Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System

cisa.gov · Undated · Licence: not cleared; local research copy only

CVEs this report names

6 CVEs

CVE-2024-21887Ivanti Connect Secure and Policy Secure Command Injection Vulnerability
Ivanti · Connect Secure and Policy SecureKEVRansomwarePublic exploitCritical · 9.1T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter+2 more · 4 reports
>99.9%Top 0.01%
88.4priority
CVE-2023-46805Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability
Ivanti · Connect Secure and Policy SecureKEVRansomwarePublic exploitHigh · 8.2T1190Exploit Public-Facing Application T1078Valid Accounts+2 more · 4 reports
>99.9%Top 0.02%
87.7priority
CVE-2024-3400Palo Alto Networks PAN-OS Command Injection Vulnerability
Palo Alto Networks · PAN-OSKEVRansomwarePublic exploitCritical · 10.0T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter3 reports
>99.9%Top 0.01%
87.7priority
CVE-2023-20198Cisco IOS XE Web UI Privilege Escalation Vulnerability
Cisco · IOS XE Web UIKEVPublic exploitCritical · 10.0T1190Exploit Public-Facing Application T1136Create Account2 reports
99.6%Top 0.05%
86.1priority
CVE-2018-0171Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability
Cisco · IOS and IOS XEKEVPublic exploitCritical · 9.8T1059Command and Scripting Interpreter T1210Exploitation of Remote Services+1 more · 2 reports
99.5%Top 0.06%
76.0priority
CVE-2023-20273Cisco IOS XE Web UI Command Injection Vulnerability
Cisco · Cisco IOS XE Web UIKEVPublic exploitHigh · 7.2T1078Valid Accounts T1059Command and Scripting Interpreter+1 more · 2 reports
92.9%Top 0.17%
74.1priority

Where it names them

CVE-2024-21887

CVE-2024-21887 - Ivanti Connect Secure and Ivanti Policy Secure web-component command injection vulnerability, commonly chained after CVE-2023-46805 (authentication bypass)

Original ↗

CVE-2024-21887

Original ↗

CVE-2023-46805

CVE-2024-21887 - Ivanti Connect Secure and Ivanti Policy Secure web-component command injection vulnerability, commonly chained after CVE-2023-46805 (authentication bypass)

Original ↗

Command injection vulnerability, commonly chained after CVE-2023-46805 (authentication bypass)

Original ↗

CVE-2024-3400

CVE-2024-3400 - Palo Alto Networks PAN-OS GlobalProtect arbitrary file creation leading to OS command injection.

Original ↗

CVE-2024-3400

Original ↗

CVE-2023-20198

CVE-2023-20273 - Cisco Internetworking Operating System (IOS) XE software web management user interface post-authentication command injection/privilege escalation (commonly chained with CVE-2023-20198 for initial access to achieve code execution as root) [T1068]

Original ↗

CVE-2023-20198 - Cisco IOS XE web user interface authentication bypass vulnerability

Original ↗

While exploiting CVE-2023-20198, the APT actors used the Web Services Management Agent (WSMA) endpoints /webui_wsma_Http or /webui_wsma_Https to bypass authentication and create unauthorized administrative accounts.

Original ↗

While exploiting CVE-2023-20198, the APT actors used the Web Services Management Agent (WSMA) endpoints /webui_wsma_Http or /webui_wsma_Https to bypass authentication and create unauthorized administrative accounts.

Original ↗

Enabling HTTP/HTTPS servers on Cisco devices affected by CVE-2023-20198.

Original ↗

CVE-2018-0171

CVE-2018-0171 - Cisco IOS and IOS XE smart install remote code execution vulnerability

Original ↗

CVE-2018-0171

Original ↗

CVE-2023-20273

CVE-2023-20273 - Cisco Internetworking Operating System (IOS) XE software web management user interface post-authentication command injection/privilege escalation (commonly chained with CVE-2023-20198 for initial access to achieve code execution as root) [T1068]

Original ↗

Exploit CVE-2023-20273 to gain root-level user privileges

Original ↗

CVE-2023-20273

Original ↗

Techniques drawn from this report

2 links, in kill-chain order

Privilege Escalation Exploitation for Privilege Escalation T1068 for CVE-2023-20273

MITRE CTID mapping of the KEV entry

CVE-2023-20273 - Cisco Internetworking Operating System (IOS) XE software web management user interface post-authentication command injection/privilege escalation (commonly chained with CVE-2023-20198 for initial access to achieve code execution as root) [T1068]

Original ↗

Privilege Escalation Exploitation for Privilege Escalation T1068 for CVE-2023-20198

ATT&CK ID cited in the report

CVE-2023-20273 - Cisco Internetworking Operating System (IOS) XE software web management user interface post-authentication command injection/privilege escalation (commonly chained with CVE-2023-20198 for initial access to achieve code execution as root) [T1068]

Original ↗