25 vulnerabilities exploited by Chinese state-sponsored hackers

CVE-2015-4852 is a Java deserialization flaw (CWE-502) in how Oracle WebLogic Server processes untrusted serialized data involving Apache Commons, which permits remote code execution. An attacker triggers it by sending a crafted serialized object to a WebLogic server over the T3 protocol (typically the default administration listener on port 7001) without authentication. Successful exploitation yields arbitrary code execution on the server under the WebLogic service account, enabling full server compromise, lateral movement, and follow-on activity such as cryptomining or ransomware (CISA has not confirmed ransomware use for this CVE). Any organization running Oracle WebLogic Server is affected, particularly those with the T3 port reachable from the internet. Exploitation is confirmed in the wild: CISA added it to the KEV catalog on 2021-11-03, EPSS assigns a 96% probability of exploitation within 30 days, and recent reporting highlights it among vulnerabilities exploited by Chinese state-sponsored hackers and discussed in criminal forums.

Do: Apply the Oracle-provided WebLogic update per vendor instructions (the October 2015 Critical Patch Update and later include the fix), as required by CISA's KEV listing. Until patched, restrict access to the T3 protocol/port 7001 to trusted hosts via firewall rules or WebLogic connection filters, and hunt for signs of compromise such as unexpected child processes, web shells, or unusual outbound connections.

CVE-2017-6327 is an input-validation flaw (CWE-20) in Symantec Messaging Gateway that allows remote code execution; the exact vulnerable code path is not described in the available data. Because the flaw is remotely triggerable, an attacker who can reach the vulnerable component can execute code on the appliance and may then pursue privilege escalation to gain higher-level access on the host. Affected organizations are those running Symantec Messaging Gateway, with risk concentrated where the appliance or its administrative interface is reachable from untrusted networks. The vulnerability is confirmed exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03 with a required action to apply updates per vendor instructions, and EPSS assigns a high 35.3% probability of exploitation within 30 days (98th percentile); no public proof-of-concept is known and any ransomware association is unconfirmed.

Do: Apply updates per vendor instructions as soon as possible, since CISA's KEV listing requires federal agencies to patch and the flaw is known exploited. In the interim, verify whether the Symantec Messaging Gateway management/administrative interface is exposed to the internet and restrict access to trusted management networks, and review appliance logs for signs of unauthorized access or code execution. Because a fixed version is not specified in the available data, confirm the current patched release with the vendor's (Symantec/Broadcom) security advisory before remediating.

Adobe ColdFusion 2016 (Update 5 and earlier) and ColdFusion 11 (Update 13 and earlier) contain a deserialization-of-untrusted-data flaw (CWE-502) that is remotely exploitable without authentication or user interaction. An attacker sends crafted serialized data to a network-accessible ColdFusion component, which the server deserializes without validation. Successful exploitation leads to arbitrary code execution with high impact on confidentiality, integrity, and availability (CVSS 3.1 score 9.8). Any organization running these ColdFusion releases is affected, particularly internet-facing ColdFusion servers, which are common in enterprise and government environments. The flaw is confirmed exploited in the wild (added to CISA KEV on 2021-11-03), carries a 62.1% 30-day exploitation probability (EPSS 99th percentile), and recent NSA reporting highlights it among the flaws actively used by Chinese state-sponsored hackers.

Do: Upgrade affected ColdFusion 2016 and ColdFusion 11 installations to the latest cumulative updates per Adobe's instructions (i.e., newer than Update 5 and Update 13, respectively) and verify no instance still runs a vulnerable build. Because the flaw is unauthenticated and remotely exploitable, prioritize patching internet-facing ColdFusion servers and, as an interim mitigation, restrict external network access to ColdFusion services and administrative components. Given the KEV listing and reported use by Chinese state-sponsored hackers, also check exposed ColdFusion servers for signs of exploitation.

CVE-2018-6789 is an off-by-one buffer overflow (CWE-120) in the base64d decoding function of Exim's SMTP listener, affecting Exim versions before 4.90.1. A remote, unauthenticated attacker triggers it by sending a handcrafted message to the SMTP listener, causing the overflow during base64 decoding. Successful exploitation yields arbitrary code execution on the mail server with the privileges of the Exim daemon. Affected operators include anyone running a vulnerable Exim mail transfer agent, including Exim as shipped in Debian and Ubuntu; Exim powers roughly half of internet-facing mail servers, with on the order of 400,000 servers exposed at disclosure. Exploitation is confirmed in the wild: the flaw is in CISA's Known Exploited Vulnerabilities catalog with known ransomware use, multiple public PoCs/exploits are available, and it appears in the NSA's list of top flaws abused by Chinese state-sponsored hackers.

