Blahalla

Ukrainian Cops Spoofed in Fileless Phishing Attacks on Kyiv

www.darkreading.com · 10 months ago

Attackers impersonate the National Police of Ukraine to deploy Amatera Stealer and PureMiner, using malicious Scalable Vector Graphics to trick victims.

⚡ Weekly Recap: Cisco 0-Day, Record DDoS, LockBit 5.0, BMC Bugs, ShadowV2 Botnet & More

thehackernews.com · 10 months ago

Cybersecurity never stops, and neither do hackers. While you wrapped up last week, new attacks were already underway. From hidden software bugs to massive DDoS attacks and new ransomware tricks, this week’s roundup gives you the biggest security moves to know. Whether you’re protecting key systems or locking down cloud apps, these are the updates you need before making your next security

The State of AI in the SOC 2025 - Insights from Recent Study

thehackernews.com · 10 months ago

Security leaders are embracing AI for triage, detection engineering, and threat hunting as alert volumes and burnout hit breaking points. A comprehensive survey of 282 security leaders at companies across industries reveals a stark reality facing modern Security Operations Centers: alert volumes have reached unsustainable levels, forcing teams to leave critical threats uninvestigated. You can

Abusing Notion’s AI Agent for Data Theft

www.schneier.com · 10 months ago

Notion just released version 3.0, complete with AI agents. Because the system contains Simon Willson’s lethal trifecta, it’s vulnerable to data theft though prompt injection. First, the trifecta: The lethal trifecta of capabilities is: Access to your private data, one of the most common purposes of tools in the first place! Exposure to untrusted content, any mechanism by which text (or images) controlled by a malicious attacker could become available to your LLM The ability to externally communicate in a way that could be used to steal your data (I often call this “exfiltration” but I’m not confident that term is widely understood.)

Microsoft Flags AI-Driven Phishing: LLM-Crafted SVG Files Outsmart Email Security

thehackernews.com · 10 months ago

Microsoft is calling attention to a new phishing campaign primarily aimed at U.S.-based organizations that has likely utilized code generated using large language models (LLMs) to obfuscate payloads and evade security defenses. "Appearing to be aided by a large language model (LLM), the activity obfuscated its behavior within an SVG file, leveraging business terminology and a synthetic structure

First Malicious MCP Server Found Stealing Emails in Rogue Postmark-MCP Package

thehackernews.com · 10 months ago

Cybersecurity researchers have discovered what has been described as the first-ever instance of a malicious Model Context Protocol (MCP) server spotted in the wild, raising software supply chain risks. According to Koi Security, a legitimate-looking developer managed to slip in rogue code within an npm package called "postmark-mcp" that copied an official Postmark Labs library of the same name.

China-Linked PlugX and Bookworm Malware Attacks Target Asian Telecom and ASEAN Networks

thehackernews.com · 10 months ago

Telecommunications and manufacturing sectors in Central and South Asian countries have emerged as the target of an ongoing campaign distributing a new variant of a known malware called PlugX (aka Korplug or SOGU). "The new variant's features overlap with both the RainyDay and Turian backdoors, including abuse of the same legitimate applications for DLL side-loading, the

Cisco Access Point Software Intermittent IPv6 Gateway Change Vulnerability

sec.cloudapps.cisco.com · 10 months ago

A vulnerability in the IPv6 Router Advertisement (RA) packet processing of Cisco Access Point Software could allow an unauthenticated, adjacent attacker to modify the IPv6 gateway on an affected device. This vulnerability is due to a logic error in the processing of IPv6 RA packets that are received from wireless clients. An attacker could exploit this vulnerability by associating to a wireless network and sending a series of crafted IPv6 RA packets. A successful exploit could allow the attacker to temporarily change the IPv6 gateway of an affected device. This could also lead to intermittent packet loss for any wireless clients that are associated with the affected device. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ap-ipv6-gw-tUAzpn9O <br/Security Impact Rating: Medium <br/CVE: CVE-2025-20365

Cisco IOS XE Software Web Authentication Reflected Cross-Site Scripting Vulnerability

sec.cloudapps.cisco.com · 10 months ago

A vulnerability in the Web Authentication feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting attack (XSS) on an affected device. This vulnerability is due to improper sanitization of user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a malicious link. A successful exploit could allow the attacker to execute a reflected XSS attack and steal user cookies from the affected device. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-xss-VWyDgjOU This advisory is part of the September 2025 release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: September 2025 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication. <br/Security Impact Rating: Medium <br/CVE: CVE-2025-20240

Friday Squid Blogging: Jigging for Squid

www.schneier.com · 10 months ago

A nice story.

