U.S. CISA adds Apple products and Juniper Junos OS flaws to its Known Exploited Vulnerabilities catalog
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-21590 | Kernel Code Injection Flaw in Juniper Junos OS Exploited in the Wild Juniper Junos OS contains an improper isolation or compartmentalization flaw (CWE-653) in the kernel that allows a local attacker with high privileges to inject arbitrary code and compromise the integrity of the device. The issue cannot be triggered from the Junos CLI, so exploitation requires shell access, such as via a compromised or rogue high-privileged account or as part of a chained attack. Code running in the kernel gives the attacker deep control of the device, enabling persistent tampering such as backdoors or rootkits. All Junos OS releases before the listed fix versions across the 21.2 through 24.2 branches are affected, covering Juniper's routing, switching, and security product lines. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-03-13, confirming exploitation in the wild, amid headlines reporting China-linked APT UNC3886 breaching Juniper routers with custom backdoors and rootkits. Do: Upgrade affected systems to 21.2R3-S9, 21.4R3-S10, 22.2R3-S6, 22.4R3-S6, 23.2R2-S3, 23.4R2-S4, or 24.2R1-S2/24.2R2 per branch; releases older than 21.2 have no listed fix and require migration to a supported fixed release. Restrict shell/root access to trusted administrators and, given reported UNC3886 backdoor and rootkit activity on Juniper routers, audit devices for unexpected processes, modified system files, or unusual persistence in the Junos shell. U.S. federal agencies must apply the required remediation per BOD 22-01 due to the KEV listing. | 6.7 | 2% | KEV |
| masson the order of 1M+ devices running affected Junos OS releases (Junos spans Juniper's global installed base of routers, switches, and firewalls at service… | |
| CVE-2025-24201 | WebKit Out-of-Bounds Write Sandbox Escape in Apple iOS, Safari, and macOS CVE-2025-24201 is an out-of-bounds write (CWE-787) in WebKit, the web rendering engine used across Apple's platforms, which Apple addressed with improved bounds checks. It is triggered by processing maliciously crafted web content, meaning a victim only has to load attacker-controlled web content in Safari or in any app that renders web content. A successful attacker can break out of the Web Content sandbox and perform unauthorized actions, an impact CISA scores at CVSS 10.0 (critical, scope-changing). Affected users include anyone running vulnerable versions of iOS, iPadOS, macOS Sequoia, Safari, visionOS, or watchOS; Debian Linux is also listed in the CPE data because Debian ships WebKit in its webkit packages. Apple reports the flaw may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 17.2 (this patch is a supplementary fix for that previously blocked attack, extended to older branches), and the CVE was added to CISA's KEV catalog on 2025-03-13. Do: Apply the vendor fixes immediately: Safari 18.3.1; iOS/iPadOS 18.3.2 (or 17.7.6, 16.7.11, or 15.8.4 on devices that cannot run the newest release); macOS Sequoia 15.3.2; visionOS 2.3.2; watchOS 11.4; and updated Debian webkit packages per Debian advisories. Because the CVE is in CISA's KEV catalog (added 2025-03-13), US federal agencies must patch per BOD 22-01, and all defenders should prioritize fleets with high-risk or frequently targeted users. Given the 'extremely sophisticated' targeted exploitation against individuals on iOS before 17.2, check whether targeted or high-value users' devices show indicators of compromise and ensure they are not left on older branches. | 10.0 | 4% | KEV |
| mass≈2 billion+ active Apple devices (iPhone, iPad, Mac, Apple Watch and Vision Pro all ship the affected WebKit; Apple publicly reports an active installed base… |
Full article693 words · extracted from securityaffairs.com · click to collapse
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Apple products and Juniper Junos OS flaws to its Known Exploited Vulnerabilities catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog:
- CVE-2025-21590 Juniper Junos OS Improper Isolation or Compartmentalization Vulnerability
- CVE-2025-24201 Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability
The vulnerability CVE-2025-21590 is an Improper Isolation or Compartmentalization issue in the kernel of Juniper Networks Junos OS that allows a local attacker with high privileges to compromise the integrity of the device. A local attacker with access to the shell is able to inject arbitrary code which can compromise an affected device. The vendor states that the flaw is not exploitable from the Junos CLI.
This week, Mandiant researchers warned that China-linked APT group UNC3886 is deploying custom backdoors on Juniper Networks Junos OS MX routers.
The group’s latest operation on Juniper Networks’ Junos OS routers demonstrates a deep knowledge of system internals. UNC3886 prioritizes stealth by using passive backdoors and tampering with logs and forensic artifacts to ensure long-term persistence while evading detection.
Mandiant observed UNC3886 using compromised credentials to access Junos OS CLI from terminal servers managing network devices, escalating to FreeBSD shell mode. Junos OS includes a Verified Exec (veriexec) subsystem, adapted from NetBSD Veriexec, to ensure file integrity by preventing unauthorized code execution, including binaries, libraries, and scripts. To deploy malware, the threat actor had to first bypass this security mechanism. UNC3886 bypassed it by injecting malicious code into trusted processes. This allowed them to install six TinyShell-based backdoors named appid, to, irad, jdosd, oemd, and lmpad. Each backdoor was designed for remote access, persistence, and stealth, enabling attackers to evade detection and maintain long-term control.
“Veriexec protection prevents unauthorized binaries from executing. This poses a challenge for threat actors, as disabling veriexec can trigger alerts. However, execution of untrusted code is still possible if it occurs within the context of a trusted process. Mandiant’s investigation revealed that UNC3886 was able to circumvent this protection by injecting malicious code into the memory of a legitimate process.” reads the report published by Mandiant “This specific technique is now tracked as CVE-2025-21590, as detailed in Juniper Network’s security bulletin JSA93446.”
The second flaw added to the KeV catalog is CVE-2025-24201. This week Apple released emergency security updates to address a zero-day vulnerability, tracked as CVE-2025-24201, in the WebKit cross-platform web browser engine.
The vulnerability is an out-of-bounds write issue that was exploited in “extremely sophisticated” attacks.
An attacker can exploit the vulnerability using maliciously crafted web content to escape the Web Content sandbox. Apple released this fix as an additional measure after blocking a similar attack in iOS 17.2.
“Maliciously crafted web content may be able to break out of Web Content sandbox. This is a supplementary fix for an attack that was blocked in iOS 17.2. (Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 17.2.)” reads the advisory published by the company.
The company addressed this vulnerability with improved checks. Apple released iOS 18.3.2, iPadOS 18.3.2, macOS Sequoia 15.3.2, visionOS 2.3.2, and Safari 18.3.1 to address the zero-day.
The flaw impacts iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later, Macs running macOS Sequoia, and Apple Vision Pro.
Apple did not disclose details about the attacks or attribute them to any threat actor.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix this vulnerability by April 3, 2025.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/175381/security/u-s-cisa-adds-apple-juniper-junos-os-flaws-known-exploited-vulnerabilities-catalog.html