Do: Upgrade Exim to 4.90.1 or later, or apply the patched Exim package from Debian's and Ubuntu's security repositories on affected distributions. Inventory internet-facing SMTP services (ports 25/465/587) for vulnerable Exim versions, review mail logs for signs of exploitation, and prioritize patching given the flaw's CISA KEV listing and known ransomware use.

CVE-2019-0708 is a use-after-free (CWE-416) vulnerability in Microsoft Remote Desktop Services, formerly Terminal Services, in which an unauthenticated attacker can connect to a target system over RDP and send specially crafted requests to trigger the flaw. Because the trigger requires no authentication, the flaw is wormable: a successful exploit grants remote code execution on the target host, potentially with elevated privileges, and could allow self-propagating attacks similar to WannaCry. Organizations running the affected Microsoft Remote Desktop Services, particularly legacy Windows releases still accepting inbound RDP connections, are in scope. Exploitation is confirmed in the wild: the flaw (nicknamed BlueKeep) is listed in CISA's KEV catalog (added 2021-11-03), CISA notes known ransomware use, and EPSS assigns it a 100% probability of exploitation within 30 days.

Do: Apply Microsoft's security updates for CVE-2019-0708 per vendor instructions, prioritizing legacy or end-of-support Windows systems exposed to inbound RDP. As mitigation, restrict RDP (TCP 3389) to trusted networks or VPN access, require Network Level Authentication (NLA), and audit perimeter firewalls and public scans for open RDP listeners. The vulnerability is in the CISA KEV catalog, so patching is treated as a required action for federal and high-risk environments.

CVE-2019-0803 is a privilege escalation flaw in Microsoft's Win32k kernel component caused by improper handling of objects in memory. It is triggered locally when code already running on a Windows system reaches the vulnerable Win32k object-handling path, allowing memory corruption that the attacker can leverage. Successful exploitation lets the attacker run arbitrary code in kernel mode, elevating from a low-privileged account to full system-level control. Per the available data, the affected component is Microsoft Win32k across Windows installations, though specific affected Windows versions and builds are not enumerated in the source data and should be confirmed against Microsoft's advisory. Exploitation is confirmed in the wild: CISA added it to the KEV catalog on 2021-11-03 with known ransomware use, and EPSS assigns a 45.2% probability of exploitation within 30 days (99th percentile).

Do: Apply Microsoft Windows security updates per vendor instructions — this flaw was fixed in Microsoft's April 2019 security updates, so ensure systems are running those or later cumulative updates and verify by checking OS build numbers. Prioritize patching endpoints and servers where untrusted or low-privileged users can execute code, given documented ransomware chaining. Treat KEV status as a deadline: systems unpatched for this Win32k flaw should be considered actively targeted.

A tampering vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully bypass the NTLM MIC (Message Integrity Check) protection. An attacker who successfully exploited this vulnerability could gain the ability to downgrade NTLM security features. To exploit this vulnerability, the attacker would need to tamper with the NTLM exchange. The attacker could then modify flags of the NTLM packet without invalidating the signature. The update addresses the vulnerability by hardening NTLM MIC protection on the server-side.

Ivanti Pulse Connect Secure, an enterprise SSL VPN appliance, contains an arbitrary file read vulnerability (CWE-22, path traversal) that requires no authentication. An unauthenticated remote attacker with network access to the appliance over HTTPS can send a specially crafted URI containing traversal sequences to read arbitrary files from the device. The attacker gains access to sensitive appliance files, potentially including configuration or credential material useful for further compromise, and CISA records known ransomware use of this flaw. Any organization running Pulse Connect Secure, especially gateways exposed to the internet for remote access, is affected. Exploitation is established: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use, EPSS assigns a 100% probability of exploitation in the next 30 days, and no public PoC is known.