Threat Insights: Active Exploitation of Cisco ASA Zero Days

unit42.paloaltonetworks.com · 10 months ago

CVE-2025-20333, CVE-2025-20362 and CVE-2025-20363 affect multiple Cisco products, and are being exploited by a threat actor linked to the ArcaneDoor campaign.

Volvo Employee SSNs Stolen in Supplier Ransomware Attack

www.darkreading.com · 10 months ago

Three international vehicle manufacturers have fallen to supply chain cyberattacks in the past month alone.

Executive Order Brings US TikTok $14B Deal One Step Closer to Finalizing

www.techrepublic.com · 10 months ago

Oracle’s oversight of an American version of TikTok will allow the app to comply with a 2024 act.

The Phantom Extension: Backdooring chrome through uncharted pathways

www.reddit.com · 10 months ago

A malicious Chrome extension named Phantom was discovered to be backdooring the browser. This extension poses a significant threat by actively stealing user credentials. Specifically, it harvests sensitive information such as saved passwords and various login details. Users are advised to remove this dangerous extension immediately to secure their browsing activity.

Supply-Chain Guardrails for npm, pnpm, and Yarn

www.reddit.com · 10 months ago

Supply chain security guardrails are essential for package managers including npm, pnpm, and yarn. Organizations must implement protections against dependency confusion and other forms of supply chain compromise. Best practices recommend strict version pinning and thorough vetting of all third-party dependencies used in development.

Researchers Expose Phishing Threats Distributing CountLoader and PureRAT

thehackernews.com · 10 months ago

A new campaign has been observed impersonating Ukrainian government agencies in phishing attacks to deliver CountLoader, which is then used to drop Amatera Stealer and PureMiner. "The phishing emails contain malicious Scalable Vector Graphics (SVG) files designed to trick recipients into opening harmful attachments," Fortinet FortiGuard Labs researcher Yurren Wan said in a report shared with The

Apple’s Feedback to EU Commission: Repeal Digital Markets Act

www.techrepublic.com · 10 months ago

The EU will have to wait to get Live Translation and other features as Apple works on complying with the Digital Markets Act regulation.

Iranian State Hackers Use SSL.com Certificates to Sign Malware

www.darkreading.com · 10 months ago

Security researchers say multiple threat groups, including Iran's Charming Kitten APT offshoot Subtle Snail, are deploying malware with code-signing certificates from the Houston-based company.

Kicking off Cybersecurity Awareness Month 2025: Researcher spotlights and enhanced incentives

github.blog · 10 months ago

For this year’s Cybersecurity Awareness Month, GitHub’s Bug Bounty team is excited to offer some additional incentives to security researchers!

Prep is Underway, But 2026 FIFA World Cup Poses Significant Cyber Challenges

www.darkreading.com · 10 months ago

The world's most-popular sports contest starts in June 2026 across 16 venues in three countries: Securing the event infrastructure from cyber threats will require massive collaboration.

New COLDRIVER Malware Campaign Joins BO Team and Bearlyfy in Russia-Focused Cyberattacks

thehackernews.com · 10 months ago

The Russian advanced persistent threat (APT) group known as COLDRIVER has been attributed to a fresh round of ClickFix-style attacks designed to deliver two new "lightweight" malware families tracked as BAITSWITCH and SIMPLEFIX. Zscaler ThreatLabz, which detected the new multi-stage ClickFix campaign earlier this month, described BAITSWITCH as a downloader that ultimately drops SIMPLEFIX, a

Crash Tests for Security: Why BAS Is Proof of Defense, Not Assumptions

thehackernews.com · 10 months ago

Car makers don’t trust blueprints. They smash prototypes into walls. Again and again. In controlled conditions. Because design specs don’t prove survival. Crash tests do. They separate theory from reality. Cybersecurity is no different. Dashboards overflow with “critical” exposure alerts. Compliance reports tick every box. But none of that proves what matters most to a CISO: The

Digital Threat Modeling Under Authoritarianism

www.schneier.com · 10 months ago

Today’s world requires us to make complex and nuanced decisions about our digital security. Evaluating when to use a secure messaging app like Signal or WhatsApp, which passwords to store on your smartphone, or what to share on social media requires us to assess risks and make judgments accordingly. Arriving at any conclusion is an exercise in threat modeling. In security, threat modeling is the process of determining what security measures make sense in your particular situation. It’s a way to think about potential risks, possible defenses, and the costs of both. It’s how experts avoid being distracted by irrelevant risks or overburdened by undue costs

HeartCrypt’s wholesale impersonation effort

news.sophos.com · 10 months ago

How the notorious Packer-as-a-Service operation built itself into a hydra

Proofpoint Exec: ‘Phishing is the Leading Cause of Breaches Globally’

www.techrepublic.com · 10 months ago

During Proofpoint Protect 2025, company leaders detailed how AI is being used in phishing trends and in cyber-defense tactics.

