CISA adds Spring4Shell vulnerability, Apple zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-45382 | Command Injection RCE in D-Link DIR-810L/820L/826L/830L/836L Routers A command injection flaw (CWE-78) in the Dynamic DNS (DDNS) handling of the ncc2 binary allows unauthenticated remote attackers to execute arbitrary commands on D-Link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L routers. Because the DDNS function passes attacker-controlled input to a system shell without sanitization, a crafted request to the router's web service triggers command execution with the device's privileges (CVSS 9.8, AV:N/AC:L/PR:N/UI:N). A successful attacker gains full control of the router, enabling botnet enrollment, traffic interception, or pivoting into the local network. All hardware revisions of these five consumer/SOHO routers are affected, and because every model has reached End of Life/End of Service Life, D-Link will not issue patches. The flaw carries a 97.8% EPSS score, was added to CISA's Known Exploited Vulnerabilities catalog on 2022-04-04, and has a public proof-of-concept, indicating active in-the-wild exploitation. Do: Replace or retire any in-use DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, or DIR-836L router, as no firmware patch will be released. If replacement must wait, disable the DDNS feature and WAN-facing remote management, and verify the admin interface is not reachable from the internet. CISA's required action is to disconnect these end-of-life devices if they are still in service. | 9.8 | 98% | KEV PoC |
| largetens of thousands of internet-exposed units; combined installed base of the five EOL models plausibly in the hundreds of thousands | |
| CVE-2022-22675 +1 in the same advisory: …22674 | Out-of-Bounds Write in Apple macOS/iOS Kernel Allows Arbitrary Code Execution CVE-2022-22675 is an out-of-bounds write vulnerability (CWE-787) in the Apple kernel, addressed through improved bounds checking. It is triggered locally — the CVSS vector shows a local attack vector with user interaction, meaning an application running on the device can trigger the memory corruption. Successful exploitation allows an application to execute arbitrary code with kernel privileges, giving the attacker full control over the affected device. Users of iPhone, iPad, Mac, Apple TV, and Apple Watch running versions prior to the fixed releases are affected. Apple reported that the issue may have been actively exploited in the wild, and CISA added it to the Known Exploited Vulnerabilities catalog on 2022-04-04. Do: Update to iOS/iPadOS 15.4.1, macOS Monterey 12.3.1 or macOS Big Sur 11.6.6, tvOS 15.5, and watchOS 8.6 as required by CISA. Because the flaw is exploited in the wild and requires only a malicious local application, prioritize patching user-facing iPhone, iPad, and Mac fleets first. There is no public PoC; verify installed OS versions on managed devices and confirm remediation after the updates are applied. | 7.8 group max | 12% | KEV |
| mass≈1 billion+ active Apple devices across iPhone, iPad, Mac, Apple TV, and Apple Watch | |
| CVE-2022-22965 | Unauthenticated RCE in VMware Spring Framework (Spring4Shell) - JDK 9+ Tomcat WARs CVE-2022-22965 ('Spring4Shell') is a critical (CVSS 9.8) remote code execution flaw in VMware's Spring Framework, caused by insecure data binding that lets unauthenticated attackers overwrite internal class and module properties through crafted request parameters (CWE-94, code injection). It affects Spring MVC and Spring WebFlux applications running on JDK 9 or later; the demonstrated exploit path requires a Tomcat WAR deployment, while applications packaged as Spring Boot executable jars are not exploitable that way, though the underlying issue may be reachable via other routes. A successful attack yields full remote code execution with the privileges of the application server, with no authentication or user interaction required. VMware Spring Framework 5.3.0-5.3.17 and 5.2.0-5.2.19 (plus older releases) are affected, and the flaw also impacts bundled products from Cisco, Oracle, Siemens and Veritas, including multiple Oracle Communications Cloud Native Core components. It is being actively exploited in the wild: added to CISA's KEV on 2022-04-04, EPSS puts 30-day exploitation probability at 99.6% (100th percentile), a public PoC is available, and mass scanning of vulnerable servers has been observed. Do: Upgrade Spring Framework to 5.3.18, 5.2.20 or later (or apply vendor-supplied fixes for bundled products, e.g., via Oracle's patch release and Cisco's advisory), prioritizing internet-facing Tomcat WAR deployments on JDK 9+; this is a CISA KEV entry, so treat patching as urgent. If patching must wait, mitigate by running on JDK 8, deploying as a Spring Boot executable jar rather than a WAR on Tomcat, and applying the vendor-documented workaround that disallows 'class.*', 'Class.*' and 'module.*' fields in data binding. Inventory exposed Tomcat/Spring services and hunt for signs of exploitation given confirmed in-the-wild use. | 9.8 | 100% | KEV PoC |
