U.S. CISA adds Google Chromium, DrayTek routers, and SAP NetWeaver flaws to its Known Exploited Vulnerabilities catalog

CVE-2024-12987 is an OS command injection flaw in the web management interface of DrayTek Vigor2960 and Vigor300B routers running firmware 1.5.1.4. An unauthenticated remote attacker triggers it by sending a crafted request to the /cgi-bin/mainfunction.cgi/apmcfgupload endpoint with a manipulated 'session' parameter, which is passed to the underlying operating system without proper sanitization (CWE-77/CWE-78). Successful exploitation yields arbitrary operating-system command execution on the router, which can mean full device compromise and a foothold for pivoting into the protected network. Any organization running affected firmware on these models is exposed, especially sites where the management interface is reachable from the internet. Exploitation is confirmed in the wild: a public proof-of-concept is available, EPSS assigns a 98.1% probability of exploitation within 30 days (100th percentile), and CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2025-05-15, requiring federal remediation under BOD 22-01.

Do: Upgrade Vigor2960 and Vigor300B units from firmware 1.5.1.4 to version 1.5.1.5 or later. Until patched, restrict internet-facing access to the web management interface and review device logs for suspicious requests to /cgi-bin/mainfunction.cgi/apmcfgupload containing anomalous session parameters. Because the flaw is in CISA's KEV catalog, federal agencies must apply the vendor fix or applicable BOD 22-01 mitigations by the required deadline.

CVE-2025-42999 is an insecure deserialization flaw (CWE-502) in the Visual Composer Metadata Uploader component of SAP NetWeaver. It is triggered when a privileged user uploads untrusted or malicious content to the Metadata Uploader, which the application then deserializes; on its own the flaw requires high-privilege access, but attackers commonly chain it with the separately tracked unauthenticated upload flaw CVE-2025-31324 in the same component. Successful exploitation can yield remote code execution and full compromise of the host's confidentiality, integrity, and availability, with impact beyond the vulnerable component (CVSS scope changed, 9.1 critical). Any organization running SAP NetWeaver with the Visual Composer Metadata Uploader enabled, especially internet-facing application servers, is affected. Exploitation is confirmed in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2025-05-15 with known ransomware use, and reporting links active attacks to ransomware groups (BianLian and RansomExx deploying the PipeMagic trojan) and to Chinese-linked APTs exploiting the sibling CVE-2025-31324.

Do: Apply SAP's security patches addressing CVE-2025-42999 together with the companion CVE-2025-31324 in the same Visual Composer Metadata Uploader, per vendor instructions, or restrict/disable access to the Metadata Uploader endpoint if patching is delayed. Given confirmed ransomware use (BianLian, RansomExx) and PipeMagic trojan deployments, review upload and authentication logs on NetWeaver servers and hunt for signs of compromise and post-exploitation activity. U.S. federal agencies must follow CISA BOD 22-01 guidance: apply mitigations by the KEV remediation due date or discontinue use of affected instances.

Insufficient policy enforcement in Loader in Google Chrome prior to 136.0.7103.113 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)