Do: Apply updates per Ivanti's instructions, the required action in the CISA KEV entry, prioritizing internet-facing Pulse Connect Secure gateways, and consult the vendor advisory for the applicable fixed release since no version range is provided here. Where patching is not immediate, restrict HTTPS access to the appliance and hunt for signs of exploitation (unexpected file reads, anomalous VPN logins or sessions, and follow-on ransomware activity), as CISA reports known ransomware use.

Atlassian accidentally shipped its pdkinstall development plugin enabled in release builds of Crowd and Crowd Data Center, so anyone who can send requests to the instance can install arbitrary plugins on it. An unauthenticated attacker sends crafted requests to a vulnerable Crowd server, uploads a malicious plugin, and gains remote code execution on the host. All releases from 2.1.0 through the 3.4.x line are affected until the 3.0.5, 3.1.6, 3.2.8, 3.3.5, and 3.4.4 fixes, so essentially every Crowd deployment predating those patches is exposed, particularly enterprises using Crowd for centralized identity/SSO with the instance reachable over the network. Exploitation is confirmed in the wild: the flaw is in CISA's Known Exploited Vulnerabilities catalog with known ransomware use, a public PoC exploit is available, and EPSS assigns a 95.4% probability of exploitation within 30 days.

Do: Upgrade Crowd or Crowd Data Center to 3.0.5, 3.1.6, 3.2.8, 3.3.5, or 3.4.4 (or later) on the corresponding release line; where patching is delayed, disable the pdkinstall plugin in the administration console as an interim mitigation. Review installed plugins for unfamiliar entries and hunt for web shells or post-exploitation activity, since CISA notes ransomware use of this flaw.

CVE-2019-18935 is a .NET deserialization flaw (CWE-502) in the RadAsyncUpload function of Progress Telerik UI for ASP.NET AJAX through version 2019.3.1023. It is triggered when an attacker who knows the Telerik upload encryption keys — most commonly because the earlier flaws CVE-2017-11317 or CVE-2017-11357 exposed them, though keys can be obtained by other means — sends crafted serialized data to RadAsyncUpload, allowing remote code execution without authentication. Successful exploitation gives an attacker arbitrary code execution on the hosting IIS/ASP.NET web server, reflected in the critical 9.8 CVSS score. Any web application built with Telerik UI for ASP.NET AJAX at or below 2019.3.1023 is affected, unless 2019.3.1023 has the non-default hardening setting enabled (as of 2020.1.114 a default setting prevents the exploit). Exploitation is rampant in the wild: the flaw was added to CISA KEV on 2021-11-03 with known ransomware use, carries a 99.7% EPSS probability of exploitation, has multiple public exploits (Bishop Fox, RAU_crypto, noperator), and has been used by multiple threat groups — including ransomware and government-linked actors — to breach organizations including a U.S. federal agency.

Do: Upgrade to Progress Telerik UI for ASP.NET AJAX 2020.1.114 or later, where a default setting prevents exploitation (or, if staying on 2019.3.1023, enable the non-default hardening setting); per CISA KEV, apply updates per vendor instructions. Because exploitation requires the encryption keys to be known, also patch the older CVE-2017-11317/CVE-2017-11357 key-disclosure flaws or rotate the Telerik upload encryption keys. Check internet-facing IIS/ASP.NET applications for exposed RadAsyncUpload handlers and indicators of compromise, given known ransomware and federal-agency breaches.

CVE-2019-19781 is a path-traversal flaw (classified CWE-22, though CISA's description calls it unspecified) in Citrix ADC (formerly NetScaler ADC), Citrix Gateway, and Citrix SD-WAN WANOP appliances that lets an unauthenticated remote attacker traverse directories via crafted requests and execute arbitrary commands on the appliance, typically with root privileges. It is triggered by sending specially crafted directory-traversal requests (crafted URLs/requests to the appliance's management or VPN endpoints), which lets the attacker write files and run commands with no credentials. Successful exploitation yields arbitrary code execution on the appliance, enabling theft of VPN/ADC credentials, lateral movement into the corporate network, and installation of persistent backdoors. Any organization running affected ADC, Gateway, or SD-WAN WANOP firmware is affected, with internet-facing gateways used for remote access at the highest risk. Exploitation is confirmed in the wild: the vulnerability is on CISA's KEV (added 2021-11-03) with known ransomware use, EPSS assigns near-certain (100.0%) probability of exploitation within 30 days, and no public PoC is listed despite confirmed abuse.

