Apt41 actors charged for attacks on more than 100 victims globally

Ivanti Pulse Connect Secure, an enterprise SSL VPN appliance, contains an arbitrary file read vulnerability (CWE-22, path traversal) that requires no authentication. An unauthenticated remote attacker with network access to the appliance over HTTPS can send a specially crafted URI containing traversal sequences to read arbitrary files from the device. The attacker gains access to sensitive appliance files, potentially including configuration or credential material useful for further compromise, and CISA records known ransomware use of this flaw. Any organization running Pulse Connect Secure, especially gateways exposed to the internet for remote access, is affected. Exploitation is established: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use, EPSS assigns a 100% probability of exploitation in the next 30 days, and no public PoC is known.

Do: Apply updates per Ivanti's instructions, the required action in the CISA KEV entry, prioritizing internet-facing Pulse Connect Secure gateways, and consult the vendor advisory for the applicable fixed release since no version range is provided here. Where patching is not immediate, restrict HTTPS access to the appliance and hunt for signs of exploitation (unexpected file reads, anomalous VPN logins or sessions, and follow-on ransomware activity), as CISA reports known ransomware use.

Nostromo nhttpd, a lightweight open-source HTTP server for Unix systems, is vulnerable to a directory traversal flaw (CWE-22) in its http_verify function, affecting every release through version 1.9.6. An unauthenticated remote attacker triggers it with a crafted HTTP request whose URL contains traversal sequences that http_verify fails to normalize, letting the request escape the server's webroot and reach system paths. Via that escaped path, combined with the server's request handling, the attacker achieves remote code execution with the privileges of the nhttpd process, giving a full confidentiality/integrity/availability impact (CVSS 3.1: 9.8, network vector, no privileges or user interaction required). Anyone running nostromo nhttpd 1.9.6 or earlier is affected, with internet-exposed instances at greatest risk; deployments are typically individual Unix hosts rather than large managed fleets. Exploitation is active: public proof-of-concept exploits have existed since 2019, EPSS assigns a 99% probability of exploitation in the next 30 days (100th percentile), and CISA added the bug to its Known Exploited Vulnerabilities catalog on 2024-11-07 (ransomware use: unknown).

Do: Upgrade nostromo nhttpd to a fixed release newer than 1.9.6 (the fix shipped in 1.9.7) or install your distribution's patched package; if patching is not possible, CISA's required action is to apply vendor mitigations or discontinue use of the product. Inventory internet-facing hosts for the 'Server: Nostromo' banner, treat any unpatched exposed instance as at-risk given active exploitation, and review access logs for crafted traversal requests; ransomware association is currently unknown.

CVE-2019-1652 is an improper input validation flaw (CWE-20, leading to command injection per CWE-78) in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN routers. An authenticated, remote attacker who already holds administrative privileges on the device exploits it by sending crafted HTTP POST requests to the management interface, and a successful exploit allows arbitrary command execution as root on the underlying Linux shell. Because administrative credentials are required, the bug is typically a second stage of an attack on an internet-facing edge router rather than a standalone entry point. All RV320 and RV325 routers running firmware predating the firmware updates Cisco released are affected, and these models have since reached end-of-life. Exploitation is confirmed in the wild: the vulnerability was added to CISA's KEV catalog on 2022-03-03, carries a 95.9% EPSS probability (100th percentile), has had public PoCs since 2019, and news coverage reports attackers — including China-linked groups — targeting the roughly 9,000 RV320/RV325 units exposed online.

Do: Apply the firmware updates Cisco released for the RV320/RV325 per the vendor advisory, as required by the CISA KEV listing, and since these routers are end-of-life, plan hardware replacement where the updated firmware cannot be installed. In the interim, restrict access to the web-based management interface to trusted networks only and check exposed devices for signs of compromise, given active targeting by China-linked threat actors.

CVE-2019-1653 is an improper access control flaw (CWE-284) in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN routers. It is triggered by sending requests to vulnerable URLs on the management interface without authentication, bypassing the intended access controls. An attacker gains the ability to download the full router configuration — which can expose credentials and VPN/VPN-tunnel settings — as well as detailed diagnostic information about the device. Any Cisco RV320 or RV325 router whose management interface is reachable, particularly over the internet, is affected. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) and carries a 99.9% EPSS score, though no public proof-of-concept is known and no ransomware association has been confirmed.

