CISA Warns of Sitecore RCE Flaws; Active Exploits Hit Next.js and DrayTek Devices

CVE-2019-9874 is a deserialization flaw (CWE-502) in the Sitecore.Security.AntiCSRF module that lets an unauthenticated attacker run arbitrary code remotely. It is triggered by sending a crafted serialized .NET object in the HTTP POST parameter __CSRFTOKEN, which the module deserializes without validation. Successful exploitation yields full remote code execution with the privileges of the web application, with confidentiality, integrity, and availability all impacted. Users of Sitecore CMS 7.0 through 7.2 and Sitecore Experience Platform (XP) 7.5 through 8.2 are affected. The flaw carries a critical CVSS 3.1 score of 9.8, a very high EPSS score of 83.7%, and was added to CISA's Known Exploited Vulnerabilities catalog on 2025-03-26, indicating active exploitation in the wild; ransomware use is currently unknown.

Do: Upgrade affected Sitecore CMS (7.0–7.2) and XP (7.5–8.2) deployments to a patched, currently supported release per Sitecore's security guidance, as required by CISA's KEV/BOD 22-01 action for federal agencies. Until patched, restrict network access to vulnerable Sitecore instances and monitor IIS/web logs for unauthenticated POST requests containing oversized or anomalous __CSRFTOKEN values. A public technical advisory with exploitation details is available from Synacktiv, so treat exploitability as confirmed.

CVE-2020-8515 is an unauthenticated OS command injection flaw (CWE-78) in the web management page of DrayTek Vigor3900, Vigor2960, and Vigor300B routers. An attacker can trigger it by sending crafted, unauthenticated HTTP requests to the router's management web interface, injecting shell metacharacters into commands executed by the device. Successful exploitation yields remote code execution on the router, allowing an attacker to install web shells, alter firewall/VPN settings, intercept traffic, or pivot into the protected network. Any organization running affected Vigor3900/2960/300B firmware with the management interface reachable from the internet is exposed; these models are commonly deployed as small-business and branch-office VPN gateways. The flaw is being actively exploited: CISA added it to the KEV on 2021-11-03 and EPSS assigns a 100% probability of exploitation within 30 days, though no public PoC is catalogued.

Do: Upgrade Vigor3900, Vigor2960, and Vigor300B to firmware 1.5.1.1 or later per DrayTek's instructions, as required by the CISA KEV entry. Do not expose the web management page directly to the internet, and inspect internet-facing units for indicators of compromise such as unexpected web shell files (e.g., webs.php), unknown administrator accounts, or altered firewall/VPN settings. If compromise is confirmed, perform a factory reset and reflash clean firmware, then restore configurations from trusted backups.

CVE-2021-20124 is a path traversal (local file inclusion, CWE-22) flaw in the file download functionality of the WebServlet endpoint in DrayTek VigorConnect 1.6.0-B3, the vendor's on-premises centralized management software for Vigor networking equipment. Because the affected endpoint requires no authentication, any attacker who can reach the VigorConnect web interface over a network can send crafted requests that traverse outside the intended download directory. The VigorConnect service runs with root privileges on the underlying operating system, so an attacker can download arbitrary files with root-level access, potentially exposing credentials, configuration data, and other sensitive information on the management host. Any organization running DrayTek VigorConnect is affected, with the flaw confirmed in version 1.6.0-B3. The bug was publicly documented by Tenable (TRA-2021-42) in 2021 and was added to CISA's Known Exploited Vulnerabilities catalog on 2024-09-03 amid reports of active exploitation of DrayTek devices.

Do: Upgrade DrayTek VigorConnect to a fixed release newer than 1.6.0-B3 per DrayTek's security guidance; if patching is delayed, restrict the VigorConnect web interface (WebServlet endpoint) to trusted management networks only. Because the flaw is on CISA's KEV catalog (added 2024-09-03) with active exploitation reported, review firewall and web-server logs for unauthenticated file-download requests against WebServlet, and rotate any credentials, keys, or configuration secrets stored on the management host that could have been exfiltrated. Organizations unable to obtain mitigations should consider discontinuing use of the product per CISA's required action.