Serra Ilgaz’s Post

BEWARE IVANTI VPN USERS - #BETTERISPOSSIBLE - There’s a new threat to the safety of your data that I want to bring to your attention.  Two significant vulnerabilities in Ivanti VPN, identified as CVE-2024-21887 and CVE-2023-46805, are resulting in the theft of configuration data, alteration of system files, and the downloading of harmful files. Businesses just like yours have already been hit and are suffering the consequences. These attacks can even transform your VPN into a tool for attacking other companies like your customers. These vulnerabilities allow for severe security breaches, including unauthenticated remote code execution. So please REMOVE COMPROMISED DEVICES from your network and immediately prepare for an upcoming patch. We understand the complexity of such security challenges and we want to help. #BETTERISPOSSIBLE - You’re not in this alone. If you're concerned about your current security measures, we can provide a comprehensive review and assist with necessary updates. Proactive defense is key to maintaining your business's integrity. Let's discuss how we can help secure your network. Dedicated to your Security. https://lnkd.in/eYESgvas

BEWARE IVANTI VPN USERS - #BETTERISPOSSIBLE - There’s a new threat to the safety of your data that I want to bring to your attention.  Two significant vulnerabilities in Ivanti VPN, identified as CVE-2024-21887 and CVE-2023-46805, are resulting in the theft of configuration data, alteration of system files, and the downloading of harmful files. Businesses just like yours have already been hit and are suffering the consequences. These attacks can even transform your VPN into a tool for attacking other companies like your customers. These vulnerabilities allow for severe security breaches, including unauthenticated remote code execution. So please REMOVE COMPROMISED DEVICES from your network and immediately prepare for an upcoming patch. We understand the complexity of such security challenges and we want to help. #BETTERISPOSSIBLE - You’re not in this alone. If you're concerned about your current security measures, we can provide a comprehensive review and assist with necessary updates. Proactive defense is key to maintaining your business's integrity. Let's discuss how we can help secure your network. Dedicated to your Security. https://lnkd.in/gK6nE6b8

Palo Alto Networks has recently released hotfixes to address a maximum-severity security flaw impacting PAN-OS software. This vulnerability has come under active exploitation in the wild, making it a significant risk for those who use the software. The release of these hotfixes is a crucial step in ensuring the security and safety of your systems. As always, it is important to stay vigilant and up-to-date on the latest security measures to protect against potential threats. #vulnerability #exploit #devsecops #infosec

Palo Alto Networks has released hotfixes to address a maximum-severity security flaw impacting PAN-OS software that has come under active exploitation in the wild. Tracked as CVE-2024-3400 (CVSS score: 10.0), the critical vulnerability is a case of command injection in the GlobalProtect feature that an unauthenticated attacker could weaponize to execute arbitrary code with root privileges on the firewall. https://lnkd.in/eGMv7Pcg

Palo Alto Networks has released hotfixes to address a maximum-severity security flaw impacting PAN-OS software that has come under active exploitation in the wild. Tracked as CVE-2024-3400 (CVSS score: 10.0), the critical vulnerability is a case of command injection in the GlobalProtect feature that an unauthenticated attacker could weaponize to execute arbitrary code with root privileges on the firewall. https://lnkd.in/gWiJpqpS

“A suspected nation-state adversary has been observed weaponizing three security flaws in Ivanti Cloud Service Appliance (CSA) a zero-day to perform a series of malicious actions.    That's according to findings from Fortinet FortiGuard Labs, which said the vulnerabilities were abused to gain unauthenticated access to the CSA, enumerate users configured in the appliance, and attempt to access the credentials of those users.    "The advanced adversaries were observed exploiting and chaining zero-day vulnerabilities to establish beachhead access in the victim's network," security researchers Faisal Abdul Malik Qureshi, John Simmons, Jared Betts, Luca Pugliese, Trent Healy, Ken Evans, and Robert Reyes said.”    Attackers used stolen credentials for admin accounts to exploit a command injection vulnerability in /gsb/reports.php and install a web shell called "help.php" for remote access. After Ivanti disclosed the vulnerability (CVE-2024-8190) on September 10, 2024, the attackers, still inside the victim’s network, patched the exploited vulnerabilities to block other hackers from using the same flaws. This tactic prevents interference from other attackers, helping the initial hackers maintain exclusive control over the compromised system.    By fixing the vulnerabilities they exploited, the hackers ensured that no other groups could compromise the same system, giving them exclusive control and reducing competition. This demonstrates how threat actors treat compromised systems as valuable assets to protect their operations. https://lnkd.in/gjVF-Apy     #cybertronium #cybertroniummalaysia #networksecurity #vulnerability 

Exploitation of Unpatched D-Link NAS Device Vulnerabilities Soars: Second identifier, CVE-2024-3272, assigned to unpatched D-Link NAS device vulnerabilities, just as exploitation attempts soar.  The post Exploitation of Unpatched D-Link NAS Device Vulnerabilities Soars appeared first on SecurityWeek.

Fortinet has disclosed a new critical security flaw in FortiOS SSL VPN that it said is likely being exploited in the wild. The vulnerability, CVE-2024-21762 (CVSS score: 9.6), allows for the execution of arbitrary code and commands. "A out-of-bounds write vulnerability [CWE-787] in FortiOS may allow a remote unauthenticated attacker to execute arbitrary code or command via specially

"The main thing we're witnessing with this race-condition vulnerability is that although there is already a Proof-of-Concept exploit for it, exploitation is mostly possible in a 'lab setting.' It is a statistical exploit by nature: it takes a significant number of attempts to win the race condition and successfully execute arbitrary code, and there are quite a few obstacles that attackers need to overcome. The best-known exploit takes over four hours to run, even in the best-case scenario. Organisations are recommended to try and limit access to SSH servers and monitor for suspicious network activity." Take a look at the full story with insights from Dazz CTO Tomer Schwartz in Cyberdaily: The Cybersecurity Daily News 👇