THN Recap: Top Cybersecurity Threats, Tools and Tips (Nov 25

CVE-2023-28461 is a critical (CVSS 9.8) missing-authentication flaw in Array Networks' AG series and virtual vxAG SSL VPN gateways running ArrayOS 9.4.0.481 and earlier. An unauthenticated remote attacker sends an HTTP request to a vulnerable URL containing a 'flags' attribute in an HTTP header, which allows browsing the filesystem on the SSL VPN gateway; vendor and CERT reporting indicate this can be leveraged into full remote code execution, and JPCERT has confirmed active command-injection attacks. Successful exploitation gives the attacker code execution on the appliance, compromising the VPN gateway and potentially providing a foothold into the protected internal network. Any organization running an affected AG/vxAG gateway is exposed; these are enterprise SSL VPN appliances, with notable deployments in Japan and the wider Asia-Pacific region. Exploitation is confirmed in the wild: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2024-11-25 (ransomware use known), JPCERT/CC reports widespread exploitation, Chinese-linked activity including MirrorFace targeting Japanese firms has been reported, and EPSS places the 30-day exploitation probability at 68.1%.

Do: Upgrade AG/vxAG gateways to a fixed ArrayOS release per Array Networks' instructions — as of the 2023-03-09 advisory a fixed release was pending, so apply any release newer than 9.4.0.481 once available; if mitigations are unavailable, discontinue use per the CISA KEV required action, and federal agencies should follow CISA's directive to patch. Review gateway logs and downstream systems for signs of exploitation, and treat any compromised appliance as a potential network foothold given confirmed ransomware use.

The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an authorization bypass via reverse DNS spoofing on the checkWithoutToken function in all versions up to, and including, 6.43.2. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated.

The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an missing empty value check on the 'api_key' value in the 'perform' function in all versions up to, and including, 6.44. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated.

The Contest Gallery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 24.0.7. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.

ProjectSend versions prior to r1720 fail to enforce authentication on requests to options.php (CWE-306, missing authentication for a critical function), a critical flaw rated CVSS 9.8. A remote, unauthenticated attacker can send crafted HTTP requests directly to options.php to modify the application's configuration without any user interaction. With configuration control, the attacker can enable registration and create accounts, upload webshells to achieve code execution on the server, and embed malicious JavaScript in the site. Any organization running ProjectSend earlier than r1720 — especially internet-facing deployments used for client file exchange — is affected. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-12-03, carries a 91.7% EPSS probability of exploitation within 30 days, and public reporting and a Metasploit module are available.

Do: Upgrade ProjectSend to r1720 or later, which restores proper authentication on options.php; per CISA's KEV required action, apply vendor mitigations or discontinue use of the product if mitigation is not possible. Prioritize internet-facing instances and hunt for signs of compromise, including unexpected or new user accounts, modified configuration, unexpected PHP files or webshells on the server, and injected JavaScript. Until patched, restrict network access to the installation and limit or protect access to options.php.

CVE-2024-42327 is a SQL injection (CWE-89) in the Zabbix frontend's CUser class, in the addRelatedObjects function, which is reached via the CUser.get API method. Any authenticated non-admin account holding the default User role, or any other role that grants API access, can trigger the flaw simply by calling user.get, with no user interaction required. The CVSS 3.1 score of 9.9 (network vector, low privileges, changed scope, high confidentiality/integrity/availability impact) indicates an attacker could read or alter database contents, potentially compromising the monitoring platform and its data beyond their own account's privileges. All Zabbix deployments whose frontends expose the API to non-admin users are affected, which is the default configuration. Exploitation has not been confirmed: the flaw is not in CISA's KEV catalog and no public PoC is known, but EPSS assigns a very high 78.7% probability of exploitation within 30 days.

Do: Upgrade each affected Zabbix instance to the patched release for your branch as specified in Zabbix's security advisory for CVE-2024-42327. As interim mitigation, audit which non-admin users and roles have API access and restrict or disable user.get access for untrusted accounts. Monitor frontend/API logs for anomalous user.get calls and unexpected SQL activity, since exploitation requires only low-privilege API credentials.

An improper access-control flaw (CWE-269) in Microsoft's Partner Center portal at Partner.Microsoft.com allows an unauthenticated, remote attacker to elevate privileges over the network, earning a critical CVSS 3.1 score of 9.8. The flaw is triggered by network requests to the internet-facing portal that bypass access-control checks, requiring no credentials or user interaction. A successful attacker gains elevated privileges within Partner Center, the portal partners use to manage Microsoft cloud customer tenants and reseller relationships, potentially exposing partner and customer management functions. Any organization using Microsoft Partner Center — typically CSP partners, direct bill partners, and indirect resellers — is affected. The flaw is actively exploited: Microsoft addressed it in its November 2024 security fixes with exploitation seen in active attacks, and CISA added it to the KEV catalog on 2025-02-25.

Do: Partner Center is a Microsoft-managed cloud service, so no customer-side upgrade version applies — confirm with Microsoft that the service-side fix is in place, and federal agencies must follow BOD 22-01/KEV required actions (apply vendor mitigations or discontinue use). Review Entra ID sign-in logs and Partner Center audit logs for unauthenticated access, unexpected role or privilege changes, and anomalous app registrations or consent grants, and rotate credentials for affected partner accounts if compromise is suspected.

CVE-2024-49039 is an elevation-of-privilege vulnerability (CWE-287, improper authentication) in the Microsoft Windows Task Scheduler, scored 8.8 (High) with a local attack vector, low required privileges, and a changed scope indicating the exploit crosses a security boundary. A local attacker with limited user privileges can trigger the flaw through Task Scheduler to gain elevated rights on the affected system, typically SYSTEM- or administrator-level control, with no user interaction required. Every supported Windows desktop and server release in the vendor's affected list is impacted, since Task Scheduler is a core component of the operating system. The flaw was patched as an actively exploited zero-day in the November 2024 Patch Tuesday release, was added to CISA's Known Exploited Vulnerabilities catalog on 2024-11-12, and ransomware operators are known to use it. With an EPSS of 14.2% (96th percentile), defenders should treat this as a high-priority local privilege escalation for privilege-chaining and ransomware campaigns.

