ConnectWise Hit by Cyberattack; Nation

CVE-2021-32030 is an improper authentication vulnerability (CWE-287) in ASUS Lyra Mini and ASUS GT-AC2900 routers that allows an attacker to gain unauthorized access to the administrative interface. It was added to the CISA Known Exploited Vulnerabilities catalog on 2025-06-02 and has an EPSS of 99.4% (100th percentile), indicating a very high probability of exploitation within 30 days. Because the affected devices may be end-of-life or end-of-service, CISA advises discontinuing their use if mitigations are unavailable.

Do: Apply mitigations per ASUS vendor instructions and follow applicable BOD 22-01 guidance for cloud services; if mitigations are unavailable, discontinue use of the affected devices per CISA's required action. In the interim, restrict exposure of the routers' administrative interfaces to trusted networks only.

ASUS RT-AX55 routers contain an OS command injection vulnerability (CWE-78) that allows a remote, authenticated attacker to execute arbitrary operating-system commands on the device. The flaw is triggered when an authenticated session submits crafted input that the router passes to its underlying OS without proper sanitization, though the available data does not identify the specific vulnerable parameter or affected firmware versions. Successful exploitation yields arbitrary command execution at the router's privilege level, which an attacker could use to change device configuration, establish persistence, or pivot into the networks behind the router. Any deployed ASUS RT-AX55 router is affected per CISA's listing, with the greatest risk on units whose management interface is reachable remotely. CISA added the issue to the Known Exploited Vulnerabilities catalog on 2025-06-02 (noting it as represented by CVE-2023-41346), confirming exploitation in the wild; EPSS currently estimates a 33.9% probability of exploitation within 30 days (98th percentile), no public PoC is known, and ransomware use is unknown.

Do: Update RT-AX55 firmware to the latest release from ASUS, checking the vendor's security advisory for CVE-2023-39780 and the related CVE-2023-41346, as the available data does not specify a fixed version. Until patched, restrict administrative access (disable WAN-side/remote management if not needed), enforce strong administrator credentials, and review device settings for signs of tampering. Federal agencies should apply vendor mitigations per BOD 22-01 timelines or discontinue use of affected RT-AX55 routers if mitigations are unavailable.

ConnectWise ScreenConnect (ConnectWise Control), a widely used remote-access and remote-monitoring tool, contains an authentication bypass (CWE-288) in its management interface. An attacker needs only network access to the management interface to trigger the flaw, with no valid credentials or user interaction required. A successful attacker gains administrative control of the ScreenConnect server by creating a new administrator-level account, providing a foothold that has already been used in ransomware campaigns against downstream managed environments. Any organization running ConnectWise ScreenConnect is affected, especially managed service providers and IT teams whose management interface is reachable from the internet; the source data specifies affected products but no version ranges. Exploitation is confirmed and urgent: CISA added the flaw to the KEV on 2024-02-22 with known ransomware use, EPSS assigns a 100% probability of exploitation within 30 days, and ConnectWise warned that no patch was available at the time of disclosure.

Do: Follow ConnectWise's instructions immediately: no patch existed at disclosure, so apply the vendor's mitigations or, per the CISA KEV required action, restrict internet exposure of the management interface or discontinue use until mitigations are available, then upgrade to the vendor's patched release as soon as it ships. Audit ScreenConnect servers for unexpectedly created administrator-level accounts and unusual remote sessions, which are the attack's artifacts. Prioritize any instance whose management interface is reachable from the internet, given confirmed in-the-wild exploitation and known ransomware use.

CVE-2024-56145 is an improper code-injection flaw (CWE-94) in Craft CMS that allows remote code execution over the network without authentication. The flaw is triggered on installations where the PHP configuration option `register_argc_argv` is enabled, a common setting, exposing an RCE vector to unauthenticated attackers. Successful exploitation gives attackers high-impact control over the host, with high confidentiality, integrity, and availability impact per the CVSS 4.0 score of 9.3. Users of Craft CMS 3.x, 4.x, and 5.x prior to the fixed releases are affected; the flaw has been added to CISA's Known Exploited Vulnerabilities catalog (as of 2025-06-02), carries a 97.4% EPSS probability of exploitation within 30 days, and has a public proof-of-concept available.

Do: Upgrade Craft CMS to version 3.9.14, 4.13.2, or 5.5.2 as applicable to your major version. If upgrading is not immediately possible, set register_argc_argv=Off in php.ini and restart the PHP service to mitigate. Because the issue is in CISA's KEV catalog with active exploitation, check internet-facing Craft CMS instances for signs of compromise and apply required BOD 22-01 timelines if applicable.

Craft CMS writes unauthenticated, user-controlled input — specifically the unsanitized return URL from a login-redirect request — into PHP session files stored at a predictable server location (/var/lib/php/sessions/sess_<session_value>), where the session value is disclosed to the client in the Set-Cookie header. Because the input is not sanitized, an unauthenticated network attacker can inject arbitrary content, including PHP code, into a known local file path on the server. That content can subsequently be accessed and potentially executed, likely by chaining this flaw with an independent vulnerability such as a local file inclusion, providing a path toward code execution. Any Craft CMS deployment running affected versions is exposed, and CISA added the issue to its Known Exploited Vulnerabilities catalog on 2025-06-02, indicating exploitation in the wild; EPSS currently estimates a ~1.3% probability of exploitation in the next 30 days.

Do: Upgrade immediately to Craft CMS 5.7.5 (5.x branch) or 4.15.3 (4.x branch) or newer, per vendor guidance and the KEV/BOD 22-01 required actions for federal agencies. Inspect /var/lib/php/sessions for unexpected content or injected PHP in sess_* files and review web logs for unauthenticated requests supplying unsanitized return URLs; since execution likely depends on chaining with another flaw, also verify the instance is not exposed to related file-inclusion or local-file-access weaknesses.

ConnectWise ScreenConnect versions 25.2.3 and earlier rely on ASP.NET Web Forms ViewState, whose integrity depends on machine keys; if an attacker with privileged system-level access obtains those keys, they can craft and send a malicious ViewState that the server deserializes, potentially resulting in remote code execution. The risk stems from platform-level ASP.NET behavior rather than a defect introduced by ScreenConnect, and the ScreenConnect Client is not directly impacted, though the CVSS vector (PR:H) confirms exploitation requires already having high privileges on the host. An attacker who achieves this gains code execution on the server with the confidentiality, integrity, and availability impact reflected in the 7.2 High score. ScreenConnect 2025.4 mitigates the issue by disabling ViewState entirely and removing any dependency on it. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-06-02, indicating confirmed exploitation in the wild, with EPSS estimating a 3.4% chance of exploitation in the next 30 days (88th percentile).

Do: Upgrade to ScreenConnect 2025.4, which disables ViewState and removes any dependency on it, per vendor instructions and CISA BOD 22-01 requirements; if an upgrade is not immediately possible, apply vendor mitigations or discontinue use of the affected product. Because exploitation requires compromised machine keys, administrators who suspect prior privileged compromise should also review and rotate ASP.NET machine keys and investigate for signs of system-level access. Note ConnectWise is separately rotating ScreenConnect code signing certificates following a nation-state intrusion, so check vendor advisories for related hardening steps.