U.S. CISA adds Smartbedded Meteobridge, Samsung, Juniper ScreenOS, Jenkins, and GNU Bash flaws to its Known Exploited Vulnerabilities catalog

GNU Bash through version 4.3 improperly processes trailing strings that follow function definitions inside environment variable values, allowing injected commands to run (CWE-78, OS command injection); this flaw is widely known as 'Shellshock'. An attacker triggers it by supplying a crafted environment variable to any service that invokes Bash, most notably CGI web handlers but also SSH, DHCP clients, and other software that sets variables and spawns the shell. Successful exploitation yields arbitrary code execution with the privileges of the Bash process on the target host. Any Linux, Unix, or similar system running an unpatched Bash through 4.3 is affected, including web servers, appliances, and embedded devices that ship the shell. Exploitation is confirmed in the wild: the flaw is in CISA's KEV (added 2022-01-28) with a required action to apply vendor updates, and EPSS assigns it a 100% probability of exploitation within 30 days, so patching is urgent.

Do: Apply Bash updates per your OS vendor's instructions, as required by the CISA KEV listing, ensuring the installed shell is a patched build newer than the unpatched 4.3-era code. Prioritize internet-exposed systems that pass environment variables to Bash, especially CGI-based web servers, and audit embedded appliances and other Linux/Unix hosts that may have been missed by standard patching.

GNU Bash, the standard command interpreter shipped with most Linux, Unix, and macOS systems, mishandles specially crafted environment variables, allowing attackers to inject and execute arbitrary OS commands (CVE-2014-6278 is one of the follow-on "Shellshock" parsing flaws disclosed in September 2014 alongside the original CVE-2014-6271). Exploitation requires a path where attacker-controlled data reaches Bash through the environment, classically via web CGI scripts, restricted or forced-command SSH configurations, DHCP clients, and other services that invoke the shell. A successful attack yields arbitrary command execution with the privileges of the invoking service, potentially leading to full system compromise. Any unpatched GNU Bash installation is affected, including Linux/Unix servers, macOS endpoints, and embedded or network appliances that bundle the shell. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2025-10-02, confirming exploitation in the wild, and EPSS assigns a 99.5% probability of exploitation within 30 days.

Do: Upgrade Bash to your distribution's or vendor's current patched build (all major Linux distributions and Apple shipped fixes after the September 2014 disclosures) and verify installed package versions rather than assuming patch status. Prioritize remediation on internet-facing systems where Bash may run with attacker-controlled environment variables, such as web/CGI servers, SSH forced-command setups, and embedded appliances, and follow CISA BOD 22-01 mitigation guidance per the KEV listing, or discontinue use if patches are unavailable. Hunt for legacy or embedded images that never received the 2014-era patches, since those are the most likely remaining vulnerable instances.

GNU Bash through version 4.3 incorrectly processes trailing strings appended after function definitions in environment variable values, allowing arbitrary code execution; this CVE tracks the residual flaw that remained after the original Shellshock fix in CVE-2014-6271. It is triggered whenever Bash parses an attacker-controlled environment variable containing a function definition followed by trailing content, a pattern common in CGI-based web services, DHCP clients, SSH forced-command deployments, and other places where Unix shells handle environment data. An attacker who triggers the flaw gains arbitrary command execution with the privileges of the process invoking Bash, which on exposed web or network services can mean direct remote code execution. Any system running Bash 4.3 or earlier is affected, which effectively includes virtually every Linux and Unix deployment plus many embedded and network devices. Exploitation is confirmed: the flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-01-28) and carries a 99.9% EPSS probability of exploitation within 30 days.

Do: Apply updated Bash packages from your OS vendor per CISA's required action, ensuring the update addresses both CVE-2014-6271 and this follow-on flaw (CVE-2014-7169). Prioritize internet-facing systems that invoke Bash with attacker-influenced environment variables, such as web servers running CGI scripts and devices processing DHCP or SSH command environments. After patching, verify the fix using your vendor's recommended Shellshock regression test rather than ad-hoc checks.

CVE-2015-7755 is an improper authentication flaw (CWE-287) in Juniper ScreenOS that allows an unauthenticated remote attacker to gain administrative access to affected Juniper firewalls. It is triggered remotely via the device's administrative access path — widely reported as a hardcoded-credential backdoor reachable over SSH/Telnet management sessions, so any network that can reach the management interface is exposed. A successful attacker gains full administrator control of the firewall, enabling configuration changes, traffic manipulation, credential theft, and persistence. Only organizations running Juniper ScreenOS (legacy NetScreen/SSG firewall deployments) are affected. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2025-10-02, confirming exploitation in the wild; no public proof-of-concept is known.

