Network Security Trends: Recent Exploits Observed in the Wild Include Remote Code Execution, Cross
- CVEs
- CVE-2022-22954CVE-2022-22963CVE-2022-22965CVE-2022-25060CVE-2022-22947CVE-2022-24112CVE-2022-22536CVE-2021-24762CVE-2022-21662CVE-2021-43711CVE-2022-25075CVE-2022-25134CVE-2021-4045CVE-2022-24260CVE-2021-21881CVE-2021-39226CVE-2021-28169CVE-2021-20167CVE-2021-20166CVE-2022-21371CVE-2021-31589CVE-2022-29464CVE-2022-27226
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2021-20166+1 related CVE | Netgear RAX43 version 1.0.3.96 contains a buffer overrun vulnerability | 8.8 group max | 2% | ||
| CVE-2021-21881 | An OS command injection vulnerability exists in the Web Manager Wireless Network Scanner functionality of Lantronix PremierWave 2050 8.9.0.0R4 | 9.9 | 37% | PoC | |
| CVE-2021-24762 | The Perfect Survey WordPress plugin before 1.5.2 does not validate and escape the question_id GET parameter before using it in a SQL statement in the… | 9.8 | 87% | PoC ×2 | |
| CVE-2021-28169 | For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected… | 5.3 | 78% | ||
| CVE-2021-31589 | A cross-site scripting (XSS) vulnerability has been reported and confirmed for BeyondTrust Secure Remote Access Base Software version 6.0.1 and older, which… | 6.1 | 26% | PoC ×2 | |
| CVE-2021-39226 | Authentication Bypass in Grafana Exposes and Deletes Dashboard Snapshot Data | 7.3 | 100% | KEVPoC | KEV |
| CVE-2021-4045 | TP-Link Tapo C200 IP camera, on its 1.1.15 firmware version and below, is affected by an unauthenticated RCE vulnerability, present in the uhttpd binary… | 9.8 | 72% | PoC | |
| CVE-2021-43711 | The downloadFlile.cgi binary file in TOTOLINK EX200 V4.0.3c.7646_B20201211 has a command injection vulnerability when receiving GET parameters | 9.8 | 38% | PoC | |
| CVE-2022-21371 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component | 7.5 | 93% | PoC | |
| CVE-2022-21662 | WordPress: Low-privileged authenticated users (like author) in WordPress core are able to execute JavaScript/perform stored XSS attack… | 5.4 | 65% | ||
| CVE-2022-22536 | HTTP Request Smuggling in SAP NetWeaver, Web Dispatcher and Content Server | 10.0 | 98% | KEV | KEV |
| CVE-2022-22947 | Unauthenticated RCE in VMware Spring Cloud Gateway | 10.0 | 98% | KEVPoC ×2 | KEV |
| CVE-2022-22954 | Server-Side Template Injection RCE in VMware Workspace ONE Access and Identity Manager | 9.8 | 100% | KEVRansomwarePoC | KEV |
| CVE-2022-22963 | SpEL Expression Injection RCE in VMware Tanzu Spring Cloud Function | 9.8 | 100% | KEVPoC | KEV |
| CVE-2022-22965 | Unauthenticated RCE in VMware Spring Framework (Spring4Shell) - JDK 9+ Tomcat WARs | 9.8 | 100% | KEVPoC | KEV |
| CVE-2022-24112 | Authentication Bypass Leading to RCE in Apache APISIX | 9.8 | 96% | KEVPoC ×2 | KEV |
| CVE-2022-24260 | A SQL injection vulnerability in Voipmonitor GUI before v24.96 allows attackers to escalate privileges to the Administrator level | 9.8 | 50% | PoC | |
| CVE-2022-25060 | TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_startPing | 9.8 | 40% | PoC | |
| CVE-2022-25075 | TOTOLink A3000RU V5.9c.2280_B20180512 was discovered to contain a command injection vulnerability in the "Main" function | 9.8 | 56% | PoC | |
| CVE-2022-25134 | A command injection vulnerability in the function setUpgradeFW of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to… | 9.8 | 3% | ||
| CVE-2022-27226 | A CSRF issue in /api/crontab on iRZ Mobile Routers through 2022-03-16 allows a threat actor to create a crontab entry in the router administration panel | 8.8 | 34% | PoC ×3 | |
| CVE-2022-29464 | Unrestricted file upload leading to unauthenticated RCE in multiple WSO2 products | 9.8 | 100% | KEVRansomwarePoC ×2 | KEV |
From the original article
10 min read at unit42.paloaltonetworks.com
Recent observations of exploits used in the wild reveal that attackers have been making use of newly published remote code execution vulnerabilities in VMware ONE Access and Identity Manager and Spring Cloud Function, Spring MVC and Spring Web Flux, among others.
By Yue Guan · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.