab

CVE-2024-45519 – Zimbra Collaboration Unauthenticated Remote Command Execution

Multiple versions of Zimbra Collaboration application are affected by an unauthenticated remote command execution vulnerability (CVE-2024-45519). Specifically crafted SMTP commands to Zimbra’s email server component can result in the execution of local OS commands. Versions less than 9.0.0 Patch 41, less than 10.0.9, less than 10.1.1, or less than 8.8.15 Patch 46 are vulnerable.

Remotely detecting of the exact exploit is difficult. Users should instead check that any assets flagged as “Potentially Affected” to ensure they are updated to the latest version of Zimbra.

References:
Created Date
Source IONIX Threat Lab

Critical Linux CUPS Printing System Flaws Could Lead to Remote Command Execution

CUPS (Common UNIX Printing System) is a standards-based, open-source printing system. Recent several vulnerabilities (CVE-2024-47076, CVE-2024-47175, CVE-2024-47176, CVE-2024-47177) were discovered and are potentially allowing hackers to remotely run code on machines that expose the service over UDP (usually, on port 631).

It is recommended to block ports for UDP. It is a good practice to avoid open IPP services also over UDP.

As checking for affected UDP open services triggers a connection from the vulnerable machine to the attacking system, and relying on the fact that most of the detected vulnerable systems over UDP had open IPP service over TCP on the same port, IONIX marks assets as potentially affected based on services with open IPP ports (TCP). Notice, that having IPP service publicly open is also not a good practice, and we recommend to close it as well.

References:
Created Date
Source IONIX Threat Lab

CVE-2024-8752 – Directory Transversal Vulnerability at WebIQ

The Windows version of WebIQ 2.15.9 is affected by a directory traversal vulnerability that allows remote attackers to read any file on the system.

References:
Created Date
Source IONIX Threat Lab

CVE-2024-8503 – Blind SQL Injection in VICIdial

An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records.

References:
Created Date
Source IONIX Threat Lab

CVE-2024-40711 – deserialization lead to remote code execution in Veeam Backup

A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).

References:
Created Date
Source IONIX Threat Lab

CVE-2024-6670 – SQL Injection in WhatsUp Gold by Progress

In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.

References:
Created Date
Source IONIX Threat Lab

CVE-2024-38856 – Incorrect Authorization vulnerability in Apache OFBiz

Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don’t explicitly check user’s permissions because they rely on the configuration of their endpoints).

References:
Created Date
Source IONIX Threat Lab

CVE-2024-6205 – SQL Injection at PayPlus Payment Gateway (WordPress plugin)

The PayPlus Payment Gateway WordPress plugin before 6.6.9 does not properly sanitise and escape a parameter before using it in a SQL statement via a WooCommerce API route available to unauthenticated users, leading to an SQL injection vulnerability.

References:
Created Date
Source IONIX Threat Lab

CVE-2024-36401 – GeoServer Remote Code Execution

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.23.6, 2.24.4, and 2.25.2, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions. The GeoTools library API that GeoServer calls evaluates property/attribute names for feature types in a way that unsafely passes them to the commons-jxpath library which can execute arbitrary code when evaluating XPath expressions.

References:
Created Date
Source IONIX Threat Lab

CVE-2024-5217 – ServiceNow Unauthenticated Remote Code Execution

ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. The vulnerability is addressed in the listed patches and hot fixes below, which were released during the June 2024 patching cycle. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.

References:
Created Date
Source IONIX Threat Lab

CVE-2024-6387 – OpenSSH Unauthenticated Remote Code Execution (regreSSHion)

CVE-2024-6387, also known as regreSSHion, is an unauthenticated remote code execution vulnerability in OpenSSH’s server that grants full root access. It affects the default configuration and does not require user interaction. It poses a significant exploit risk. A crude public exploit does exist for 32-bit systems, but not 64-bit systems.

This vulnerability is a regression of the previously patched vulnerability CVE-2006-5051, reported and fixed in 2006. Due to this uncommon vector of a code regression (re)creating a vulnerability, the versions of OpenSSH sshd are affected is strange: Versions earlier than 4.4p1 are vulnerable unless they have already been patched for CVE-2006-5051 and CVE-2008-4109. Versions from 4.4p1 up to, but not including, 8.5p1 are not vulnerable. Versions from 8.5p1 up to, but not including, 9.8p1 vulnerable.

