CISA Urges Federal Agencies to Patch Versa Director Vulnerability by September

CVE-2021-31196 is a Microsoft Exchange Server vulnerability that CISA's catalog names as an information disclosure flaw (the associated description string calls it remote code execution), rated CVSS 3.1 7.2 (AV:N/AC:L/PR:H/UI:N), meaning it is exploitable over the network without user interaction but only by an attacker already holding high-privilege, admin-level credentials on the server. It is triggered by sending crafted requests to a vulnerable Exchange server using those elevated credentials, and the attacker gains access to protected information - or, per the remote code execution description, potentially code execution on the server. The CISA data lists Microsoft Exchange Server with no specific version ranges, so unpatched on-premises Exchange deployments should be presumed in scope, with internet-facing servers the most plausible targets. Exploitation is confirmed: CISA added the bug to the Known Exploited Vulnerabilities catalog on 2024-08-21 (ransomware use unknown), and EPSS assigns a 54% probability of exploitation within 30 days (99th percentile), although no public proof-of-concept is known.

Do: Install the Microsoft Exchange security update for CVE-2021-31196 (shipped in the May 2021 Patch Tuesday Exchange security updates) or a later update on every Exchange server, prioritizing internet-facing ones, and verify installed builds rather than assuming the earlier 2021 Exchange patches covered this flaw. Given confirmed exploitation and reports of attackers actively scanning for unpatched Exchange servers, audit privileged-account usage and review logs for anomalous admin activity; federal agencies must remediate within the standard two-week BOD 22 window following the KEV listing. If immediate patching is not possible, restrict OWA/ECP exposure to trusted networks and enforce MFA and strong credentials for Exchange admin accounts, per CISA's required action.

Dahua IP cameras and related products contain an authentication bypass flaw (CWE-287, Improper Authentication) that is triggered when the client supplies the NetKeyboard type argument during the authentication process, allowing the device to treat the session as authenticated without valid credentials. An unauthenticated remote attacker who can reach the camera's network interface can exploit this to gain unauthorized access to the device's management functions. Successful exploitation can expose camera video streams and device configuration and can serve as a foothold into the surrounding surveillance or corporate network. Any organization running affected Dahua IP camera firmware, particularly cameras exposed to the internet, is potentially affected. The flaw is confirmed to be exploited in the wild: it was added to the CISA KEV on 2024-08-21, and EPSS assigns it a 99.9% probability of exploitation within 30 days (100th percentile), although no public PoC is known.

Do: Apply the mitigations or patched firmware specified in Dahua's security advisory for CVE-2021-33044; if mitigations are unavailable, discontinue use of the product as CISA's required action directs. Inventory internet-facing Dahua cameras and related devices, restrict their login interfaces from direct internet exposure, and review authentication logs for signs of prior exploitation. Ransomware use is listed as unknown, so treat any compromised camera as a potential network foothold and rotate any credentials used on the device.

CVE-2022-0185 is a heap-based buffer overflow in the legacy_parse_param function of the Linux kernel's Filesystem Context (fs_context) functionality, rooted in an integer-handling flaw (CWE-190). A local attacker triggers it by opening or configuring a filesystem that does not support the Filesystem Context API, which overflows the heap buffer used to hold mount parameters. Successful exploitation lets the attacker escalate privileges on the host, and in environments with user namespaces enabled (common on desktops, shared servers, and containers) it can lead to full root compromise and container escape. Any Linux kernel build containing the vulnerable code is affected, which spans the very large installed base of Linux servers, cloud instances, containers, and devices. The vulnerability is confirmed exploited in the wild (added to CISA KEV on 2024-08-21), carries an EPSS 30-day exploitation probability of 25.2% (98th percentile), has no known public PoC, and its use in ransomware campaigns is unknown.

Do: Apply patched kernel packages from your distribution or vendor as soon as available and reboot to load the fixed kernel, per the KEV required action; do not continue running an unpatched vulnerable kernel. Where feasible, interim-mitigate by restricting or disabling unprivileged user namespaces (a common exploitation path), and prioritize hosts that are internet-facing, multi-tenant, or running containers. Verify remediation by confirming your running kernel is one of your vendor's patched builds, since no specific fixed version numbers are provided in this dataset.

CVE-2024-39717 is an unrestricted file upload flaw (CWE-434) in the interface customization function of Versa Networks' Versa Director: the 'Change Favicon' option in the GUI accepts an uploaded file that merely ends in a .png extension, so a malicious file can masquerade as an image. Exploitation requires network access to the Director GUI and valid credentials for a Provider-Data-Center-Admin or Provider-Data-Center-System-Admin account (tenant-level users cannot reach the feature), which is why the 7.2 CVSS score includes 'high privileges required.' By planting a dangerous file disguised as a .png, an attacker gains a code-execution path on the Director server consistent with the flaw's high confidentiality, integrity and availability impact ratings. Any organization running Versa Director — particularly service providers and internet providers whose management interface is reachable from the internet — is potentially affected. Exploitation is confirmed in the wild: China-linked actor Volt Typhoon used the flaw as a zero-day against U.S. and global IT targets, CISA added it to the Known Exploited Vulnerabilities catalog on 2024-08-23, and federal agencies were urged to patch by September 2024.

Do: Apply Versa Networks' fix/mitigation instructions — CISA's required action is to apply vendor mitigations or discontinue use of the product if mitigations are unavailable — and meet the September 2024 federal remediation deadline if applicable. Restrict access to the Versa Director GUI to trusted management networks rather than exposing it to the internet, and audit and rotate credentials for Provider-Data-Center-Admin and Provider-Data-Center-System-Admin accounts, since the observed Volt Typhoon activity relied on valid high-privilege logins. Check Director systems for unexpected files uploaded through the Change Favicon feature that may be disguised as .png images.