CISA Urges Software Makers to Eliminate OS Command Injection Flaws
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-20399 | Authenticated Command Injection in Cisco NX-OS Grants Root Privileges | 6.7 | 4% | KEV | KEV |
| CVE-2024-21887 | Command Injection RCE in Ivanti Connect Secure and Policy Secure | 9.1 | 100% | KEVRansomwarePoC | KEV |
| CVE-2024-3400 | Unauthenticated Root Command Injection in Palo Alto Networks PAN-OS GlobalProtect | 10.0 | 100% | KEVRansomwarePoC ×2 | KEV |
From the original article
3 min read at infosecurity-magazine.com
The US government has urged software manufacturers to work towards the elimination of operating system (OS) command injection vulnerabilities. The alert from the Cybersecurity and Infrastructure Security Agency (CISA) and FBI was issued in response to several high-profile threat actor campaigns in 2024 that exploited OS command injection defects in network edge devices to compromise users.
By James Coker · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.