September 2025 CVE Landscape
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-21311 | Server-Side Request Forgery in Adminer Database Management Tool (CVE-2021-21311) | 7.2 | 98% | KEVPoC | KEV |
| CVE-2025-10035 | Deserialization Flaw in Fortra GoAnywhere MFT License Servlet Enables RCE | 9.8 | 100% | KEVRansomwarePoC | KEV |
CVE-2025-20333+1 related CVE | Authenticated Buffer Overflow RCE in Cisco ASA/FTD VPN Web Server | 9.9 group max | 71% | KEV | KEV |
| CVE-2025-20352 | SNMP Stack Buffer Overflow in Cisco IOS and IOS XE Enables DoS and Root RCE | 7.7 | 42% | KEV | KEV |
| CVE-2025-5086 | Deserialization of Untrusted Data RCE in Dassault Systèmes DELMIA Apriso | 9.0 | 97% | KEVPoC | KEV |
| CVE-2025-53690 | Unauthenticated ViewState Deserialization RCE in Sitecore XM/XP | 9.0 | 61% | KEVPoC | KEV |
| CVE-2025-59689 | Command Injection in Libraesva Email Security Gateway Exploited in the Wild | 6.1 | 2% | KEV | KEV |
| CVE-2025-9377 | OS Command Injection in TP-Link Archer C7 (EU) and TL-WR841N/ND (MS) Routers | 8.6 | 41% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 130.33.156.194 | 54b51a16f8b10a2be175 ( main.exe file downloaded from hxxp://130[.]33[.]156[.]194/main.exe ) MD5: 62483e732553c8ba051b792949f3c6d0 ( Go |
| md5 | 62483e732553c8ba051b792949f3c6d0 | downloaded from hxxp://130[.]33[.]156[.]194/main.exe ) MD5: 62483e732553c8ba051b792949f3c6d0 ( GoToken.exe ) 130[.]33[.]156[.]194[:]443 (C2 server 130[. |
| md5 | be7e2c6a9a4654b51a16f8b10a2be175 | 29b93786b224e489c960bf5c ( Helper.ico and helper.exe ) MD5: be7e2c6a9a4654b51a16f8b10a2be175 ( main.exe file downloaded from hxxp://130[.]33[.]156[.]194 |
| md5 | f410d88429b93786b224e489c960bf5c | 8d08312902f6f3cd1f7ac3 (executable for 7-Zip archiver) MD5: f410d88429b93786b224e489c960bf5c ( Helper.ico and helper.exe ) MD5: be7e2c6a9a4654b51a16f8b1 |
| sha256 | 223b873c50380fe9a39f1a22b6abf8d46db506e1c08d08312902f6f3cd1f7ac3 | 7c5e88c3e3b93c4ca86942e24d203aa878863 (SharpHound) SHA-256: 223b873c50380fe9a39f1a22b6abf8d46db506e1c08d08312902f6f3cd1f7ac3 (executable for 7-Zip archiver) MD5: f410d88429b93786b224e4 |
| sha256 | 61f897ed69646e0509f6802fb2d7c5e88c3e3b93c4ca86942e24d203aa878863 | a52b (EARTHWORM; lfe.ico , ufp.exe , and ufp.ico ) SHA-256: 61f897ed69646e0509f6802fb2d7c5e88c3e3b93c4ca86942e24d203aa878863 (SharpHound) SHA-256: 223b873c50380fe9a39f1a22b6abf8d46db50 |
| sha256 | a566cceaf9a66332470a978a234a8a8e2bbdd4d6aa43c2c75c25a80b3b744307 | from the RDP connection) 1.vbs (EARTHWORM loader) SHA-256: a566cceaf9a66332470a978a234a8a8e2bbdd4d6aa43c2c75c25a80b3b744307 (WEEPSTEEL; Information.dll ) SHA-256: b3f83721f24f7ee5eb19 |
| sha256 | b3f83721f24f7ee5eb19f24747b7668ff96da7dfd9be947e6e24a688ecc0a52b | c2c75c25a80b3b744307 (WEEPSTEEL; Information.dll ) SHA-256: b3f83721f24f7ee5eb19f24747b7668ff96da7dfd9be947e6e24a688ecc0a52b (EARTHWORM; lfe.ico , ufp.exe , and ufp.ico ) SHA-256: 61f8 |
| url | http://130.33.156.194/main.exe | c6a9a4654b51a16f8b10a2be175 ( main.exe file downloaded from hxxp://130[.]33[.]156[.]194/main.exe ) MD5: 62483e732553c8ba051b792949f3c6d0 ( GoToken.exe |
From the original article
12 min read at recordedfuture.com
In September 2025, Recorded Future’s Insikt Group® identified sixteen high-impact vulnerabilities that should be prioritized for remediation. This represents a decrease from the eighteen identified in August, with the number of Very Critical vulnerabilities also decreasing (11) month over month.
By Insikt Group® · recordedfuture.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.