CISA adds WatchGuard flaw to its Known Exploited Vulnerabilities Catalog

Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and in R2 releases before R2 2017 SP2 uses weak encryption for the RadAsyncUpload component, allowing unauthenticated remote attackers to forge upload parameters, upload arbitrary files to the web server, and ultimately execute arbitrary code. The flaw is triggered simply by sending crafted requests to the vulnerable upload handler over the network, with no authentication or user interaction required. Successful exploitation gives an attacker arbitrary file upload and remote code execution in the context of the ASP.NET application, which is typically hosted on IIS web servers. Any site or application built with Telerik UI for ASP.NET AJAX is affected, and the weakness is confirmed exploited in the wild: it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-04-11, and related reporting describes multiple hacking groups — including IIS/ASP.NET-focused APT actors — breaching a U.S. federal agency through it.

Do: Upgrade Telerik UI for ASP.NET AJAX to R1 2017 or R2 2017 SP2 (or later) per vendor instructions, and verify the deployed Telerik.Web.UI.dll version in each application's bin folder. Given active in-the-wild exploitation of IIS/ASP.NET applications, review affected web servers for unauthorized uploads and web shells and rotate ASP.NET machine keys used with RadAsyncUpload.

QNAP Network-Attached Storage (NAS) devices contain a command injection vulnerability (CWE-77/CWE-78) in which unsanitized input is passed to an operating-system command shell, allowing remote attackers to run arbitrary commands. The flaw is reachable over the network through the NAS device's software interfaces, so an attacker who can reach a vulnerable device can trigger the injection and achieve remote code execution. Successful exploitation gives an attacker control of the NAS, including access to stored data and a potential foothold for lateral movement or ransomware, though CISA has not confirmed ransomware use in this case. Any organization running an affected QNAP NAS device is exposed, especially where the management interface is internet-facing; exact affected version ranges are not stated in the available data and should be taken from QNAP's security advisory. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2022-04-11, indicating exploitation has been observed in the wild, and its 33.4% EPSS score (98th percentile) signals elevated near-term exploitation risk, although no public PoC is known.

Do: Apply the vendor's firmware/OS updates per QNAP's security advisory, as this is the required action under CISA's KEV catalog. Until patched, remove direct internet exposure of NAS management interfaces and restrict access via firewall rules or VPN. Because exploitation has been observed in the wild, check NAS logs for unexpected commands, processes, or logins even after updating.

CVE-2021-22600 is a double-free flaw (CWE-415) in packet_set_ring() in the Linux kernel's net/packet/af_packet.c, the code that manages packet socket ring buffers. A local, low-privileged user can trigger it through crafted syscalls on AF_PACKET sockets, causing kernel memory corruption. A successful attacker gains local privilege escalation to kernel/root-level control, or can instead crash the system in a denial of service; the flaw scores 7.0 (High) with a local attack vector and high attack complexity. Any kernel built before the fix commit ec6af094ea28f0f2dda1a6a33b14cd57e36a9755 is affected, spanning the upstream Linux kernel, Debian Linux, Google's Android (patched in an actively exploited April 2022 Android security update), and NetApp storage products that embed the Linux kernel (8300, 8700, A400, C400, and H-series firmware). The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-04-11 and Google patched it as actively exploited, so it is being exploited in the wild, though no standalone public PoC is known and any ransomware use is unconfirmed.

Do: Upgrade the Linux kernel to a release past the affected versions, or rebuild from source including commit ec6af094ea28f0f2dda1a6a33b14cd57e36a9755; apply Debian security updates and NetApp firmware updates per each vendor's advisory. Because the flaw is in CISA's KEV catalog and Google confirmed active exploitation, prioritize patching for hosts that grant interactive/local access to untrusted users. If patching must be delayed, restrict local logins and monitor for suspicious AF_PACKET ring-buffer syscall activity and unexplained crashes or reboots.

CVE-2021-27852 is a deserialization of untrusted data flaw (CWE-502) in CheckboxWeb.dll of Checkbox Survey, allowing an unauthenticated remote attacker to execute arbitrary code. An attacker triggers it by sending maliciously crafted serialized data to the vulnerable application over the network, without needing credentials. Successful exploitation yields arbitrary code execution on the server hosting the survey application. Only Checkbox Survey versions 6 and earlier are affected; versions 7 and later are not considered vulnerable, but version 6 and earlier is end-of-life. The flaw is listed in the CISA Known Exploited Vulnerabilities catalog (added 2022-04-11), indicating known exploitation, and EPSS estimates a 31.9% probability of exploitation within 30 days (98th percentile), though no public proof-of-concept is known.