Fortra GoAnywhere CVSS 10 Flaw Exploited as 0-Day a Week Before Public Disclosure

thehackernews.com · 10 months ago

Cybersecurity company watchTowr Labs has disclosed that it has "credible evidence" of active exploitation of the recently disclosed security flaw in Fortra GoAnywhere Managed File Transfer (MFT) software as early as September 10, 2025, a whole week before it was publicly disclosed. "This is not 'just' a CVSS 10.0 flaw in a solution long favored by APT groups and ransomware operators, it is a

New macOS XCSSET Variant Targets Firefox with Clipper and Persistence Module

thehackernews.com · 10 months ago

Cybersecurity researchers have discovered an updated version of a known Apple macOS malware called XCSSET that has been observed in limited attacks. "This new variant of XCSSET brings key changes related to browser targeting, clipboard hijacking, and persistence mechanisms," the Microsoft Threat Intelligence team said in a Thursday report. "It employs sophisticated encryption and obfuscation

Starmer to unveil digital ID cards in plan set to ignite civil liberties row

www.theguardian.com · 10 months ago

‘Brit card’ already facing opposition from privacy campaigners as government looks for ways to tackle illegal immigration All working adults will need digital ID cards under plans to be announced by Keir Starmer, in a move that will spark a battle with civil liberties campaigners. The prime minister will set out the measures on Friday at a conference on how progressive politicians can tackle the problems facing the UK, including addressing voter concerns around immigration. Continue reading

It Is Bad (Exploitation of Fortra GoAnywhere MFT CVE-2025-10035) - Part 2 - watchTowr Labs

www.reddit.com · 10 months ago

A vulnerability has been disclosed concerning Fortra GoAnywhere MFT. Exploitation of this flaw could allow unauthorized access to the system. Users are advised to apply necessary patches immediately to mitigate the risk.

Cisco's Wave of Actively Exploited Zero-Day Bugs Targets Firewalls, IOS

www.darkreading.com · 10 months ago

Patch now: Cisco recently disclosed four actively exploited zero-days affecting millions of devices, including three targeted by a nation-state actor previously discovered to be behind the "ArcaneDoor" campaign.

Chinese APT Drops 'Brickstorm' Backdoors on Edge Devices

www.darkreading.com · 10 months ago

The China-linked cyber-espionage group UNC5221 is compromising network appliances that cannot run traditional EDR agents to deploy new versions of the "Brickstorm" backdoor.

Hackers reportedly steal pictures of 8,000 children from Kido nursery chain

www.theguardian.com · 10 months ago

Firm, which has 18 sites around London and more in US, India and China, has received ransom demand, say reports The names, pictures and addresses of about 8,000 children have reportedly been stolen from the Kido nursery chain by a gang of cybercriminals. The criminals have demanded a ransom from the company, which has 18 sites around London, with more in the US, India and China, according to the BBC. Continue reading

Digital ID cards: a versatile and useful tool or a worrying cybersecurity risk?

www.theguardian.com · 10 months ago

As Keir Starmer aims to revive ID card system first proposed by Tony Blair, we look at the arguments for and against It is 21 years since Tony Blair’s government made proposals for an ID card system to tackle illegal working and immigration, and to make it more convenient for the public to access services. The same issues are on the agenda again as Keir Starmer revives what became one of New Labour’s most controversial policies. He is about to find out if he can defeat the argument that David Cameron’s Conservatives made before scrapping it. They said the ID card approach to personal privacy was “the worst of all worlds, intrusive, ineffective and enormously expensive”. Continue reading

Salesforce AI Agents Forced to Leak Sensitive Data

www.darkreading.com · 10 months ago

Yet again researchers have uncovered an opportunity (dubbed "ForcedLeak" for indirect prompt injection against autonomous agents lacking sufficient security controls, but this time the risk involves PII, corporate secrets, physical location data, and so much more.

Introducing Microsoft Marketplace — Thousands of solutions. Millions of customers. One Marketplace.

blogs.microsoft.com · 10 months ago

To empower customers in becoming Frontier, we’re excited to announce the launch of the reimagined Microsoft Marketplace, your trusted source for cloud solutions, AI apps and agents.

