September 3, 2024 at 03:59PM Zyxel released security updates for a critical vulnerability affecting various business routers, allowing unauthenticated attackers to execute OS commands. The flaw, tracked as CVE-2024-7261, has a CVSS v3 score of 9.8. Additionally, multiple high-severity flaws in APT and USG FLEX firewalls were addressed through security updates. Detailed information is available … Read more
July 12, 2024 at 02:34PM CISA and the FBI issued a critical “Secure by Design Alert” urging software developers to address OS command-injection vulnerabilities. Recent exploits, such as the CVE-2024-20399 bug in Cisco’s NX-OS software, demonstrate the potential for system takeovers and data leaks. The agencies advocate for a secure-by-design approach and OPSEC principles to … Read more
July 11, 2024 at 07:42AM CISA and the FBI are calling for immediate action to address OS command injection vulnerabilities in network devices following recent intrusions. The agencies emphasize the need for businesses and device manufacturers to eliminate these vulnerabilities at the source. (46 words) Based on the meeting notes, the key takeaway is that … Read more
July 10, 2024 at 02:07PM CISA and FBI have jointly urged software companies to address OS command injection vulnerabilities in their products, following recent attacks by the Chinese state-sponsored threat actor, Velvet Ant. The advisory recommends implementing mitigations to prevent these vulnerabilities, such as separating user input from commands and conducting rigorous product testing. CEOs … Read more
November 16, 2023 at 10:22AM Fortinet has warned customers about a critical OS command injection vulnerability in its FortiSIEM report server. The flaw can be exploited by remote, unauthenticated attackers to execute unauthorized commands through specially crafted API requests. The vulnerability, tracked as CVE-2023-36553, is a variant of a previous vulnerability (CVE-2023-34992). Fortinet advises affected … Read more