⚡ Weekly Recap: BadCam Attack, WinRAR 0-Day, EDR Killer, NVIDIA Flaws, Ransomware Attacks & More
- CVEs
- CVE-2025-54948CVE-2025-54987CVE-2025-8088CVE-2025-6218CVE-2025-49760CVE-2025-55188CVE-2025-4371CVE-2025-25050CVE-2025-25215CVE-2025-24922CVE-2025-24311CVE-2025-24919CVE-2025-49827CVE-2025-49831CVE-2025-6000CVE-2025-53786CVE-2025-30023CVE-2025-23310CVE-2025-23311CVE-2025-23319CVE-2025-54574CVE-2025-7025CVE-2025-7032CVE-2025-7033CVE-2025-54253CVE-2025-54254CVE-2025-24285CVE-2025-38236CVE-2025-2771CVE-2025-2773CVE-2025-25214CVE-2025-48732CVE-2025-26469
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2025-23311+2 related CVEs | NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a stack overflow through specially crafted HTTP requests | 9.8 | 3% | ||
| CVE-2025-24285 | Multiple Improper Input Validation vulnerabilities in UniFi Connect EV Station Lite may allow a Command Injection by a malicious actor with network access to… | 9.8 | 1% | ||
| CVE-2025-24311 | An out-of-bounds read vulnerability exists in the cv_send_blockdata functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault3 Plus prior… | 8.4 | 2% | ||
| CVE-2025-24919 | A deserialization of untrusted input vulnerability exists in the cvhDecapsulateCmd functionality of Dell ControlVault3 prior to 5.15.10.14 and ControlVault3… | 8.1 | 2% | ||
| CVE-2025-24922 | A stack-based buffer overflow vulnerability exists in the securebio_identify functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault3… | 8.8 | 3% | ||
| CVE-2025-25050 | An out-of-bounds write vulnerability exists in the cv_upgrade_sensor_firmware functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault 3… | 8.8 | 2% | ||
CVE-2025-48732+1 related CVE | An incomplete blacklist exists in the .htaccess sample of WWBN AVideo 14.4 and dev master commit 8a8954ff | 9.8 group max | 1% | PoC | |
| CVE-2025-25215 | An arbitrary free vulnerability exists in the cv_close functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault3 Plus prior to 6.2.26.36 | 8.8 | 2% | ||
| CVE-2025-26469 | An incorrect default permissions vulnerability exists in the CServerSettings::SetRegistryValues functionality of MedDream PACS Premium 7.3.3.840 | 9.8 | <1% | PoC | |
CVE-2025-2773+1 related CVE | BEC Technologies Multiple Routers sys ping Command Injection Remote Code Execution Vulnerability | 7.2 group max | 2% | ||
| CVE-2025-30023 | The communication protocol used between client and server had a flaw that could lead to an authenticated user performing a remote code execution attack | 9.0 | <1% | ||
| CVE-2025-38236 | Linux kernel: af_unix: Don't leave consecutive consumed OOB skbs. Jann Horn reported a use-after-free in… | 7.8 | <1% | ||
| CVE-2025-4371 | A potential vulnerability was reported in the Lenovo 510 FHD and Performance FHD web cameras that could allow an attacker with physical access to write… | 7.0 | <1% | ||
| CVE-2025-49760 | External control of file name or path in Windows Storage allows an authorized attacker to perform spoofing over a network | 3.5 | 1% | ||
CVE-2025-49827+1 related CVE | Conjur provides secrets management and application identity for infrastructure | 9.1 | 1% | ||
| CVE-2025-53786 | On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and accompanying non-security Hot Fix | 8.0 | 7% | ||
| CVE-2025-54253 | Pre-Auth RCE in Adobe Experience Manager Forms via Struts DevMode Misconfiguration | 10.0 | 89% | KEVPoC | KEV |
| CVE-2025-54254 | XXE Arbitrary File-Read in Adobe Experience Manager Forms 6.5 | 8.6 | 77% | ||
| CVE-2025-54574 | Heap Buffer Overflow in Squid Proxy URN Handling Enables Potential RCE | 9.8 | 22% | ||
| CVE-2025-54948 | Pre-auth OS command injection in Trend Micro Apex One on-prem Management Console | 9.8 | 25% | KEV | KEV |
| CVE-2025-54987 | A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute… | 9.8 | 17% | ||
| CVE-2025-55188 | 7-Zip before 25.01 does not always properly handle symbolic links during extraction | 3.6 | <1% | PoC ×3 | |
| CVE-2025-6000 | A privileged Vault operator within the root namespace with write permission to {{sys/audit}} may obtain code execution on the underlying host if a plugin… | 9.1 | <1% | ||
| CVE-2025-6218 | Directory Traversal RCE in RARLAB WinRAR | 7.8 | 90% | KEVPoC ×2 | KEV |
CVE-2025-7032+2 related CVEs | A memory abuse issue exists in the Rockwell Automation Arena® Simulation | 8.4 | <1% | ||
| CVE-2025-8088 | WinRAR Path Traversal (CVE-2025-8088) Enables Arbitrary Code Execution | 8.4 | 94% | KEVRansomware | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | bi.zone | fting malicious archive files. Russian cybersecurity vendor BI.ZONE, in a report published last week, said there are indication |
From the original article
13 min read at thehackernews.com
This week, cyber attackers are moving quickly, and businesses need to stay alert. They’re finding new weaknesses in popular software and coming up with clever ways to get around security. Even one unpatched flaw could let attackers in, leading to data theft or even taking control of your systems.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.