Cybercriminals scale up, government sector hit hardest

The Realtek SDK, a software development kit embedded in routers, gateways, and similar network equipment sold under many OEM brands, contains an improper input validation flaw (CWE-20) in its miniigd UPnP SOAP service. A remote, unauthenticated attacker can trigger it by sending a crafted NewInternalClient request to the vulnerable SOAP interface, causing execution of malicious code on the device. Successful exploitation gives attackers control of affected devices, which can be used for botnet recruitment, staging further attacks, or ransomware operations. Affected parties are owners of devices built on the Realtek SDK, particularly routers and gateways with the UPnP service exposed to the internet. Exploitation is ongoing: CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2023-09-18 and EPSS assigns it a 100% probability of exploitation within 30 days, though ransomware use is not confirmed.

Do: Inventory devices that use the Realtek SDK and check whether the miniigd UPnP/SOAP service is reachable from untrusted networks; apply firmware updates from your device vendor as soon as available, or per CISA's required action, disable UPnP or block the service from internet exposure if mitigations are unavailable. No patch level is published in this dataset, so verify fix status against OEM advisories and review device logs for crafted NewInternalClient SOAP requests.

Huawei HG532 with some customized versions has a remote code execution vulnerability. An authenticated attacker could send malicious packets to port 37215 to launch attacks. Successful exploit could lead to the remote execution of arbitrary code.

PHPUnit ships a utility script (eval-stdin.php under /vendor/phpunit/phpunit/src/Util/PHP/) that reads HTTP POST data and evaluates it as PHP code with no authentication. The flaw is triggered when a site's /vendor folder is web-accessible and an attacker sends a POST request whose body begins with '<?php ' directly to that URI. Doing so lets the attacker execute arbitrary PHP code on the server under the web server account, giving unauthenticated remote code execution (CWE-94 code injection). Anyone running a PHP application installed with Composer, where PHPUnit is present in the vendor tree and that directory is reachable over HTTP, is affected. The flaw is under active exploitation: CISA added it to the Known Exploited Vulnerabilities catalog on 2022-02-15 and its EPSS probability of exploitation is 100% (top percentile).

Do: Apply the CISA KEV required action by updating PHPUnit per vendor instructions, which in practice means updating the CMS/framework or running a Composer update that pulls a patched PHPUnit release. Until patched, block web access to the /vendor directory (e.g., deny /vendor/ or at least /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php in your web server configuration) and verify the endpoint is no longer reachable. Check access logs for POST requests to eval-stdin.php and investigate affected servers for webshells or other signs of compromise.

CVE-2023-1389 is a command injection flaw (CWE-77) in TP-Link's Archer AX21 Wi-Fi 6 router that lets an attacker execute arbitrary operating-system commands on the device. It is triggered by sending crafted input to a remotely reachable service on the router, which passes attacker-controlled values to the device's shell without proper sanitization; the source data does not specify the vulnerable endpoint or exact affected firmware ranges. Successful exploitation yields remote code execution on the router, giving the attacker a foothold in the network where the router sits, from which they can pivot or abuse the device further. Any household or organization running an Archer AX21 router is affected, with the highest risk where the router's management interface is exposed to the internet. The flaw was added to CISA's KEV catalog on 2023-05-01, confirming exploitation in the wild; EPSS assigns a ~100% probability of exploitation within 30 days (top percentile), while no public proof-of-concept or ransomware association is documented in the source data.

Do: Update the Archer AX21 to the latest firmware available from TP-Link per the vendor's instructions (fixed firmware is published on the product's TP-Link support page). If updating is not immediately possible, disable WAN-side/remote management and restrict the router's web interface to the local network. Because exploitation is confirmed in the wild, also review exposed routers for signs of compromise, such as unexplained configuration changes or unexpected outbound traffic.

LB-LINK BL-AC1900_2.0 v1.0.1, LB-LINK BL-WR9000 v2.4.9, LB-LINK BL-X26 v1.2.5, and LB-LINK BL-LTE300 v1.0.8 were discovered to contain a command injection vulnerability via the mac, time1, and time2 parameters at /goform/set_LimitClient_cfg.