pwn.watch: Firewall incident updates

[high] Zyxel Multiple Firewalls Path Traversal

Tue, 03 Dec 2024 00:00:00 GMT

Multiple Zyxel firewalls contain a path traversal vulnerability in the web management interface that could allow an attacker to download or upload files via a crafted URL. Added to the CISA KEV catalog on 2024-12-03. CISA lists known use in ransomware campaigns.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-12-03: CISA added CVE-2024-11667 to the KEV catalog (federal deadline 2024-12-24) (source)
2024-11-27: CVE-2024-11667 published (source)

CVEs: CVE-2024-11667

[critical] Palo Alto PAN-OS management interface auth bypass + privilege escalation

Mon, 18 Nov 2024 00:00:00 GMT

CVE-2024-0012: Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in the web-based management interface for several PAN-OS products, including firewalls and VPN concentrators. CVE-2024-9474: Palo Alto Networks PAN-OS contains an OS command injection vulnerability that allows for privilege escalation through the web-based management interface for several PAN products, including firewalls and VPN concentrators. Added to the CISA KEV catalog on 2024-11-18. CISA lists known use in ransomware campaigns.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-11-18: CVE-2024-0012 published (source)
2024-11-18: CVE-2024-9474 published (source)
2024-11-18: CISA added CVE-2024-0012 to the KEV catalog (federal deadline 2024-12-09) (source)

CVEs: CVE-2024-0012, CVE-2024-9474

[high] Cisco ASA/FTD zero-days used in the ArcaneDoor espionage campaign

Wed, 24 Apr 2024 00:00:00 GMT

Cisco Talos disclosed ArcaneDoor, a state-sponsored campaign against perimeter devices that exploited two Cisco Adaptive Security Appliance and Firepower Threat Defense zero-days: a denial of service (CVE-2024-20353) and a persistent local code execution bug (CVE-2024-20359), used to plant the Line Dancer and Line Runner implants. Added to the CISA KEV catalog on 2024-04-24.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-04-24: CVE-2024-20353 published (source)
2024-04-24: CVE-2024-20359 published (source)
2024-04-24: CISA added CVE-2024-20353 to the KEV catalog (federal deadline 2024-05-01) (source)

CVEs: CVE-2024-20353, CVE-2024-20359

[critical] Palo Alto PAN-OS GlobalProtect zero-day (CVE-2024-3400)

Fri, 12 Apr 2024 00:00:00 GMT

A command injection in the GlobalProtect feature of PAN-OS let unauthenticated attackers run code as root on Palo Alto firewalls (CVSS 10). Volexity caught an actor it tracks as UTA0218, assessed as likely state-backed, exploiting it as a zero-day, and Palo Alto's Unit 42 tracked the activity as Operation MidnightEclipse. Hotfixes shipped from mid-April 2024. Added to the CISA KEV catalog on 2024-04-12. CISA lists known use in ransomware campaigns.

Status: closed · Patch: patched · Fixed in: Hotfix releases per the Palo Alto advisory, e.g. 10.2.9-h1, 11.0.4-h1, 11.1.2-h3

Latest updates:

2024-04-12: CVE-2024-3400 published (source)
2024-04-12: CISA added CVE-2024-3400 to the KEV catalog (federal deadline 2024-04-19) (source)
2024-04-12: Palo Alto publishes the advisory; Volexity and Unit 42 publish exploitation details (source)

CVEs: CVE-2024-3400