Do: Per the CISA required action and BOD 22-01, upgrade ScreenOS to a fixed release per Juniper's advisory, or if fixed versions are unavailable for your hardware, discontinue use or immediately restrict SSH and Telnet administrative access to trusted management networks. Audit device logs for unexpected administrative logins, rotate or reset administrative credentials, and treat any long-lived ScreenOS firewall as potentially compromised given the backdoor history and current KEV listing.

CVE-2017-1000353 is an unauthenticated remote code execution flaw in the Jenkins CLI (CWE-502): an attacker can send a crafted serialized Java SignedObject to the remoting-based CLI endpoint, where it is deserialized with a new ObjectInputStream and bypasses Jenkins' existing blacklist-based deserialization protection. Triggering it requires only network reachability to the Jenkins remoting CLI — no authentication or user interaction — which is why the flaw scores 9.8 (critical) under CVSS 3.1. Successful exploitation gives arbitrary code execution with the privileges of the Jenkins process, i.e., full control of the CI/CD server and any credentials, source code, and build infrastructure it holds; Jenkins servers have historically been targeted for cryptomining campaigns such as JenkinsMiner, which reportedly generated $3.4 million. All Jenkins versions 2.56 and earlier and 2.46.1 LTS and earlier are affected, including Oracle Communications Cloud Native Core Automated Test Suite deployments that bundle affected Jenkins releases. Exploitation status is serious: a public proof-of-concept exploit exists (Exploit-DB 41965), EPSS estimates a 99.7% probability of exploitation within 30 days, and CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2025-10-02.

Do: Upgrade to Jenkins 2.57 or later (weekly line) or 2.46.2 LTS or later, which add SignedObject to the deserialization blacklist, backport the HTTP CLI protocol, and deprecate/disable the remoting (Java serialization) CLI by default; as an interim mitigation, disable or restrict access to the remoting CLI (e.g., the /cli endpoint) from untrusted networks. Because the flaw is in CISA's KEV catalog, federal agencies must apply vendor mitigations or discontinue use per BOD 22-01, and all administrators of internet-facing Jenkins instances should check for signs of compromise such as cryptomining processes. Oracle Communications Cloud Native Core Automated Test Suite users should apply the applicable Oracle security patch/update addressing CVE-2017-1000353.

CVE-2025-21043 is an out-of-bounds write vulnerability (CWE-787) in libimagecodec.quram.so, the image-decoding library used by Samsung Mobile Devices. It can be triggered remotely when the vulnerable codec processes maliciously crafted image data, and per the CVSS vector it requires no privileges or user interaction. A successful attack allows a remote attacker to execute arbitrary code on the device with high impact on confidentiality, integrity, and availability (CVSS 9.8, critical). All Samsung mobile devices running a security update prior to the September 2025 Maintenance Release (SMR Sep-2025 Release 1) are affected. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog as of October 2, 2025, indicating exploitation in the wild, and headlines note Samsung patched it as an actively exploited zero-day; a related Samsung image-codec zero-day (CVE-2025-21042) was used to deliver LANDFALL spyware.

Do: Update affected Samsung devices to SMR Sep-2025 Release 1 or later via Settings > Software update, prioritizing devices exposed to untrusted image content (messaging, email, browsers). CISA KEV requires applying the vendor fix (or discontinuing use) under BOD 22-01 timelines for federal systems. Because exploitation has been observed in the wild and a related image-codec zero-day (CVE-2025-21042) was used to deploy LANDFALL spyware, verify fleet patch levels and investigate any devices showing signs of spyware infection.

The Meteobridge web interface, implemented in CGI shell scripts and C, exposes an endpoint vulnerable to command injection (CWE-77) with missing authentication requirements (CWE-306). A remote, unauthenticated attacker who can reach the web interface can supply crafted input that is passed to the underlying shell, gaining arbitrary command execution with root privileges on the device. Affected products are Smartbedded Meteobridge firmware and the Meteobridge VM, used to bridge weather-station data. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2025-10-02, and public reporting indicates it is being actively exploited in the wild; EPSS puts the 30-day exploitation probability at 93.7%. Exploitation details are documented in a public advisory by the discovering researcher (oneKey).

Do: Apply the fix or mitigations per the Smartbedded vendor instructions referenced in the CISA KEV entry (fixed version numbers are not specified in the source data, so consult the vendor advisory and the oneKey write-up before upgrading). Until patched, do not expose the Meteobridge web interface directly to the internet — restrict it to trusted management networks or via VPN/firewall rules — and check exposed instances for signs of compromise given confirmed in-the-wild exploitation. Organizations under BOD 22-01 must apply the required mitigations within the mandated timeframe or discontinue use of the product.