CISA adds Fortra MFT, TerraMaster NAS, Intel driver Flaws, to its Known Exploited Vulnerabilities Catalog

CVE-2015-2291 is an input-validation flaw (CWE-20) in the Windows kernel-mode driver files IQVW32.sys and IQVW64.sys that ship with Intel's Ethernet diagnostics software for Windows. It is triggered when the driver mishandles malformed or unexpected input (such as a crafted request from code running on the host), causing the affected Windows system to crash. An attacker gains denial of service — a system-wide crash or blue-screen — on any Windows machine where the vulnerable diagnostics drivers are installed, a technique CISA notes has been used in ransomware operations. Any Windows workstation or server running the Intel Ethernet Diagnostics Driver is affected. Exploitation is in the wild: CISA added the flaw to the KEV catalog on 2023-02-10 with known ransomware use; EPSS estimates a 9.0% probability of exploitation in the next 30 days (95th percentile), and no public PoC is known.

Do: Inventory Windows hosts for the driver files IQVW32.sys and IQVW64.sys (including driver service entries) to determine exposure, then apply updated Intel Ethernet diagnostics/network drivers per Intel's instructions, as required by CISA's KEV listing. Given known ransomware use, prioritize high-value servers and endpoints where untrusted code or users run. Restricting local code execution to trusted users reduces exposure until updates are applied.

TerraMaster TOS (TerraMaster OS) versions 4.2.29 and earlier do not require authentication (CWE-306) on the mobile API endpoint module/api.php?mobile/webNasIPS, and a request presenting the User-Agent "TNAS" returns system information that includes the administrative account's password in the PWD field. An unauthenticated attacker with network access to the NAS web interface can send this request and read the response, obtaining full administrative credentials. With those credentials an attacker controls the NAS, and public proof-of-concept exploits chain this flaw with a PHP object-instantiation bug to achieve unauthenticated remote command execution. Any TerraMaster NAS running TOS 4.2.29 or earlier is affected, with internet-exposed devices at the greatest risk. Exploitation is confirmed: the flaw is in CISA's Known Exploited Vulnerabilities Catalog (added 2023-02-10) with known ransomware use, carries an EPSS of roughly 84%, and CISA and press reports describe active attacks, including North Korean ransomware activity against healthcare and critical infrastructure.

Do: Upgrade TerraMaster TOS to a release newer than 4.2.29 per the vendor's instructions, as required by the CISA KEV entry. If patching must wait, restrict the TOS web interface to trusted networks so unauthenticated users cannot reach module/api.php?mobile/webNasIPS. Check device logs for requests to the webNasIPS endpoint with a TNAS User-Agent and look for signs of post-compromise activity, since ransomware use of this flaw is known.

Fortra (formerly HelpSystems) GoAnywhere MFT is vulnerable to pre-authentication remote code execution (CWE-502) in the License Response Servlet, which deserializes an attacker-controlled object without validating it. An unauthenticated attacker who can reach the exposed administrative interface can send a crafted serialized object to the servlet and trigger code execution on the server. Successful exploitation gives the attacker the ability to run arbitrary code in the context of the application, which has been leveraged for ransomware operations. All organizations running GoAnywhere MFT with the affected component reachable by untrusted networks are in scope. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2023-02-10, ransomware use is confirmed, and EPSS puts the 30-day exploitation probability at 100%.

Do: Apply the vendor's updates for GoAnywhere MFT immediately, per Fortra's instructions, as required by the CISA KEV catalog. Until patched, restrict or block untrusted/internet access to the administrative interface hosting the License Response Servlet, and review logs for signs of exploitation given confirmed in-the-wild and ransomware use.