Centreon to Exim and Back: On the Trail of Sandworm

domaintools.com · Undated · Licence: not cleared; local research copy only

CVEs this report names

2 CVEs

CVE-2019-10149Exim Mail Transfer Agent (MTA) Improper Input Validation
Exim · Mail Transfer Agent (MTA)KEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter3 reports
>99.9%Top 0.02%
77.6priority
CVE-2014-3828Multiple SQL injection vulnerabilities in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web…
Public exploitT1190Exploit Public-Facing Application T1059Command and Scripting Interpreter1 report
72.7%Top 0.56%
28.8priority

Where it names them

CVE-2019-10149

The vulnerability linked to Sandworm activity, CVE-2019-10149, can allow for Remote Code Execution (RCE) on the vulnerable host depending on Exim’s configuration and if it is remotely accessible.

Original ↗

CVE-2014-3828

DomainTools cannot make a definitive determination, based on these details it appears that the intruder likely used a vulnerability such as CVE-2014-3828, a SQL injection vulnerability in Centreon patched in version 2.5.3, to write data to the vulnerable system (such as a webshell) which could facilitate

Original ↗

Techniques drawn from this report

None

No passage in this report has been tied to an ATT&CK technique.