Do: Upgrade Citrix ADC, Gateway, and SD-WAN WANOP appliances to the fixed firmware builds listed in Citrix advisory CTX267020; if patching cannot be done immediately, apply Citrix's published interim mitigation and restrict internet exposure to the appliance. Because exploitation grants root code execution and persistence, after patching hunt for indicators of compromise (unexpected nsroot account, modified system files, crontab/scheduled entries), kill all active and inactive sessions, and rotate appliance and VPN credentials. Prioritize internet-facing gateways and comply with CISA's required action to apply vendor updates.

Atlassian Confluence Server and Data Center contain a server-side template injection flaw (CWE-22) in which attacker-supplied template content is processed by the server, enabling path traversal and ultimately remote code execution. An attacker triggers it by submitting crafted template syntax in a request to a vulnerable instance, and can run arbitrary commands or code on the underlying server. Successful compromise could allow data theft, deployment of webshells, or ransomware; CISA notes known ransomware use of this vulnerability. Organizations running self-hosted Confluence Server or Data Center are affected, particularly instances exposed to the internet. Exploitation is confirmed in the wild: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) and EPSS assigns a 99.9% probability of exploitation, placing it in the top percentile.

Do: Apply updates per vendor instructions by upgrading Confluence Server and Data Center to Atlassian's fixed releases, and prioritize internet-facing instances. Until patched, restrict network exposure of Confluence and monitor for signs of compromise such as webshells, unexpected processes, or ransomware activity, since ransomware operators are known to exploit this flaw.

CVE-2020-0601 (known as 'Curveball') is a spoofing flaw in Crypt32.dll, the Windows CryptoAPI component that validates Elliptic Curve Cryptography (ECC) certificates, which mishandles ECC certificate parameters when checking signatures. An attacker can trigger it by signing malicious content, most notably an executable, with a spoofed, attacker-controlled ECC certificate that Windows accepts as if it were issued by a trusted certificate authority; the attack vector is network-based but requires user interaction (CVSS 3.1: 8.1, AV:N/AC:L/PR:N/UI:R). Successful exploitation makes attacker-supplied malware appear to come from a legitimate, trusted software vendor, defeating code-signing trust prompts and signature-based trust decisions, with high impact on confidentiality and integrity. Affected systems are the Microsoft Windows 10 builds 1507 through 1909 and Windows Server versions 1803, 1903, 1909, 2016 and 2019 in the CISA data, with Go also listed as an affected vendor via its ECC certificate validation, effectively covering the mainstream Windows install base at the time. The flaw was discovered by the NSA and patched in the January 2020 Patch Tuesday; it is now CISA KEV-listed (added 2021-11-03, ransomware use unknown) with very high predicted exploitation risk (EPSS 89.4%, 100th percentile), and no public PoC is tracked in this data.

Do: Apply Microsoft's January 2020 Patch Tuesday cumulative security updates for all affected Windows 10 and Windows Server builds, per CISA's required action (apply updates per vendor instructions). Prioritize user workstations and servers that validate signed binaries, Authenticode signatures, or TLS certificates, since exploitation hinges on a user or application trusting a spoofed ECC-signed artifact. If Go is deployed in your environment, update Go toolchains to a patched January 2020 or later release, as Go was also acknowledged as an affected vendor.

CVE-2020-0688 is a remote code execution vulnerability in Microsoft Exchange Server caused by the validation key not being uniquely created at install time, leaving deployments with a predictable, shared key (CWE-287, improper authentication). A remote attacker who can reach an affected Exchange server and knows the common install-time key can supply maliciously crafted, cryptographically signed payloads that the server trusts, triggering code execution without needing per-server secrets. Successful exploitation gives the attacker code execution on the Exchange server, which can be used to access mail data, move laterally, and stage follow-on activity; CISA notes known use in ransomware campaigns. All organizations running the affected on-premises Microsoft Exchange Server are in scope per CISA's listing, though the affected version range is not specified in the source data. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2021-11-03 with known ransomware use, and EPSS rates 30-day exploitation probability at 100% (top percentile).