To resolve the issue, upgrade to the latest version of OpenSSH.

References:
Created Date
Source IONIX Threat Lab

CVE-2024-38526 – Polyfill Supply Chain Attack for malicious code execution

The Polyfill.io service uses JavaScript code to add modern functionality to older browsers that do not usually support it. For example, it adds JavaScript functions that are not available for older browsers but are present in modern ones. Sansec warned today that polyfill.io domain and service was purchased earlier this year by a Chinese company named ‘Funnull’ and the script has been modified to introduce malicious code on websites in a supply chain attack. Over 100,000 domains are affected. References:
Created Date
Source IONIX Threat Lab

CVE-2024-34102 – XML External EntityXML at Adobe Commerce (MAGENTO)

Adobe Commerce (MAGENTO) versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference (‘XXE’) vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.

References:
Created Date
Source IONIX Threat Lab

CVE-2024-4577 – Argument Injection Vulnerability at PHP-CGI

CVE-2024-4577 critical remote code execution vulnerability in the PHP programming language could potentially allow unauthenticated attackers to take full control of affected PHP servers.

The vulnerability arises from an oversight in the Best-Fit feature of encoding conversion within the Windows operating system during PHP implementation. This oversight allows attackers to bypass protections for a previous vulnerability, CVE-2012-1823, using specific character sequences. Consequently, arbitrary code can be executed on remote PHP servers via an argument injection attack, enabling unauthorized access and control.

References:
Created Date
Source IONIX Threat Lab

CVE-2024-24919 – Exposure of Sensitive Information at Check Point Security Gateway

Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. A Security fix that mitigates this vulnerability is available.

References:
Created Date
Source IONIX Threat Lab

CVE-2024-3495 – SQL Injection at Country State City Dropdown CF7 (WordPress plugin)

The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and ‘sid’ parameters in versions up to, and including, 2.7.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

References:
Created Date
Source IONIX Threat Lab

CVE-2024-4956 – Path Traversal at Sonatype Nexus Repository Manager 3

Path Traversal in Sonatype Nexus Repository 3 allows an unauthenticated attacker to read system files. Fixed in version 3.68.1.

References:
Created Date
Source IONIX Threat Lab

CVE-2024-2876 – SQL Injection at Email Subscribers by Icegram Express (WordPress plugin)

The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to SQL Injection via the ‘run’ function of the ‘IG_ES_Subscribers_Query’ class in all versions up to, and including, 5.7.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

References:
Created Date
Source IONIX Threat Lab

CISA Adds CVE-2023-7028 Exploited Vulnerability to Catalog

CISA has added CVE-2023-7028 vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.

CVE-2023-7028 GitLab Community and Enterprise Editions Improper Access Control Vulnerability

References:
Created Date
Source IONIX Threat Lab

CVE-2024-27956 – WP-Automatic Plugin Bug to Create Admin Accounts on WordPress Sites

This vulnerability in the Automatic Plugin for WordPress, allows a SQL injection (SQLi) flaw and poses a severe threat as attackers can exploit it to gain unauthorized access to websites, create admin‑level user accounts, upload malicious files, and potentially take full control of affected sites.
This vulnerability is being used to perform unauthorized database queries and create new admin accounts on susceptible WordPress sites
It impacts all versions of the plugin prior to 3.92.0. The issue has been resolved in version 3.92.1 released on February 27, 2024, although the release notes make no mention of it.

References:Read More
Created Date
Source IONIX Threat Lab

CVE-2024-20359 Cisco Adaptive Security Appliance and Firepower Threat Defense Persistent Local Code

A vulnerability in a legacy capability that allowed for the preloading of VPN clients and plug-ins and that has been available in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary code with root-level privileges. Administrator-level privileges are required to exploit this vulnerability.

This vulnerability is due to improper validation of a file when it is read from system flash memory. An attacker could exploit this vulnerability by copying a crafted file to the disk0: file system of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the affected device after the next reload of the device, which could alter system behavior and persist across reboots.

