Feb 11, 2025

Started

• Closed✓Patched

  Microsoft Windows: 2 exploited vulnerabilities (CVE-2025-21391, CVE-2025-21418)

  CVE-2025-21391: Microsoft Windows Storage contains a link following vulnerability that could allow for privilege escalation. This vulnerability could allow an attacker to delete data including data that results in the service being unavailable. CVE-2025-21418: Microsoft Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges. Added to CISA KEV on 2025-02-11.

  Microsoft Windows·Closed Feb 11, 2025·updated Feb 11, 2025

• ClosedHigh✕No patch yet

  Zyxel DSL CPE Devices: 2 exploited vulnerabilities (CVE-2024-40890, CVE-2024-40891)

  CVE-2024-40890: Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the CGI program that could allow an authenticated attacker to execute OS commands via a crafted HTTP request. CVE-2024-40891: Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the management commands that could allow an authenticated attacker to execute OS commands via Telnet. Added to CISA KEV on 2025-02-11.

  Zyxel DSL CPE Devices·Closed Feb 11, 2025·updated Feb 11, 2025