Ransomwarecritical
⚡ THN Weekly Recap: Router Hacks, PyPI Attacks, New Ransomware Decryptor, and More
- CVEs
- CVE-2025-21590CVE-2025-24983CVE-2025-24984CVE-2025-24985CVE-2025-24991CVE-2025-24993CVE-2025-26633CVE-2025-24201CVE-2025-25291CVE-2025-25292CVE-2025-27363CVE-2024-12297CVE-2025-27816CVE-2025-24813CVE-2025-27636CVE-2025-27017CVE-2024-56336CVE-2024-13871CVE-2024-13872CVE-2025-20115CVE-2025-27593CVE-2025-27407CVE-2024-54085CVE-2025-27509CVE-2024-57040CVE-2024-1182CVE-2024-7587CVE-2024-8299CVE-2024-9852CVE-2024-8300
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-1182 | Uncontrolled Search Path Element vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3… | 7.0 | <1% | ||
| CVE-2024-12297 | Moxa’s Ethernet switch is vulnerable to an authentication bypass because of flaws in its authorization mechanism | 9.2 | <1% | ||
CVE-2024-13871+1 related CVE | A command injection vulnerability exists in the /check_image_and_trigger_recovery API endpoint of Bitdefender Box 1 (firmware version 1.3.11.490) | 9.4 | <1% | ||
| CVE-2024-54085 | Remote Authentication Bypass by Spoofing in AMI MegaRAC SP-X BMC | 10.0 | 61% | KEV | KEV |
| CVE-2024-56336 | SINAMICS S200 (All versions with serial number beginning with SZVS8: The affected device contains an unlocked bootloader. This security oversight enables attackers to inject malicious code, or… | 9.5 | <1% | ||
| CVE-2024-57040 | TP-Link TL-WR845N devices with firmware TL-WR845N(UN)_V4_200909 and TL-WR845N(UN)_V4_190219 was discovered to contain a hardcoded password for the root account… | 9.8 | 1% | ||
| CVE-2024-7587 | Incorrect Default Permissions vulnerability in GenBroker32, which is included in the installers for Mitsubishi Electric GENESIS64 versions 10.97.3 and prior… | 7.8 | <1% | ||
CVE-2024-8299+1 related CVE | Uncontrolled Search Path Element vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3… | 7.8 | <1% | ||
| CVE-2024-8300 | Dead Code vulnerability in Mitsubishi Electric GENESIS64 Version 10.97.2, 10.97.2 CFR1, 10.97.2 CRF2 and 10.97.3, Mitsubishi Electric Iconics Digital Solutions… | 7.0 | <1% | ||
| CVE-2025-20115 | A vulnerability in confederation implementation for the Border Gateway Protocol (BGP) in Cisco IOS XR Software could allow an unauthenticated, remote attacker… | 8.6 | <1% | ||
| CVE-2025-21590 | Kernel Code Injection Flaw in Juniper Junos OS Exploited in the Wild | 6.7 | 2% | KEV | KEV |
| CVE-2025-24201 | WebKit Out-of-Bounds Write Sandbox Escape in Apple iOS, Safari, and macOS | 10.0 | 4% | KEV | KEV |
| CVE-2025-24813 | Path Equivalence Flaw in Apache Tomcat Partial PUT Enables RCE and Disclosure | 9.8 | 100% | KEVPoC ×6 | KEV |
| CVE-2025-24985 | Local Code Execution via Integer Overflow in Microsoft Windows Fast FAT Driver | 7.8 group max | 4% | KEVPoC | KEV |
CVE-2025-25292+1 related CVE | Authentication Bypass (Signature Wrapping) in ruby-saml via XML Parser Differential | 9.3 | 65% | PoC ×2 | |
| CVE-2025-27017 | Apache NiFi 1.13.0 through 2.2.0 includes the username and password used to authenticate with MongoDB in the NiFi provenance events that MongoDB components… | 6.9 | 1% | ||
| CVE-2025-27363 | Out-of-Bounds Write in FreeType Font Parsing Allows Arbitrary Code Execution | 8.1 | 28% | KEV | KEV |
| CVE-2025-27407 | graphql-ruby is a Ruby implementation of GraphQL | 9.0 | 3% | ||
| CVE-2025-27509 | fleetdm/fleet is an open source device management, built on osquery | 9.3 | <1% | ||
| CVE-2025-27593 | The product can be used to distribute malicious code using SDD Device Drivers due to missing download verification checks, leading to code execution on target… | 9.3 | <1% | ||
| CVE-2025-27636 | Header Filter Bypass in Apache Camel Allows Bean Method and Queue Manipulation | 5.6 | 97% | PoC ×3 | |
| CVE-2025-27816 | A vulnerability was discovered in the Arctera InfoScale 7.0 through 8.0.2 where a .NET remoting endpoint can be exploited due to the insecure deserialization… | 9.8 | <1% |
From the original article
13 min read at thehackernews.com
From sophisticated nation-state campaigns to stealthy malware lurking in unexpected places, this week’s cybersecurity landscape is a reminder that attackers are always evolving. Advanced threat groups are exploiting outdated hardware, abusing legitimate tools for financial fraud, and finding new ways to bypass security defenses.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.