Customers can detect if they are vulnerable using Cisco’s software checker. Customers with a Cisco Service Contract can download security fixes.

References:
Created Date
Source IONIX Threat Lab

CVE-2024-20353 – Cisco Adaptive Security Appliance and Firepower Threat Defense Denial of Service

A vulnerability in the management and VPN web servers for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.

This vulnerability is due to incomplete error checking when parsing an HTTP header. An attacker could exploit this vulnerability by sending a crafted HTTP request to a targeted web server on a device. A successful exploit could allow the attacker to cause a DoS condition when the device reloads.

To determine whether a device that is running Cisco ASA Software or FTD Software is affected, use the “show asp table socket | include SSL” command and look for an SSL listen socket on any TCP port.

Customers with a Cisco Service Contract can download security fixes.

References:
Created Date
Source IONIX Threat Lab

CVE-2024-4040 – CrushFTP VFS Sandbox Escape

A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.

Public exploits for this vulnerability were published and are used by hackers.

References:
Created Date
Source IONIX Threat Lab

CVE-2024-3400 – PAN-OS OS Command Injection Vulnerability in GlobalProtect Gateway

An OS Command Injection vulnerability in PAN GlobalProtect is being exploited in the wild. IONIX is now running a full exploit simulation for this vulnerability to better detect vulnerability devices.

PAN versions PAN-OS 10.2, PAN-OS 11.0, and PAN-OS 11.1 impacted. loud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability. All other versions of PAN-OS are also not impacted.

PAN is in the process of releasing hotfixes to update the affected versions. At this time not all versions have a hotfix available. You should check with PAN to see if a hotfix is available.

Additionally, PAN customers with a Threat Prevention subscription can protect themselves enabling Threat ID 95187.

In earlier versions of this advisory, disabling device telemetry was listed as a secondary mitigation action. Disabling device telemetry is no longer an effective mitigation.

References:
Created Date
Source IONIX Threat Lab

CVE-2024-2879 – SQL Injection in LayerSlider (WordPress plugin)

The LayerSlider plugin for WordPress is vulnerable to SQL Injection via the ls_get_popup_markup action in versions 7.9.11 and 7.10.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Exploits are available online and attempts to exploit the vulnerability were detected.

References:
Created Date
Source IONIX Threat Lab

CVE-2024-29059 – Leaking ObjRefs and Potential Remote Code Execution by Exploiting .NET Remoting

.NET Remoting allows invocation of methods across so-called remoting boundaries. Supported transports between the client and server include HTTP and TCP. .NET Remoting was already considered a legacy technology in 2009, but it is still in use due to the wide usage of ASP. NET (e.g., IIS, Sharepoint and others) and backward compatibility.
Leakage of ObjRef instances allows hackers to remotely manipulate the server, and in some cases to remotely run code on the server.
IONIX Exploit Simulation successfully simulated the leakage via a POST request to the “/RemoteApplicationMetadata.rem?wsdl” endpoint, but did not use the leaked ObjRefs to manipulate the server.
To remediate, update the ASP.NET application and verify that it does not leak ObjRef objects that could be used for attacking the server.

References:
Created Date
Source IONIX Threat Lab

CVE-2024-20767 – Adobe ColdFusion Arbitrary File Read

ColdFusion versions 2023.6, 2021.12, and earlier are affected by an Improper Access Control vulnerability that could lead to arbitrary file system read.
An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access to sensitive files and perform arbitrary file system write. Exploitation of this issue does not require user interaction.

References:
Created Date
Source IONIX Threat Lab

CVE-2024-27954 – File Download and SSRF in Automatic (WordPress plugin)

Automatic, a WordPress plugin, in versions <= 3.92.0 is vulnerable to Unauthenticated Arbitrary File Download and Server-Side Request Forgery attacks. The security issue is easy to exploit and it is reported to be exploited in the wild.

Created Date
Source IONIX Threat Lab

CVE-2024-21762 – Potentially Vulnerable Fortinet Devices

According to Fortinet, the Fortinet FortiOS vulnerability (affecting also Fortinet VPN) CVE-2024-21762 allows attackers to execute unauthorized code or commands via specifically crafted requests and is potentially exploited in the wild.
CISA marked the vulnerability as exploited.

