Picus-RedReport-2024
picussecurity.com · Undated · Licence: not cleared; local research copy only
CVEs this report names
9 CVEs- CVE-2023-3519Citrix NetScaler ADC and NetScaler Gateway Code Injection VulnerabilityCitrix · NetScaler ADC and NetScaler GatewayKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1574Hijack Execution Flow+2 more · 6 reports99.7%Top 0.05%89.9priority
- CVE-2022-42475Fortinet FortiOS Heap-Based Buffer Overflow VulnerabilityFortinet · FortiOSKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1574Hijack Execution Flow+2 more · 4 reports99.5%Top 0.06%88.8priority
- CVE-2022-47966Zoho ManageEngine Multiple Products Remote Code Execution VulnerabilityZoho · ManageEngineKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1136.001Local Account+1 more · 3 reports99.8%Top 0.04%87.6priority
- CVE-2017-9841PHPUnit Command Injection VulnerabilityPHPUnit · PHPUnitKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter1 report>99.9%Top 0.01%73.7priority
- CVE-2022-39952A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7…Fortinet · FortiNACPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter1 report99.8%Top 0.04%73.3priority
- CVE-2021-32648October CMS Improper AuthenticationOctober CMS · October CMSKEVPublic exploitCritical · 9.1T1190Exploit Public-Facing ApplicationT1078Valid Accounts1 report90.4%Top 0.2%73.2priority
- CVE-2023-48795The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows…93.5%Top 0.16%70.8priority
- CVE-2023-7102Remote Code Execution (RCE) VulnerabilityBarracuda Networks Inc. · Barracuda ESG AppliancePublic exploit1 report44.6%Top 1.2%65.0priority
- CVE-2023-35829An issue was discovered in the Linux kernel before 6.3.21 report0.4%Top 63%12.3priority
Where it names them
CVE-2023-3519 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
In a notable instance involving the exploitation of Citrix CVE-2023-3519, detailed in CISA's
“Threat Actors Exploiting Citrix CVE-2023-3519
cve-2023-3519_to_implant_webshells.pdf
CVE-2022-42475 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
vulnerabilities CVE-2022-47966 and CVE-2022-42475.
“Multiple Nation-State Threat Actors Exploit CVE-2022-47966 and CVE-2022-42475,”
CVE-2022-47966 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
vulnerabilities CVE-2022-47966 and CVE-2022-42475.
“Multiple Nation-State Threat Actors Exploit CVE-2022-47966 and CVE-2022-42475,”
CVE-2017-9841 Original (opens in a new tab) ↗
vulnerability (identified as CVE-2017-9841) allowed attackers to open a reverse shell on port
CVE-2022-39952 Original (opens in a new tab) ↗
For instance, the vulnerability CVE-2022-39952 in Fortinet's FortiNAC is exploited using
CVE-2021-32648 Original (opens in a new tab) ↗
https://unit42.paloaltonetworks.com/ukraine-cyber-conflict-cve-2021-32648-whispergate/
CVE-2023-48795 Original (opens in a new tab) ↗
CVE-2023-48795 vulnerability allows adversaries to launch a prefix truncation attack against
CVE-2023-7102 Original (opens in a new tab) ↗
devices to exploit the CVE-2023-7102 vulnerability.
CVE-2023-35829 Original (opens in a new tab) ↗
This fake PoC masquerades as a high-severity use-after-free exploit (CVE-2023-35829)
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.