XCSSET evolves again: Analyzing the latest updates to XCSSET’s inventory

www.microsoft.com · 10 months ago

Microsoft Threat Intelligence has uncovered a new variant of the XCSSET malware, which is designed to infect Xcode projects, typically used by software developers building Apple or macOS-related applications.

How Cloud Service Disruptions Are Making Resilience Critical for Developers

www.darkreading.com · 10 months ago

Outages affecting DevOps tools threaten to leave developers coding like it's 1999. How serious is the threat, and what can companies do?

Malicious-Looking URL Creation Service

www.schneier.com · 10 months ago

This site turns your URL into something sketchy-looking. For example, www.schneier.com becomes https://cheap-bitcoin.online/firewall-snatcher/cipher-injector/phishingsniffertool.html?form=inject&host=spoof&id=bb1bc121¶meter=inject&payload=%28function%28%29%7B+return+%27+hi+%27.trim%28%29%3B+%7D%29%28%29%3B&port=spoof. Found on Boing Boing.

Hacking Furbo - A Hardware Research Project – Part 5: Exploiting BLE

www.reddit.com · 10 months ago

Researchers detailed a project involving the exploitation of the Furbo pet camera. The investigation revealed several hardware vulnerabilities and methods for bypassing the device's internal security measures. The project utilized research techniques to analyze the communication protocols used by the system. This research serves as an educational example of embedded system penetration testing.

Why “contained” doesn’t mean “safe” in modern SOCs

www.reddit.com · 10 months ago

Containment strategies are often insufficient for guaranteeing security in modern Security Operations Centers. Threats frequently bypass isolated network segments by exploiting architectural blind spots. Organizations must transition away from perimeter-based defenses toward a rigorous zero trust model. This shift requires continuous monitoring and threat hunting across all digital assets to maintain comprehensive protection.

Smashing Security podcast #436: The €600,000 gold heist, powered by ransomware

grahamcluley.com · 10 months ago

Ransomware doesn’t just freeze computers - it can silence alarms too. And when the Natural History Museum in Paris went dark, thieves helped themselves to €600,000 worth of gold in a daring late-night heist. Meanwhile, developers have a new headache: a worm dubbed “Shai Hulud” has wriggled its way through more than 180 npm packages, quietly stealing secrets. But it’s not all doom and gloom - unless you count your kitchen appliances turning into ad billboards. All this and more is discussed in episode 436 of the award-winning "Smashing Security" podcast with cybersecurity veteran Graham Cluley, and his special guest Zoë Rose.

Cisco IOS XE Software on Cisco Catalyst 9500X and 9600X Series Switches Virtual Interface Access Control List Bypass Vulnerability

sec.cloudapps.cisco.com · 10 months ago

A vulnerability in the access control list (ACL) programming of Cisco IOS XE Software for Cisco Catalyst 9500X and 9600X Series Switches could allow an unauthenticated, remote attacker to bypass a configured ACL on an affected device. This vulnerability is due to the flooding of traffic from an unlearned MAC address on a switch virtual interface (SVI) that has an egress ACL applied. An attacker could exploit this vulnerability by causing the VLAN to flush its MAC address table. This condition can also occur if the MAC address table is full. A successful exploit could allow the attacker to bypass an egress ACL on an affected device. Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cat9k-acl-L4K7VXgD This advisory is part of the September 2025 release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: September 2025 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication. <br/Security Impact Rating: Medium <br/CVE: CVE-2025-20316

Cisco IOS Software Industrial Ethernet Switch Device Manager Denial of Service Vulnerability

sec.cloudapps.cisco.com · 10 months ago

A vulnerability in the web UI of Cisco IOS Software could allow an authenticated, remote attacker with low privileges to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper input validation. An attacker could exploit this vulnerability by sending a crafted URL in an HTTP request. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. There is a mitigation that addresses this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-invalid-url-dos-Nvxszf6u This advisory is part of the September 2025 release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: September 2025 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication. <br/Security Impact Rating: High <br/CVE: CVE-2025-20327

Cisco IOS XE Software for Catalyst 9800 Series Wireless Controller for Cloud Unauthenticated Access to Certificate Enrollment Service Vulnerability

sec.cloudapps.cisco.com · 10 months ago

A vulnerability in the Day One setup process of Cisco IOS XE Software for Catalyst 9800 Series Wireless Controllers for Cloud (9800-CL) could allow an unauthenticated, remote attacker to access the public-key infrastructure (PKI) server that is running on an affected device. This vulnerability is due to incomplete cleanup upon completion of the Day One setup process. An attacker could exploit this vulnerability by sending Simple Certificate Enrollment Protocol (SCEP) requests to an affected device. A successful exploit could allow the attacker to request a certificate from the virtual wireless controller and then use the acquired certificate to join an attacker-controlled device to the virtual wireless controller. Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-9800cl-openscep-SB4xtxzP This advisory is part of the September 2025 release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: September 2025 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication. <br/Security Impact Rating: Medium <br/CVE: CVE-2025-20293