Do: Apply Microsoft's Exchange security updates addressing CVE-2020-0688 (released in February 2020) to every on-premises Exchange server, per CISA's required action. As an interim mitigation, configure a unique ASP.NET machineKey in each Exchange server's web.config instead of the default shared install-time key, and hunt for indicators of exploitation given the known ransomware use.

Zoho ManageEngine Desktop Central contains a file upload vulnerability (CWE-502, deserialization of untrusted data) that can be exploited without authentication. A remote attacker sends crafted upload requests to the affected application, which accepts and processes the uploaded content without any credentials, resulting in execution of attacker-controlled code. Successful exploitation yields remote code execution on the server hosting Desktop Central, giving the attacker a foothold on an endpoint-management system that typically has broad reach into a corporate network. Any organization running the affected Zoho ManageEngine product is exposed, and exploitability does not depend on user interaction or credentials. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), indicating known exploitation in the wild, and EPSS assigns a 99.9% probability of exploitation within 30 days; specific exploited versions are not stated in the available data.

Do: Apply updates per Zoho/ManageEngine vendor instructions immediately, as the CISA KEV required action specifies. Restrict internet exposure of the Desktop Central server and audit it for signs of compromise (unexpected processes, webshells, outbound connections) since unauthenticated RCE has been exploited in the wild. Check that any exposed instances are patched before treating network access as safe.

CVE-2020-1350 is a critical (CVSS 10.0) remote code execution vulnerability in the DNS Server role of Microsoft Windows Server, caused by improper input handling (CWE-20) when the server fails to properly process crafted DNS requests, notably malicious DNS signature (SIG) records delivered over TCP. An unauthenticated attacker can trigger it by sending a crafted DNS query that forces the vulnerable DNS server to perform an upstream lookup and receive a malicious response, overflowing a heap buffer. Successful exploitation yields code execution with SYSTEM privileges on the DNS server, which is very often an Active Directory domain controller, giving the attacker control of the host and typically the entire domain; the flaw is considered wormable because compromised DNS servers can propagate attacks to other servers they query. Any Windows Server 2008, 2012, 2016, or 2019 host running the DNS Server role is affected — internet-facing DNS servers are directly explovable, while internal DNS servers can be reached via malicious DNS responses passed through firewalls. The flaw was fixed in Microsoft's July 2020 updates, is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03, required action: apply vendor updates), carries EPSS of 91.4% (100th percentile), and appears in the NSA's top-25 list of flaws exploited by Chinese state-sponsored hackers; no public PoC is cataloged in this dataset and ransomware use is listed as unknown.

Do: Apply the July 2020 (or later) Microsoft security updates for each affected Windows Server release, prioritizing internet-facing DNS servers and domain controllers; if patching must be delayed, apply Microsoft's registry-based workaround limiting TCP DNS packet size (TcpReceivePacketSize = 0xFF00) and restart the DNS Server service. Inventory hosts with the DNS Server role installed and review their TCP/53 exposure, especially any resolvers reachable from the internet, and confirm remediation per CISA's required action.

CVE-2020-1472, widely known as "Zerologon," is an elevation-of-privilege flaw in how the Netlogon secure channel is established over the Netlogon Remote Protocol (MS-NRPC) on Microsoft domain controllers. An unauthenticated attacker with network reachability to a domain controller sends specially crafted Netlogon messages to establish a vulnerable secure channel and then runs a specially crafted application on the network to obtain domain administrator access. Successful exploitation yields domain administrator privileges, effectively full compromise of the Active Directory environment, and the flaw is known to be used in ransomware operations. Any organization running affected Windows Server versions (2008 through 20H2) as domain controllers is exposed, along with environments using Netlogon implementations from Samba and distributions or products from Fedora, openSUSE, Canonical (Ubuntu), Debian, Synology, and Oracle. Exploitation is highly active: a public Zerologon PoC/exploit is available, the flaw is on CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03, with known ransomware use), and EPSS estimates a 99.4% probability of exploitation within 30 days.

Do: Apply the vendor updates on all domain controllers and other affected systems immediately, following Microsoft's two-phase Netlogon secure channel guidance (the enforcement phase of the phased rollout began in Q1 2021). Audit Netlogon secure-channel connections and event logs for clients still using vulnerable connections before enabling full enforcement, and install updated packages for Samba and other Netlogon implementations from Fedora, openSUSE, Ubuntu, Debian, Synology, and Oracle. Given known ransomware use, prioritize patching any domain controller reachable from user networks, VPNs, or the internet.

