Cisco Warns of Critical Flaw Affecting On

VMware vCenter Server ships certain files with incorrectly permissive default file permissions, creating an information disclosure vulnerability (CWE-276). A malicious actor with non-administrative (low-privileged) network access to the vCenter Server can exploit the misconfigured permissions to read sensitive information; per the CVSS vector there is confidentiality impact only, with no integrity or availability effect. Any organization running VMware vCenter Server, or VMware Cloud Foundation whose vCenter Server component is affected, is exposed to the flaw. CISA added the bug to its Known Exploited Vulnerabilities catalog on 2024-07-17, indicating exploitation in the wild, and EPSS currently assigns a 13.3% probability of exploitation within 30 days (96th percentile); no public proof-of-concept is known.

Do: Upgrade vCenter Server and the vCenter Server component of Cloud Foundation to the fixed releases cited in VMware's advisory for CVE-2022-22948, per the CISA KEV required action (or discontinue use if patching is unavailable). Given the KEV listing and headlines describing stealthy VMware-focused activity by UNC3886, prioritize internet-exposed and high-value vCenter deployments, review which non-administrative accounts can reach the vCenter appliance, and monitor those accounts and vCenter logs for signs of unauthorized file access.

A vulnerability in the content scanning and message filtering features of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to overwrite arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when file analysis and content filters are enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to replace any file on the underlying file system. The attacker could then perform any of the following actions: add users with root privileges, modify the device configuration, execute arbitrary code, or cause a permanent denial of service (DoS) condition on the affected device. Note: Manual intervention is required to recover from the DoS condition. Customers are advised to contact the Cisco Technical Assistance Center (TAC) to help recover a device in this condition.

A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to change the password of any user, including administrative users. This vulnerability is due to improper implementation of the password-change process. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow an attacker to access the web UI or API with the privileges of the compromised user.

CVE-2024-28995 is a directory traversal flaw (CWE-22) in SolarWinds Serv-U, the vendor's managed file transfer/FTP server. Per the CVSS vector, it is reachable over the network with low attack complexity and requires no privileges or user interaction, meaning an unauthenticated remote attacker can trigger it. By sending traversal sequences that escape the intended directory, the attacker gains the ability to read sensitive files on the host machine (high confidentiality impact, with no integrity or availability impact). Any organization running SolarWinds Serv-U is potentially affected, particularly instances exposed to the internet. The flaw is under active exploitation: CISA added it to the Known Exploited Vulnerabilities catalog on 2024-07-17, threat actors were reported exploiting it in the wild, and EPSS puts the 30-day exploitation probability at 99.6%, although no public proof-of-concept is known.

Do: Apply SolarWinds' patch or hotfix for Serv-U per the vendor's July 2024 PSIRT advisory, prioritizing internet-facing instances; if mitigations cannot be applied, CISA's required action is to follow vendor instructions or discontinue use of the product. In the meantime, restrict Serv-U exposure to trusted networks and review FTP/web server access logs for traversal-style requests that could indicate file reads or exfiltration.

CVE-2024-34102 is an improper restriction of XML external entity reference (XXE) vulnerability (CWE-611) in Adobe Commerce and Magento Open Source, where the platform does not properly restrict external entities when processing XML, so an attacker who can submit crafted XML containing external entity references can have it parsed with attacker-controlled resources. XXE flaws classically enable local file disclosure and server-side request forgery, and in this case Adobe states the flaw allows remote code execution on the affected server. Any organization running a vulnerable Adobe Commerce or Magento Open Source storefront is affected, and because these are internet-facing e-commerce platforms that routinely process XML input, exposure is likely to be broad. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2024-07-17, confirming exploitation in the wild, and its EPSS score of ~100% (100th percentile) indicates near-certain near-term exploitation activity; no public proof-of-concept is known and CVSS has not yet been scored. CISA lists ransomware use as unknown, so a ransomware connection should not be assumed.

Do: Apply Adobe's security updates for Adobe Commerce and Magento Open Source per the vendor's June 2024 advisory (APSB24-40), or, per the CISA KEV required action, apply vendor-recommended mitigations or discontinue use of the product if patches are unavailable. Review any endpoints or integrations that accept XML from untrusted users and hunt for signs of XXE exploitation, such as unexpected outbound requests, anomalous file reads, or webshell artifacts. Continue monitoring Adobe and CISA KEV for updated mitigation guidance and remediation deadlines.