While a full exploit simulation is not available, the IONIX research team used a deeper version analysis to distinguish between patched versions and older, vulnerable ones.
The analysis leverages a change that was done in the patched version that blocks “chunk-encoded” malformed requests. Our testing tool sends multiple test requests to see that the assets are live and then sends a badly formed “chunk-encoded” probe that is expected to time out only on vulnerable versions.

References:
Created Date
Source IONIX Threat Lab

CVE-2024-1071 – SQL Injection in Ultimate Member (WordPress plugin)

The Ultimate Member plugin for WordPress is vulnerable to SQL Injection via the ‘sorting’ parameter in versions 2.1.3 to 2.8.2 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query.
This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

References:
Created Date
Source IONIX Threat Lab

Akira Ransomware Group leverages Cisco CVE-2020-3259

According to CISA and other reports, an old vulnerability in Cisco ASA and FTD, CVE-2020-3259, is being exploited by the Akira Ransomware group (and others). This vulnerability involves an unauthenticated memory disclosure issue.
IONIX research team has conducted a scan for CVE-2020-3580, another Cisco ASA/FTD vulnerability. With high probability, assets that are vulnerable to CVE-2020-3580 are also vulnerable to CVE-2020-3259.
While the IONIX research team tests the feasibility of simulating a CVE-2020-3259 exploit non-intrusively, we recommend:
1. Use the IONIX platform to test whether you are vulnerable to spot assets that are vulnerable to CVE-2020-3580 (Action Items).
2. Review all the Cisco ASA assets. Notice that assets might be vulnerable to CVE-2020-3259 without being vulnerable to CVE-2020-3580.
3. For relevant assets, follow the guide by Cisco.
4. Keep an eye on security bulletins and updates from IONIX and Cisco

References:
Created Date
Source IONIX Threat Lab

CVE-2024-22024 – XML External Entity (XXE) vulnerability in Ivanti Connect Secure

An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x; previously known as PulseSecure), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways which allows an attacker to access certain restricted resources without authentication.
CISA recognized this vulnerability as exploited.

References:
Created Date
Source IONIX Threat Lab

CVE-2024-21893 – Server-side Request Forgery (SSRF) vulnerability in Ivanti Connect Secure

A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x; previously known as PulseSecure) and Ivanti Policy Secure (9.x, 22.x), and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.
The vulnerability was recognized by CISA as exploitable.

References:
Created Date
Source IONIX Threat Lab

CVE-2024-1061 – SQL Injection in HTML5 Video Player (WordPress plugin)

The ‘HTML5 Video Player’ WordPress Plugin, version < 2.5.25 is affected by an unauthenticated SQL injection vulnerability in the 'id' parameter in the 'get_view' function.

Created Date
Source IONIX Threat Lab

Local File Inclusion and potential RCE in Jenkins CVE-2024-23897

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an ‘@’ character followed by a file path in an argument with the file’s contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.
This leads to information leakage and potentially to remote code execution on the server.

References:
Created Date
Source IONIX Threat Lab

Remote Code Execution vulnerability in Atlassian Confluence Data Center

A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action.
CISA recognized this vulnerability as exploited.

References:
Created Date
Source IONIX Threat Lab

CVE-2023-7028 Gitlab Account Takeover via Password Reset without user interactions

An issue has been discovered in GitLab CE/EE, in which user account password reset emails could be delivered to an unverified email address resulting in Account Takeover via Password Reset without user interactions.
It is strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.

Read More
Created Date
Source IONIX Threat Lab

CVE-2024-0352 – Arbitrary File Upload vulnerability in Likeshop

A vulnerability classified as critical was found in Likeshop up to 2.5.7.20210311. This vulnerability affects the function FileServer::userFormImage of the file server/application/api/controller/File.php of the component HTTP POST Request Handler.
The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

References:

WATCH A SHORT IONIX DEMO

See how easy it is to implement a CTEM program with IONIX. Find and fix exploits fast.