| massmass - on the order of 1M+ Spring-based Java deployments overall, with at least ~100,000 internet-exposed Tomcat servers on JDK 9+ plausibly meeting the… |
Full article606 words · extracted from therecord.media · click to collapse
The Cybersecurity and Infrastructure Security Agency (CISA) added four new vulnerabilities to its catalog of exploited bugs, including the much-discussed “Spring4Shell” remote code execution (RCE) vulnerability. In addition to the CVE-2022-22965 affecting the Spring Framework, CISA included CVE-2022-22675 and CVE-2022-22674, two vulnerabilities affecting macOS Monterey. The fourth is CVE-2021-45382 – a remote code execution vulnerability affecting D-Link routers. All four have a remediation date of April 25 and come just days after CISA added seven other bugs to the list, which is compiled based on evidence of active exploitation. The Spring Framework affected by CVE-2022-22965 provides tools and utilities for Java-based enterprise applications, effectively serving as important “plumbing” used in Java web applications to help reduce the amount of effort required to produce a working application. On March 31, the company confirmed the zero-day vulnerability and released a patch addressing the issue. Security company Sonatype noted this week that even though a patch has been released, more than 80% of recent downloads are of potentially vulnerable versions. Cybersecurity company Kasada also found that cybercriminals are using automated vulnerability scanner tools to test thousands of URLs and identify which systems haven’t been patched yet. The Apple vulnerabilities were highlighted by the tech giant last week. Apple released fixes for both of the zero days but noted that they “may have been actively exploited.” In its notice, CISA said the D-Link routers impacted by the remote code execution vulnerability cannot be updated because they are end-of-life devices. They urged users to disconnect them if they are still used. Valtix security researcher Davis McCarthy said that when the routers hit end of life in December 2021, they “became a prime target for exploit development due to the fact they are Internet-facing, always on, and won't receive updates.” “Compromised routers are frequently used by threat actors to obfuscate their location while launching attacks,” he said. Viakoo CEO Bud Broomhead told The Record that the Spring4Shell and D-Link vulnerabilities stood out most to him as issues that required significant attention and effort. “Open source vulnerabilities by their nature (like Spring4Shell) are hard for organizations to remediate, especially with manual methods, because of the widespread use of Spring in Java development. Likely this vulnerability will remain exploitable for some time as it requires many organizations to take action to remediate it,” Broomhead said. “End of life products, like last week’s Dasan routers or this week’s D-Link routers, are also difficult to quickly remediate because these products are widespread, and like many IoT devices often get ‘lost’ within an organization.” Vulcan Cyber’s Mike Parkin noted that it was interesting the Apple vulnerabilities were added to the list so quickly but said it was likely included due to the “heightened cybersecurity threats posed by the conflict in Ukraine.” Exploit brokers are willing to pay into the millions for an RCE zero-day and usually do so by the product or operating system, according to McCarthy, who added that the issues impacting Apple products would be “lucrative.” “If CISA is reporting wide-spread exploitation, it's possible this zero-day was sold to many users, or sold in a pre-packaged exploit kit made available in an underground marketplace,” McCarthy said. “When paired with CVE-2022-22674, which allows reading from memory in macOS, an adversary could obtain a lot of sensitive information from their target.”
No previous article
No new articles
Jonathan Greig
is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.
Text extracted automatically; images, tables and formatting may be missing. Original: https://therecord.media/cisa-adds-spring4shell-vulnerability-apple-zero-days-to-exploited-catalog