Do: Apply the updated router firmware from Cisco as instructed in the vendor advisory, per the CISA KEV required action. If updating is not immediately possible, restrict or disable WAN-side access to the web management interface and limit it to trusted management hosts. Because the downloaded configuration can contain credentials, change administrative and VPN passwords after patching, and review logs for signs of unauthenticated configuration downloads.

Multiple D-Link routers contain a command injection flaw (CWE-78) in which attacker-controlled input is executed as operating system commands by the device. An attacker who triggers the flaw can run arbitrary commands on the router with system privileges, achieving full compromise of the device, from which they can intercept or redirect traffic, pivot to the local network, or persist on the device. The specific affected models and firmware version ranges are not enumerated in the available data, but CISA notes the impacted product line is end-of-life, so only devices still in service are at risk. This vulnerability is confirmed exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2022-03-25, and EPSS assigns it a 100% probability of exploitation within 30 days (100th percentile). No public proof-of-concept is known, but the KEV listing means defenders should treat exploitation as active, not theoretical.

Do: Inventory your environment for D-Link routers and identify any running the affected end-of-life models; per CISA's required action, disconnect or retire them if still in use since they no longer receive fixes. If a device must remain in service, restrict management access (disable WAN-side web administration, limit it to trusted management networks) and monitor for compromise indicators. Confirm whether any internet-facing D-Link routers are exposed and prioritize replacement of EOL units.

CVE-2019-19781 is a path-traversal flaw (classified CWE-22, though CISA's description calls it unspecified) in Citrix ADC (formerly NetScaler ADC), Citrix Gateway, and Citrix SD-WAN WANOP appliances that lets an unauthenticated remote attacker traverse directories via crafted requests and execute arbitrary commands on the appliance, typically with root privileges. It is triggered by sending specially crafted directory-traversal requests (crafted URLs/requests to the appliance's management or VPN endpoints), which lets the attacker write files and run commands with no credentials. Successful exploitation yields arbitrary code execution on the appliance, enabling theft of VPN/ADC credentials, lateral movement into the corporate network, and installation of persistent backdoors. Any organization running affected ADC, Gateway, or SD-WAN WANOP firmware is affected, with internet-facing gateways used for remote access at the highest risk. Exploitation is confirmed in the wild: the vulnerability is on CISA's KEV (added 2021-11-03) with known ransomware use, EPSS assigns near-certain (100.0%) probability of exploitation within 30 days, and no public PoC is listed despite confirmed abuse.

Do: Upgrade Citrix ADC, Gateway, and SD-WAN WANOP appliances to the fixed firmware builds listed in Citrix advisory CTX267020; if patching cannot be done immediately, apply Citrix's published interim mitigation and restrict internet exposure to the appliance. Because exploitation grants root code execution and persistence, after patching hunt for indicators of compromise (unexpected nsroot account, modified system files, crontab/scheduled entries), kill all active and inactive sessions, and rotate appliance and VPN credentials. Prioritize internet-facing gateways and comply with CISA's required action to apply vendor updates.

Zoho ManageEngine Desktop Central contains a file upload vulnerability (CWE-502, deserialization of untrusted data) that can be exploited without authentication. A remote attacker sends crafted upload requests to the affected application, which accepts and processes the uploaded content without any credentials, resulting in execution of attacker-controlled code. Successful exploitation yields remote code execution on the server hosting Desktop Central, giving the attacker a foothold on an endpoint-management system that typically has broad reach into a corporate network. Any organization running the affected Zoho ManageEngine product is exposed, and exploitability does not depend on user interaction or credentials. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), indicating known exploitation in the wild, and EPSS assigns a 99.9% probability of exploitation within 30 days; specific exploited versions are not stated in the available data.

Do: Apply updates per Zoho/ManageEngine vendor instructions immediately, as the CISA KEV required action specifies. Restrict internet exposure of the Desktop Central server and audit it for signs of compromise (unexpected processes, webshells, outbound connections) since unauthenticated RCE has been exploited in the wild. Check that any exposed instances are patched before treating network access as safe.