Week in review: Covertly connected and insecure Android VPN apps, Apple fixes exploited zero-day
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2018-0171 | Unauthenticated RCE/DoS in Cisco IOS & IOS XE Smart Install | 9.8 | 99% | KEV | KEV |
| CVE-2025-31324 | Unauthenticated File Upload RCE in SAP NetWeaver Visual Composer | 9.8 | 99% | KEVRansomwarePoC | KEV |
| CVE-2025-42999 | Insecure Deserialization in SAP NetWeaver Visual Composer Metadata Uploader | 9.1 | 13% | KEVRansomwarePoC | KEV |
| CVE-2025-43300 | Actively Exploited Out-of-Bounds Write in Apple iOS/iPadOS/macOS Image I/O | 10.0 | 65% | KEVPoC | KEV |
From the original article
4 min read at helpnetsecurity.com
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Android VPN apps used by millions are covertly connected AND insecure Three families of Android VPN apps, with a combined 700 million-plus Google Play downloads, are secretly linked, according to a group of researchers from Arizona State University and Citizen Lab.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.