Do: Per CISA's required action, remove Checkbox Survey versions 6 and earlier from agency networks, as they are end-of-life, or upgrade to version 7 or later, which is not considered vulnerable. Check for internet-facing servers exposing CheckboxWeb.dll/Checkbox Survey endpoints and treat any version 6 or earlier installation as potentially compromised. Monitor CISA guidance, since ransomware association is currently unknown and CVSS scoring is pending.

CVE-2021-39793 is an out-of-bounds write (CWE-787) in the kbase_jd_user_buf_pin_pages function of mali_kbase_mem.c — the Mali GPU kernel driver used in Google Pixel devices — caused by a logic error in the code. A local application or process can trigger the flaw via the GPU driver's user-buffer pinning routine without needing any additional execution privileges or user interaction. Successful exploitation lets the attacker write out of bounds in kernel memory and achieve local escalation of privilege, with high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.8). All Google Pixel devices running affected Android kernel builds are affected; the CISA record lists Google/Android as the vendor/product and designates Google Pixel as the affected product. The bug is being exploited in the wild: CISA added it to the Known Exploited Vulnerabilities Catalog on 2022-04-11, no public proof-of-concept is known, and EPSS estimates a 0.7% probability of exploitation within 30 days.

Do: Apply Google's Android security updates on every Pixel device, per CISA's required action to apply updates per vendor instructions; patches were available as of the April 2022 KEV addition, so ensure devices are on an April 2022 or later security patch level (verify in Settings > About phone > Android security update). There is no known workaround, and because exploitation requires local code execution, review apps installed on unpatched devices and prioritize fleet-wide patching for enterprise-managed Pixel fleets.

CVE-2021-42287 is an elevation-of-privilege vulnerability in Microsoft Active Directory Domain Services (AD DS) affecting multiple supported Windows Server releases. An attacker with any low-privileged domain account can trigger it — commonly in combination with the related sAMAccountName spoofing flaw CVE-2021-42278 — by manipulating account name attributes so the Kerberos Key Distribution Center issues tickets that grant rights normally reserved for domain controllers. The result is escalation from a standard user to domain administrator, giving the attacker full control over the Windows domain, a capability that is directly useful for ransomware deployment and data theft. Any organization running Active Directory on the affected Windows Server versions is exposed, which amounts to essentially every enterprise Windows network. The flaw is actively exploited: it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-04-11 with known ransomware use, and EPSS assigns it a 77.2% probability of exploitation within 30 days.

Do: Apply Microsoft's security updates to every domain controller — writable and read-only — as soon as possible (the fix shipped in Microsoft's November 2021 security releases), prioritizing internet-exposed and VPN-facing DCs. Hunt domain controller logs for anomalous Kerberos TGT requests by user accounts with domain-controller-style names (a hallmark of CVE-2021-42278/42287 abuse) and monitor for ransomware staging activity, given documented ransomware use.

WatchGuard Firebox and XTM appliances running affected versions of Fireware OS contain a privilege escalation flaw that allows a remote attacker who already holds unprivileged credentials to obtain a privileged management session via exposed management access. The flaw is triggered when management access is exposed (for example, to the internet) and an attacker authenticates with low-privileged credentials, at which point they can elevate to privileged management of the appliance. Because the CVSS v3.1 score of 8.8 carries high confidentiality, integrity, and availability impact, full compromise of the appliance is the realistic outcome. Organizations running Fireware OS before 12.7.2_U1, 12.x before 12.1.3_U3, or 12.2.x through 12.5.x before 12.5.7_U3 are affected. The vulnerability is being exploited in the wild: CISA added it to the Known Exploited Vulnerabilities Catalog on 2022-04-11, and the Russia-linked Cyclops Blink botnet used it as an initial access vector to infect thousands of devices before the FBI disrupted the botnet.

Do: Upgrade affected Fireware OS branches to 12.7.2_U1, 12.1.3_U3, or 12.5.7_U3 (or later) per WatchGuard's instructions, as required by CISA's KEV catalog. Until patched, restrict appliance management access to trusted networks or management VPNs rather than exposing it to the internet. Because this flaw was used to deploy the Cyclops Blink botnet, administrators should also check Firebox/XTM devices for signs of that compromise using vendor detection guidance.