XE Hacker Group Exploits VeraCore Zero
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-9248 | Cryptographic key leak (CWE-522) in Progress Telerik UI for ASP.NET AJAX & Sitefinity | 9.8 | 75% | KEVPoC | KEV |
| CVE-2019-18935 | Unauthenticated .NET Deserialization RCE in Progress Telerik UI for ASP.NET AJAX | 9.8 | 100% | KEVRansomwarePoC ×4 | KEV |
| CVE-2020-15069 | Unauthenticated Buffer Overflow RCE in Sophos XG Firewall | 9.8 | 11% | KEV | KEV |
| CVE-2020-29574 | Unauthenticated SQL Injection in Sophos CyberoamOS WebAdmin | 9.8 | 5% | KEVRansomware | KEV |
| CVE-2022-23748 | DLL Sideloading Vulnerability in Audinate Dante Discovery (mDNSResponder.exe) | 7.8 | 8% | KEV | KEV |
| CVE-2024-21413 | Improper Input Validation RCE in Microsoft Outlook (MonikerLink) | 9.8 | 95% | KEVPoC | KEV |
CVE-2024-57968+1 related CVE | Unrestricted File Upload in Advantive VeraCore upload.aspx | 8.8 group max | 32% | KEVPoC ×2 | KEV |
| CVE-2025-0411 | Mark-of-the-Web Bypass in 7-Zip Enables Code Execution via Crafted Archives | 7.0 | 67% | KEV | KEV |
From the original article
3 min read at thehackernews.com
Threat actors have been observed exploiting multiple security flaws in various software products, including Progress Telerik UI for ASP. NET AJAX and Advantive VeraCore, to drop reverse shells and web shells, and maintain persistent remote access to compromised systems.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.