CVE-2020-15505 is a critical, unauthenticated remote code execution vulnerability in Ivanti MobileIron's Core and Enterprise Connector, Sentry, and Monitor and Reporting Database (RDB) products, which public proof-of-concept exploits identify as a Hessian-based Java deserialization flaw. An unauthenticated attacker can send crafted requests to an affected MobileIron server over the network, with no privileges or user interaction required, and execute arbitrary code, gaining full control of the MDM server with high impact on confidentiality, integrity, and availability. Any organization running the affected versions of these enterprise mobile device management products is at risk, particularly internet-facing MobileIron Core and Sentry instances. Exploitation is confirmed and widespread: the flaw is on CISA's Known Exploited Vulnerabilities catalog (added November 3, 2021), carries a 99.7% EPSS score, and was named among the top flaws exploited by Chinese state-sponsored hackers, prompting urgent UK NCSC patching alerts. It is also being observed chained with other exploited vulnerabilities (e.g., VPN flaws and Zerologon) as an initial-access vector, so defenders should treat it as actively exploited.

Do: Apply the vendor updates immediately per Ivanti's security advisory for MobileIron Core, Enterprise Connector, Sentry, and RDB (this is CISA's required action for KEV entries). Until patched, reduce internet exposure of MobileIron interfaces and monitor for exploitation; because the flaw was mass-exploited (including by Chinese state-sponsored actors), hunt for signs of compromise such as unexpected processes, persistence mechanisms, or webshells on affected MDM servers.

Oracle Coherence versions 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0 contain a deserialization flaw (CWE-502) in the Caching, CacheStore and Invocation components, rated 9.8 (critical). An unauthenticated attacker with network access to the T3 protocol — the listener typically exposed by Oracle WebLogic Server, which bundles Coherence — can send a crafted serialized payload and take over Coherence, effectively achieving remote code execution in the hosting Java process with no credentials or user interaction required. Beyond standalone Coherence, the flaw affects the Oracle Fusion Middleware products that bundle it, including Access Manager, WebCenter Portal, Commerce Platform, Rapid Planning and others. Exploitation is confirmed in the wild: CISA added it to the KEV catalog on 2021-11-03, EPSS estimates a ~97% probability of exploitation within 30 days, public PoCs and exploit write-ups exist, and related reporting flags it among vulnerabilities heavily used by Chinese state-sponsored hackers.

Do: Apply the Coherence fixes from Oracle's January 2020 Critical Patch Update (or later) for Coherence 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0 and for every listed product that embeds Coherence, prioritizing WebLogic-based deployments given active exploitation and the 9.8 CVSS. Until patched, restrict T3/T3S access to trusted networks and remove direct internet exposure of WebLogic listener ports, and keep this in your KEV/EPSS-driven remediation queue; hunt for unexpected code execution or outbound connections originating from T3 listeners.

CVE-2020-3118 is a format string vulnerability (CWE-134) in the Cisco Discovery Protocol (CDP) implementation of Cisco IOS XR Software, caused by improper validation of string input from certain fields in CDP messages. An unauthenticated attacker who is Layer 2 adjacent (on the same broadcast domain) can trigger it by sending a malicious CDP packet to an affected device, causing a stack overflow (CWE-787). A successful exploit allows the attacker to execute arbitrary code with administrative privileges on the device, or alternatively to cause a device reload (denial of service). Any organization running Cisco IOS XR — typically service-provider and large-enterprise core, edge, and aggregation routers — is affected whenever CDP is enabled on interfaces reachable by an attacker at Layer 2. The flaw is listed in the CISA Known Exploited Vulnerabilities catalog (added 2021-11-03), indicating known exploitation in the wild, with no public PoC identified and an EPSS estimate of 11.7% (96th percentile) for exploitation within 30 days.

Do: Apply updates to affected Cisco IOS XR devices per Cisco's advisory, as required by the CISA KEV catalog. As interim mitigation, disable Cisco Discovery Protocol on interfaces connected to untrusted Layer 2 segments or restrict broadcast-domain access to trusted devices. Prioritize IOS XR devices where untrusted users, partners, or shared infrastructure exist on the same VLAN or broadcast domain, since exploitation requires only L2 adjacency.

