Trend Micro Releases Urgent Fix for Actively Exploited Critical Security Vulnerability

The Realtek SDK, a software development kit embedded in routers, gateways, and similar network equipment sold under many OEM brands, contains an improper input validation flaw (CWE-20) in its miniigd UPnP SOAP service. A remote, unauthenticated attacker can trigger it by sending a crafted NewInternalClient request to the vulnerable SOAP interface, causing execution of malicious code on the device. Successful exploitation gives attackers control of affected devices, which can be used for botnet recruitment, staging further attacks, or ransomware operations. Affected parties are owners of devices built on the Realtek SDK, particularly routers and gateways with the UPnP service exposed to the internet. Exploitation is ongoing: CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2023-09-18 and EPSS assigns it a 100% probability of exploitation within 30 days, though ransomware use is not confirmed.

Do: Inventory devices that use the Realtek SDK and check whether the miniigd UPnP/SOAP service is reachable from untrusted networks; apply firmware updates from your device vendor as soon as available, or per CISA's required action, disable UPnP or block the service from internet exposure if mitigations are unavailable. No patch level is published in this dataset, so verify fix status against OEM advisories and review device logs for crafted NewInternalClient SOAP requests.

CVE-2017-6884 is an OS command injection flaw (CWE-78) in the diagnostic tools of Zyxel EMG2926 routers, located in the nslookup function. An attacker can trigger it through multiple vectors, notably by supplying a malicious ping_ip parameter to the expert/maintenance/diagnostic/nslookup URI, causing attacker-controlled commands to execute on the router. Successful exploitation yields arbitrary command execution on the gateway, providing a foothold that can be used for further network compromise, including by ransomware operators. Any operator of a Zyxel EMG2926 router is affected, and many of these gateways were deployed through internet service providers. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2023-09-18 with known ransomware use, and EPSS estimates a 36.8% probability of exploitation within 30 days (98th percentile).

Do: Per CISA's required action, apply mitigations per Zyxel's instructions or discontinue use of the product if mitigations are unavailable. Check whether the router's management interface, including the expert/maintenance/diagnostic/nslookup endpoint, is reachable from the WAN or untrusted networks and restrict access to it; monitor devices for signs of command execution or ransomware-related activity. Fixed firmware versions were not specified in the available data, so consult Zyxel's advisory for the appropriate upgrade path.

Laravel Ignition, the default error-page package bundled with Laravel applications, uses file_get_contents() and file_put_contents() insecurely in its solution-execution feature, allowing unauthenticated remote attackers to read and write arbitrary files on the server. The flaw is triggered by sending a crafted, unauthenticated HTTP request to Ignition's execute-solution endpoint, which is reachable whenever the application runs with debug mode enabled. Attackers can chain the arbitrary file write to execute arbitrary code in the context of the web application, leading to server compromise and, per CISA, ransomware deployment. Any internet-facing Laravel application running a vulnerable version of the Ignition package with debug mode enabled is affected. The vulnerability is known to be exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2023-09-18 with ransomware use confirmed, and EPSS assigns it a 99.9% probability of exploitation within 30 days (100th percentile).

Do: Upgrade facade/ignition to 2.5.2 or later on all Laravel applications, or update to a current Laravel release that bundles the fixed package. Ensure production environments run with debug mode disabled and block or restrict the /_ignition/execute-solution endpoint from untrusted access as an interim mitigation. Given confirmed ransomware use, hunt for signs of compromise such as modified environment files, unexpected scheduled tasks, or webshells, and apply the CISA-required mitigations or discontinue use of the product if patching is not possible.

CVE-2022-22265 is a use-after-free flaw — an improper check or handling of exceptional conditions (CWE-703) — in the neural processing unit (NPU) driver on Samsung mobile devices. A local attacker with limited privileges, such as a malicious app already on the handset, can trigger the flaw without user interaction, causing an arbitrary memory write and arbitrary code execution, effectively a full local privilege escalation. All Samsung mobile devices running a Samsung Mobile Security Release older than the January 2022 (SMR Jan-2022 Release 1) patch level are affected. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2023-09-18, confirming exploitation in the wild, although CISA lists ransomware use as unknown and EPSS assigns a modest 0.4% probability of exploitation in the next 30 days.

Do: Apply the January 2022 Samsung Mobile Security Release (SMR Jan-2022 Release 1) or any later monthly Samsung security update to all Samsung mobile devices, and verify patch levels via Settings > Software update, prioritizing KEV-listed, unpatched fleets. Because the flaw requires local access, avoid installing untrusted apps on devices pending the update. CISA's required action is to apply vendor mitigations or discontinue use if updates are unavailable.

Owl Labs Meeting Owl 5.2.0.15 allows attackers to control the device via a backdoor password (derived from the serial number) that can be found in Bluetooth broadcast data.

CVE-2023-28434 is a security feature bypass (CWE-269) in MinIO, an open-source multi-cloud object storage server, where metadata bucket name checking is not properly enforced while processing PostPolicyBucket requests. An attacker holding credentials granted the wildcard bucket permission arn:aws:s3:::* can send crafted requests to bypass the bucket name checks and put an object into any bucket, provided Console API access is enabled. The result is that bucket-level policy isolation can be violated, and in observed attacks the flaw (publicly dubbed Evil_MinIO) has been used against MinIO storage servers. All MinIO releases before RELEASE.2023-03-20T20-16-18Z are affected, with risk concentrated in deployments that expose the Console API and use wildcard-scope credentials. The vulnerability is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2023-09-19, public exploit code exists, and news reports describe ongoing attacks on MinIO servers.

Do: Upgrade MinIO to RELEASE.2023-03-20T20-16-18Z or later, which contains the fix. If patching is delayed, apply the documented workaround involving the MINIO_BROWSER/browser API access setting as described in the advisory, and avoid granting credentials the wildcard arn:aws:s3:::* permission alongside Console API access. Since this is in CISA KEV (added 2023-09-19, required action: apply vendor mitigations or discontinue use) and the Evil_MinIO exploit has been used in real attacks, review exposed MinIO consoles for signs of compromise as part of remediation.

CVE-2023-41179 is a code-injection flaw (CWE-94) in the third-party AV uninstaller module shipped with Trend Micro Apex One (on-premises and SaaS), Worry-Free Business Security, and Worry-Free Business Security Services. An attacker who has first obtained administrative console access on the target system can manipulate this module to execute arbitrary commands. Successful exploitation yields remote code execution on the affected installation with high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.2). Any organization running these Trend Micro endpoint-security management products is affected, especially those whose consoles are reachable by multiple or untrusted administrators. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2023-09-21 and Trend Micro released urgent fixes, though no public proof-of-concept is known and ransomware use has not been confirmed.

Do: Apply Trend Micro's security patch/hotfix per vendor instructions immediately, or discontinue use of the product if mitigations are unavailable, as required by the CISA KEV listing. Because exploitation requires administrative console access, restrict console reachability to trusted networks or VPN, audit administrative accounts for anomalous activity, and monitor for signs of exploitation given the active in-the-wild abuse.