U.S. CISA adds Dahua IP Camera, Linux Kernel and Microsoft Exchange Server bugs to its Known Exploited Vulnerabilities catalog

CVE-2021-31196 is a Microsoft Exchange Server vulnerability that CISA's catalog names as an information disclosure flaw (the associated description string calls it remote code execution), rated CVSS 3.1 7.2 (AV:N/AC:L/PR:H/UI:N), meaning it is exploitable over the network without user interaction but only by an attacker already holding high-privilege, admin-level credentials on the server. It is triggered by sending crafted requests to a vulnerable Exchange server using those elevated credentials, and the attacker gains access to protected information - or, per the remote code execution description, potentially code execution on the server. The CISA data lists Microsoft Exchange Server with no specific version ranges, so unpatched on-premises Exchange deployments should be presumed in scope, with internet-facing servers the most plausible targets. Exploitation is confirmed: CISA added the bug to the Known Exploited Vulnerabilities catalog on 2024-08-21 (ransomware use unknown), and EPSS assigns a 54% probability of exploitation within 30 days (99th percentile), although no public proof-of-concept is known.

Do: Install the Microsoft Exchange security update for CVE-2021-31196 (shipped in the May 2021 Patch Tuesday Exchange security updates) or a later update on every Exchange server, prioritizing internet-facing ones, and verify installed builds rather than assuming the earlier 2021 Exchange patches covered this flaw. Given confirmed exploitation and reports of attackers actively scanning for unpatched Exchange servers, audit privileged-account usage and review logs for anomalous admin activity; federal agencies must remediate within the standard two-week BOD 22 window following the KEV listing. If immediate patching is not possible, restrict OWA/ECP exposure to trusted networks and enforce MFA and strong credentials for Exchange admin accounts, per CISA's required action.

Dahua IP cameras and related products contain an authentication bypass flaw (CWE-287, Improper Authentication) that is triggered when the client supplies the NetKeyboard type argument during the authentication process, allowing the device to treat the session as authenticated without valid credentials. An unauthenticated remote attacker who can reach the camera's network interface can exploit this to gain unauthorized access to the device's management functions. Successful exploitation can expose camera video streams and device configuration and can serve as a foothold into the surrounding surveillance or corporate network. Any organization running affected Dahua IP camera firmware, particularly cameras exposed to the internet, is potentially affected. The flaw is confirmed to be exploited in the wild: it was added to the CISA KEV on 2024-08-21, and EPSS assigns it a 99.9% probability of exploitation within 30 days (100th percentile), although no public PoC is known.

Do: Apply the mitigations or patched firmware specified in Dahua's security advisory for CVE-2021-33044; if mitigations are unavailable, discontinue use of the product as CISA's required action directs. Inventory internet-facing Dahua cameras and related devices, restrict their login interfaces from direct internet exposure, and review authentication logs for signs of prior exploitation. Ransomware use is listed as unknown, so treat any compromised camera as a potential network foothold and rotate any credentials used on the device.

CVE-2022-0185 is a heap-based buffer overflow in the legacy_parse_param function of the Linux kernel's Filesystem Context (fs_context) functionality, rooted in an integer-handling flaw (CWE-190). A local attacker triggers it by opening or configuring a filesystem that does not support the Filesystem Context API, which overflows the heap buffer used to hold mount parameters. Successful exploitation lets the attacker escalate privileges on the host, and in environments with user namespaces enabled (common on desktops, shared servers, and containers) it can lead to full root compromise and container escape. Any Linux kernel build containing the vulnerable code is affected, which spans the very large installed base of Linux servers, cloud instances, containers, and devices. The vulnerability is confirmed exploited in the wild (added to CISA KEV on 2024-08-21), carries an EPSS 30-day exploitation probability of 25.2% (98th percentile), has no known public PoC, and its use in ransomware campaigns is unknown.

Do: Apply patched kernel packages from your distribution or vendor as soon as available and reboot to load the fixed kernel, per the KEV required action; do not continue running an unpatched vulnerable kernel. Where feasible, interim-mitigate by restricting or disabling unprivileged user namespaces (a common exploitation path), and prioritize hosts that are internet-facing, multi-tenant, or running containers. Verify remediation by confirming your running kernel is one of your vendor's patched builds, since no specific fixed version numbers are provided in this dataset.