Cisco Wireless Access Point Software Device Analytics Action Frame Injection Vulnerability

sec.cloudapps.cisco.com · 10 months ago

A vulnerability in the Device Analytics action frame processing of Cisco Wireless Access Point (AP) Software could allow an unauthenticated, adjacent attacker to inject wireless 802.11 action frames with arbitrary information. This vulnerability is due to insufficient verification checks of incoming 802.11 action frames. An attacker could exploit this vulnerability by sending 802.11 Device Analytics action frames with arbitrary parameters. A successful exploit could allow the attacker to inject Device Analytics action frames with arbitrary information, which could modify the Device Analytics data of valid wireless clients that are connected to the same wireless controller. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-action-frame-inj-QqCNcz8H <br/Security Impact Rating: Medium <br/CVE: CVE-2025-20364

Cisco IOS XE Software Network-Based Application Recognition Denial of Service Vulnerability

sec.cloudapps.cisco.com · 10 months ago

A vulnerability in the Network-Based Application Recognition (NBAR) feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, causing a denial of service (DoS) condition. This vulnerability is due to improper handling of malformed Control and Provisioning of Wireless Access Points (CAPWAP) packets. An attacker could exploit this vulnerability by sending malformed CAPWAP packets through an affected device. A successful exploit could allow the attacker to cause the device to reload unexpectedly, resulting in a DoS condition. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. However, there is a mitigation. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nbar-dos-LAvwTmeT This advisory is part of the September 2025 release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: September 2025 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication. <br/Security Impact Rating: High <br/CVE: CVE-2025-20315

Cisco IOS XE Software HTTP API Command Injection Vulnerability

sec.cloudapps.cisco.com · 10 months ago

A vulnerability in the HTTP API subsystem of Cisco IOS XE Software could allow a remote attacker to inject commands that will execute with root privileges into the underlying operating system. This vulnerability is due to insufficient input validation. An attacker with administrative privileges could exploit this vulnerability by authenticating to an affected system and performing an API call with crafted input. Alternatively, an unauthenticated attacker could persuade a legitimate user with administrative privileges who is currently logged in to the system to click a crafted link. A successful exploit could allow the attacker to execute arbitrary commands as the root user. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xe-cmd-inject-rPJM8BGL This advisory is part of the September 2025 release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: September 2025 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication. <br/Security Impact Rating: High <br/CVE: CVE-2025-20334

Cisco IOS and IOS XE Software CLI Denial of Service Vulnerability

sec.cloudapps.cisco.com · 10 months ago

A vulnerability in the CLI of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to a buffer overflow. An attacker with a low-privileged account could exploit this vulnerability by using crafted commands at the CLI prompt. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-cli-EB7cZ6yO This advisory is part of the September 2025 release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: September 2025 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication. <br/Security Impact Rating: Medium <br/CVE: CVE-2025-20149

Cisco IOS XE Software CLI Argument Injection Vulnerability

sec.cloudapps.cisco.com · 10 months ago

A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with administrative privileges to execute arbitrary commands as root on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of user arguments that are passed to specific CLI commands. An attacker could exploit this vulnerability by logging in to the device CLI with valid administrative (level 15) credentials and using crafted commands at the CLI prompt. A successful exploit could allow the attacker to execute arbitrary commands as root. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-arg-inject-EyDDbh4e This advisory is part of the September 2025 release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: September 2025 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication. <br/Security Impact Rating: Medium <br/CVE: CVE-2025-20338

Cisco SD-WAN vEdge Software Access Control List Bypass Vulnerability

sec.cloudapps.cisco.com · 10 months ago

A vulnerability in the access control list (ACL) processing of IPv4 packets of Cisco SD-WAN vEdge Software could allow an unauthenticated, remote attacker to bypass a configured ACL. This vulnerability is due to the improper enforcement of the implicit deny all at the end of a configured ACL. An attacker could exploit this vulnerability by attempting to send unauthorized traffic to an interface on an affected device. A successful exploit could allow the attacker to bypass an ACL on the affected device. Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-defaultacl-pSJk9nVF <br/Security Impact Rating: Medium <br/CVE: CVE-2025-20339