Ransomwarecritical
⚡ THN Weekly Recap: New Attacks, Old Tricks, Bigger Impact
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-41334 | Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor… | 8.8 | <1% | ||
| CVE-2024-41340 | An issue in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to… | 8.4 | <1% | ||
| CVE-2024-48248 | Unauthenticated absolute path traversal file read in NAKIVO Backup & Replication | 8.6 | 94% | KEVPoC | KEV |
| CVE-2024-50302 | Kernel Memory Leak via Uninitialized HID Report Buffer in Linux Kernel | 5.5 | <1% | KEV | KEV |
| CVE-2024-51138 | Vigor165/166 4.2.7 and earlier | 9.8 | 1% | ||
| CVE-2024-51139 | Buffer Overflow vulnerability in Vigor2620/LTE200 3.9.8.9 and earlier and Vigor2860/2925 3.9.8 and earlier and Vigor2862/2926 3.9.9.5 and earlier and… | 9.8 | <1% | ||
| CVE-2024-56325 | Authentication Bypass in Apache Pinot Controller API | 9.8 | 80% | ||
| CVE-2025-0364 | BigAntSoft BigAnt Server, up to and including version 5.6.06, is vulnerable to unauthenticated remote code execution via account registration | 9.8 | 2% | PoC | |
| CVE-2025-1080 | LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server | 7.2 | <1% | ||
| CVE-2025-1316 | Unauthenticated OS Command Injection RCE in Edimax IC-7100 IP Camera | 9.3 | 74% | KEV | KEV |
| CVE-2025-1723 | Zohocorp ManageEngine ADSelfService Plus versions 6510 and below are vulnerable to account takeover due to the session mishandling | 8.1 | 1% | ||
| CVE-2025-20206 | A vulnerability in the interprocess communication (IPC) channel of Cisco Secure Client for Windows could allow an authenticated, local attacker to perform a… | 7.8 | <1% | ||
| CVE-2025-22224 | TOCTOU Out-of-Bounds Write in VMware ESXi and Workstation Enables Guest-to-Host Escape | 8.2 | 2% | KEV | KEV |
| CVE-2025-22225 | Sandbox Escape via Arbitrary Kernel Write in VMware ESXi (Actively Exploited) | 8.2 | 1% | KEVRansomware | KEV |
| CVE-2025-22226 | Out-of-Bounds Read in VMware ESXi, Workstation, and Fusion Leaks Host Memory via HGFS | 6.0 | 2% | KEV | KEV |
| CVE-2025-24494 | Path traversal may allow remote code execution using privileged account (requires device admin account, cannot be performed by a regular user) | 8.6 | 1% | ||
| CVE-2025-25015 | Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests | 9.9 | 1% | ||
| CVE-2025-27218 | Insecure Deserialization RCE in Sitecore Experience Manager (XM) and XP 10.4 | 5.3 | 65% | ||
| CVE-2025-27423 | Shell Command Injection in Vim tar.vim Plugin via Crafted Tar Archives | 7.1 | 22% | ||
CVE-2025-27622+1 related CVE | Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of agents via REST API or CLI… | 4.3 | <1% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | crrsg.site | n in 2021. There are at least 2,727 registered operators on crrsg.site. "The infrastructure of this operation includes a centraliz |
From the original article
13 min read at thehackernews.com
Ravie Lakshmanan Mar 10, 2025 Cybersecurity / Newsletter Cyber threats today don't just evolve—they mutate rapidly, testing the resilience of everything from global financial systems to critical infrastructure.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.