Do: Apply the November 2024 Windows security updates across all affected Windows 10, Windows 11, and Windows Server branches, prioritizing servers, jump hosts, and machines used by privileged users given confirmed ransomware use. Confirm no supported Windows host is left unpatched, review local task creation and authentication logs for signs of privilege escalation, and follow CISA's required action to apply vendor mitigations or discontinue use if patches are unavailable.

IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.

FutureNet NXR series routers provided by Century Systems Co., Ltd. have REST-APIs, which are configured as disabled in the initial (factory default) configuration. But, REST-APIs are unexpectedly enabled when the affected product is powered up, provided either http-server (GUI) or Web authentication is enabled. The factory default configuration makes http-server (GUI) enabled, which means REST-APIs are also enabled. The username and the password for REST-APIs are configured in the factory default configuration. As a result, an attacker may obtain and/or alter the affected product's settings via REST-APIs.

Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 through 16.1.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example, user-supplied input files). This vulnerability only affects the arrow R package, not other Apache Arrow implementations or bindings unless those bindings are specifically used via the R package (for example, an R application that embeds a Python interpreter and uses PyArrow to read files from untrusted sources is still vulnerable if the arrow R package is an affected version). It is recommended that users of the arrow R package upgrade to 17.0.0 or later. Similarly, it is recommended that downstream libraries upgrade their dependency requirements to arrow 17.0.0 or later. If using an affected version of the package, untrusted data can read into a Table and its internal to_data_frame() method can be used as a workaround (e.g., read_parquet(..., as_data_frame = FALSE)$to_data_frame()). This issue affects the Apache Arrow R package: from 4.0.0 through 16.1.0. Users are recommended to upgrade to version 17.0.0, which fixes the issue.

Unrestricted Upload of File with Dangerous Type vulnerability in pathomation Pathomation pathomation allows Upload a Web Shell to a Web Server.This issue affects Pathomation: from n/a through <= 2.5.1.

CVE-2024-53676 is a directory traversal flaw (CWE-22, CWE-552) in HPE Insight Remote Support, HPE's remote monitoring and support service deployed alongside ProLiant server estates, which may allow attackers to escape the intended path restrictions and achieve remote code execution. It is triggered by sending crafted, network-based requests containing traversal sequences to the service, with no authentication required (AV:N/AC:L/PR:N/UI:N). A successful attacker gains code execution on the server hosting Insight Remote Support, with the CVSS score indicating high impact on confidentiality, integrity, and availability. Any organization running HPE Insight Remote Support to monitor HPE ProLiant servers is potentially affected. There is no public proof-of-concept, it is not in CISA KEV, and no confirmed in-the-wild exploitation is known, but the 56.3% EPSS score (99th percentile) indicates a high likelihood of exploitation attempts within the next 30 days.

Do: Upgrade Insight Remote Support to the patched release identified in HPE's official security advisory, since no version numbers are provided in the current data. Until patched, restrict network access to the Insight Remote Support service to trusted management networks and confirm it is not exposed to the internet. Because EPSS is high, watch for HPE advisories and monitor the host for unexpected process launches or outbound connections.

CVE-2024-8672 is a code-injection flaw (CWE-94) in the Widget Options WordPress plugin, where the display-logic feature that extends several page builders passes user-supplied input directly into PHP eval() with no filtering or capability checks. An attacker holding contributor-level credentials or higher on a site running Widget Options can submit crafted input through this feature to execute arbitrary code on the web server. Successful exploitation yields full remote code execution with high impact on confidentiality, integrity, and availability, and the changed-scope CVSS metric indicates the compromise can extend beyond the vulnerable component. All sites running Widget Options version 4.0.7 or earlier are affected. There is no public proof-of-concept or confirmed in-the-wild exploitation yet, but EPSS places the probability of exploitation within 30 days at 43.6% (99th percentile), and the vendor's patch is considered released although researchers note it could still be further hardened.

Do: Update Widget Options to a patched release beyond 4.0.7 immediately and treat this as a priority given the high EPSS. Because the researchers note the current patch may leave residual risk, audit which contributor-and-above accounts exist on affected sites, review or restrict use of the plugin's display-logic widgets, and monitor server logs for unexpected code execution or admin activity.

Mozilla Firefox and Firefox ESR contain a use-after-free (CWE-416) in the browser's animation timelines component, which CISA describes as allowing code execution in the content process. The flaw is reachable through malicious web content: a crafted page can manipulate animation timelines so that an in-use object is freed, producing exploitable memory corruption. A successful attacker gains code execution in the content process, the sandboxed process that renders web pages, on the machine of the user who loaded the content. All users of Firefox and Firefox ESR are affected by the flaw itself. It is being actively exploited: the vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2024-10-15 with known ransomware use, and EPSS assigns it a 23.2% probability of exploitation in the next 30 days (98th percentile).

Do: Apply Mozilla's patched Firefox/Firefox ESR release immediately and verify the running version via the browser's About Firefox dialog, since many installs only pick up auto-updates after a restart (per CISA's required action: apply mitigations per vendor instructions or discontinue use). Given the known ransomware use, prioritize enterprise ESR rollout and check for managed-update failures, auto-update-disabled installs, or unmanaged Firefox copies on user machines. Note that no public proof-of-concept is known, but KEV listing confirms exploitation, so patching should not wait for PoC availability.