CVE-2020-5902 is a critical, unauthenticated remote code execution flaw in the F5 BIG-IP Traffic Management User Interface (TMUI), the appliance's web management console, rooted in a directory/path traversal issue (CWE-22) in undisclosed TMUI pages. It is triggered by sending crafted HTTP(S) requests to the management interface — classically path-traversal URLs beneath the TMUI application on the management port — which lets an attacker bypass authentication, read or delete arbitrary files, and execute commands without credentials. Successful exploitation yields full control of the BIG-IP system, which attackers can use to pivot into networks the appliance fronts, maintain persistence, and deploy ransomware. Any organization running an affected F5 BIG-IP appliance or virtual edition whose TMUI is reachable, or whose management network can be reached, is exposed; F5's installed base spans large enterprises and service providers, so the footprint is broad. Exploitation is confirmed in the wild: the flaw was mass-scanned and exploited within days of its July 2020 disclosure, it is listed in CISA KEV with known ransomware use, and EPSS assigns a ~100% probability of exploitation within 30 days.

Do: Patch immediately using F5's advisory K52145254 — upgrade BIG-IP to a fixed release per the vendor's version matrix, since CISA's required action is applying vendor updates. Until patched, restrict TMUI/management-interface access to trusted source IPs or a VPN (or disable TMUI if unused) and apply F5's published interim workaround. Because ransomware use is confirmed, hunt for indicators of compromise on both patched and unpatched appliances (unexpected files, webshells, modified login pages, new accounts or scheduled tasks) before treating systems as clean.

CVE-2020-8193 is an improper access control flaw (CWE-284/CWE-287) in Citrix ADC, Citrix Gateway, and Citrix SD-WAN WAN-OP appliances that lets an unauthenticated remote attacker reach certain URL endpoints that should require authentication. An attacker triggers it simply by sending crafted HTTP requests over the network, with no credentials or user interaction required. The direct impact is limited (CVSS 3.1 rates it 6.5 with low confidentiality and integrity impact), but access to protected endpoints can expose sensitive information and is commonly chained with other Citrix flaws; a public proof of concept for local file inclusion against Citrix ADC/NetScaler exists. Anyone running Citrix ADC or Gateway builds before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14, or 10.5-70.18, or SD-WAN WAN-OP builds before 11.1.1a, 11.0.3d, or 10.2.7 is affected. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog in November 2021 and was named in the NSA's list of the top 25 flaws actively exploited by Chinese state-sponsored hackers, with an EPSS probability of exploitation of 88.4%.

Do: Upgrade Citrix ADC and Citrix Gateway to at least 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14, or 10.5-70.18, and SD-WAN WAN-OP to at least 11.1.1a, 11.0.3d, or 10.2.7, per Citrix's instructions. Prioritize internet-facing ADC/Gateway appliances (VPN gateways and load balancers), since the flaw is reachable without credentials, and review appliance logs for unauthenticated access to protected endpoints. This CVE is on the CISA KEV list, so federal and KEV-committed defenders are required to apply the vendor updates.

CVE-2020-8515 is an unauthenticated OS command injection flaw (CWE-78) in the web management page of DrayTek Vigor3900, Vigor2960, and Vigor300B routers. An attacker can trigger it by sending crafted, unauthenticated HTTP requests to the router's management web interface, injecting shell metacharacters into commands executed by the device. Successful exploitation yields remote code execution on the router, allowing an attacker to install web shells, alter firewall/VPN settings, intercept traffic, or pivot into the protected network. Any organization running affected Vigor3900/2960/300B firmware with the management interface reachable from the internet is exposed; these models are commonly deployed as small-business and branch-office VPN gateways. The flaw is being actively exploited: CISA added it to the KEV on 2021-11-03 and EPSS assigns a 100% probability of exploitation within 30 days, though no public PoC is catalogued.

Do: Upgrade Vigor3900, Vigor2960, and Vigor300B to firmware 1.5.1.1 or later per DrayTek's instructions, as required by the CISA KEV entry. Do not expose the web management page directly to the internet, and inspect internet-facing units for indicators of compromise such as unexpected web shell files (e.g., webs.php), unknown administrator accounts, or altered firewall/VPN settings. If compromise is confirmed, perform a factory reset and reflash clean firmware, then restore configurations from trusted backups.