Jun 2, 2025
4 new incidents, 0 with updates.
Started
- ClosedCriticalPatched
ASUS Routers: Routers Improper Authentication Vulnerability
ASUS Lyra Mini and ASUS GT-AC2900 devices contain an improper authentication vulnerability that allows an attacker to gain unauthorized access to the administrative interface. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Added to CISA KEV on 2025-06-02.
ASUS RoutersClosed Jun 2, 2025
- ClosedCriticalPatched
Craft CMS: 2 exploited vulnerabilities (CVE-2024-56145, CVE-2025-35939)
CVE-2024-56145: Craft CMS contains a code injection vulnerability. Users with affected versions are vulnerable to remote code execution if their php.ini configuration has `register_argc_argv` enabled. CVE-2025-35939: Craft CMS contains an external control of assumed-immutable web parameter vulnerability. This vulnerability could allow an unauthenticated client to introduce arbitrary values, such as PHP code, to a known local file location on the server. This vulnerability could be chained with CVE-2024-58136 as represented by CVE-2025-32432. Added to CISA KEV on 2025-06-02.
Craft CMSClosed Jun 2, 2025
- ClosedHighPatched
ASUS RT-AX55 Routers: RT-AX55 Routers OS Command Injection Vulnerability
ASUS RT-AX55 devices contain an OS command injection vulnerability that could allow a remote, authenticated attacker to execute arbitrary commands. As represented by CVE-2023-41346. Added to CISA KEV on 2025-06-02.
ASUS RT-AX55 RoutersClosed Jun 2, 2025
- ClosedHighPatched
ConnectWise ScreenConnect: ScreenConnect Improper Authentication Vulnerability
ConnectWise ScreenConnect contains an improper authentication vulnerability. This vulnerability could allow a ViewState code injection attack, which could allow remote code execution if machine keys are compromised. Added to CISA KEV on 2025-06-02.
ConnectWise ScreenConnectClosed Jun 2, 2025
