U.S. CISA adds Microsoft Windows and Rejetto HTTP File Server bugs to its Known Exploited Vulnerabilities catalog

CVE-2024-20399 is a command injection flaw (CWE-78) in the CLI of Cisco NX-OS Software, caused by insufficient validation of arguments passed to specific configuration CLI commands. An authenticated attacker who already holds Administrator credentials can trigger it by submitting crafted input as the argument of an affected configuration command, gaining the ability to execute arbitrary commands as root on the device's underlying operating system. Because Administrator access is required, the flaw is effectively a privilege-escalation issue following credential compromise, and it grants no additional privilege on Nexus 3000 Series, Nexus 7000 Series running NX-OS 8.1(1) or later, and Nexus 9000 Series in standalone NX-OS mode, which already allow administrative bash-shell access to the OS. Any organization running affected NX-OS on Cisco Nexus switching is in scope, with the practical risk concentrated in environments where admin credentials may have been stolen. Exploitation has been observed in the wild: the China-linked group 'Velvet Ant' (associated with Salt Typhoon) used it as a zero-day to compromise U.S. ISPs and telecom providers, and CISA added it to the Known Exploited Vulnerabilities catalog on 2024-07-02.

Do: Upgrade affected Nexus switches to a fixed NX-OS release per Cisco's security advisory, as required by the CISA KEV listing (apply mitigations per vendor instructions or discontinue use if fixes are unavailable). Restrict and audit Administrator-level CLI access on NX-OS devices, and hunt for suspicious configuration-command activity or unexplained root-level actions, given Velvet Ant/Salt Typhoon targeting of telecom and ISP networks. For Nexus 3000, Nexus 7000 (8.1(1)+), and Nexus 9000 standalone-mode devices the flaw adds no privilege, but patching is still recommended.

Rejetto HTTP File Server (HFS), a free Windows-based file-sharing server, contains a template injection vulnerability (CWE-94/CWE-1336) in versions up to and including 2.3m that allows a remote, unauthenticated attacker to execute arbitrary commands by sending a specially crafted HTTP request. The flaw is network-exploitable with no privileges or user interaction required (CVSS 3.1: 9.8 Critical), and the affected 2.3m release is no longer supported by the vendor. Any system running Rejetto HFS 2.3m or earlier is affected, with instances exposed directly to the internet at the greatest risk. Exploitation is confirmed in the wild: CISA added the vulnerability to the Known Exploited Vulnerabilities catalog on 2024-07-09 with known ransomware use, EPSS assigns a 99.5% probability of exploitation within 30 days, and public PoCs and a Metasploit module are available. Related reporting on Russia-aligned TAG-110 activity (HATVIBE/CHERRYSPY malware) against Ukrainian institutions highlights active targeting around the same period.

Do: Because HFS 2.3m is end-of-life with no fixed 2.x version indicated in the available data, follow CISA's required action: apply mitigations per vendor instructions or discontinue use of the product, and at minimum remove it from direct internet exposure (firewall/ACL rules or VPN-only access). Hunt for compromise by checking HFS access logs for crafted HTTP requests containing template/macro syntax and the HFS service process for unexpected child processes. Organizations subject to CISA KEV remediation deadlines should prioritize this fix given the 9.8 Critical severity, 99.5% EPSS, and known ransomware use.

CVE-2024-38112 is a spoofing flaw (CWE-451) in the Microsoft Windows MSHTML platform, the Windows component used to render web content, including by applications that embed the legacy Internet Explorer engine. It is triggered when a user interacts with attacker-controlled content rendered through MSHTML: the attack requires no privileges, travels over the network, and needs user interaction (UI:R per its CVSS vector), letting an attacker misrepresent critical UI information to the victim. Despite being classified as spoofing, the CVSS impact scores are high across confidentiality, integrity, and availability, and the CVSS base score is 7.5 (High). Any system running the affected Windows 10 (1507, 1607, 1809, 21H2, 22H2), Windows 11 (21H2, 22H2, 23H2), or Windows Server (2008, 2012, 2016, 2019) releases is affected. Exploitation is confirmed in the wild: Microsoft patched it as an actively exploited zero-day in July 2024, CISA added it to the Known Exploited Vulnerabilities catalog on 2024-07-09, and reporting indicates it had been exploited for over a year before the fix.

Do: Apply Microsoft's July 2024 security updates (Patch Tuesday) across all affected Windows 10, Windows 11, and Windows Server versions, prioritizing internet-facing and user workstations given confirmed in-the-wild exploitation and the 84.2% EPSS score. Until patched, remind users to avoid interacting with untrusted web or document content, since exploitation requires user interaction. Track the fix against CISA's KEV catalog deadlines and verify patch status on all endpoints.