Eduardo Ghidoli’s Post

SUMMARY: Ivanti warns that a high-severity flaw in its Connected Secure Access (CSA) product is being actively exploited in the wild. MAIN POINTS: - The vulnerability is tracked as CVE-2023-20178. - The flaw allows remote attackers to execute arbitrary code. - Ivanti released a patch and urged immediate updates. TAKEAWAYS: - Update Ivanti CSA immediately to mitigate potential risks. - Failure to patch could result in severe security breaches. - Monitor for any unusual activity in affected systems. #Ivanti #CVE202320178 #cybersecuritynews

14 new vulnerabilities allow for actors to potentially hijack and pilot DreyTek routers to include things like buffer overflow vulnerabilities, XSS attacks, Ransomware lateral movement, stack overflows. Two of the 14 vulnerabilites have been given the highest CVSS score of 10/10, those two being the buffer overflow concern and a command injection exploit. The base software contained in the router that allows for user / web interfacing is what is providing the gateway for these vulnerabilities that affect over 704,000 routers, with most of the incidents of router tampering occurring in the US. Patches have been released for these vulnerabilities including equipment that might be nearing EOL. There is a catch however: the software needed to download these patches uses the malicious software in some instances. Forescout Vedere Labs, the ones responsible for identifying the issues, recommends that users disable SSH and RDP functionality of your devices while patching the system. #LetsBeCarefulOutThere #csc270 https://lnkd.in/eHf5eGin

The latest update for #Ivanti includes "How EASM Discovers Your Attack Surface Vulnerabilities" and "#CloudMigration: Unlock the Full Power of Your Unified #EndpointManagement Solution". #AssetManagement #ITSM https://lnkd.in/ey2Jeqq

Ivanti's recent update addressing 10 critical vulnerabilities in Endpoint Manager (EPM) made a significant impact on its customers. The urgency of the fix prompted quick action to avoid potential security risks and safeguard systems. Some customers may have faced disruptions in their IT operations but prioritized security. These vulnerabilities likely led to reassessments of trust in Ivanti's security practices, highlighting the importance of proactive measures. P.S. Ready for an upgrade? #Hexnode secures what matters most! #SecurityUpdate #EndpointManager #CyberSecurity #SoftwareUpdate #EnterpriseSecurity

A true zero trust platform, like Zscaler Private Access, removes the threat of zero day vulnerabilities that have plagued Ivanti, as well as all other legacy VPN solutions, by removing all remote access entry points. True #zerotrust means no exposed devices or IP addresses to attack, because authorization happens before an inside out connection is ever made. To learn more, we encourage you to read this blog published by the Zscaler ThreatLabz Team.

Ivanti - more bad news and same with Palo Alto vulnerabilities - Secure your OT and Critical Server access with BeyondTrust Secure Remote Access. PRA/SRA include built in MFA per access and per session plus only speak 443 outbound with granular control on what you can see and JIT access or persistent access with role. #SecureAccess #MFA #OT #ServerAccess Privileged Remote Access | BeyondTrust

[❗Security Bulletin] Ivanti, the software vendor, and Volexity, the organisation that discovered the flaws, have observed active exploitation of these vulnerabilities in the wild. Threat actors have used these vulnerabilities to gain initial access to internal networks, leading to data exfiltration.     As such, Triskele Labs recommends investigating any internet-facing Ivanti devices to look for Indicators of Compromise (IOCs). Currently known IOCs are listed at the end of the bulletin.

A “single, centralized point of control” is not always a good thing considering the amount of critical vulnerabilities associated with BIG-IP Next Central Manager. Should all vulnerabilities (that have been reported) be acknowledged regardless of the progress toward a patch? I feel that is duty rather than a privilege. https://lnkd.in/eKK5h8V9

Two security vulnerabilities have been discovered in F5 Next Central Manager that could be exploited by a threat actor to seize control of the devices and create hidden rogue administrator accounts for persistence. #f5 #vulnerability #security

🚨New vulnerabilities were recently discovered in Ivanti VPN products🚨CISA mandated that US federal agencies must disconnect affected products from their networks. 🛡 Wiz is here to help with actionable advice and insights on these vulnerabilities. Check out the blog below 👇 📲 I can connect you with a cloud threat experts to help you detect and remediate any instances in cloud with a free Wiz assessment of your cloud environment.