US CISA added actively exploited Samsung and D-Link vulnerabilities to its Known Exploited Vulnerabilities catalog.
US Cybersecurity and Infrastructure Security Agency (CISA) added six Samsung and two D-Link vulnerabilities to its Known Exploited Vulnerabilities Catalog.
Below is the list of flaws added to the catalog:
- CVE-2019-17621 (CVSS score: 9.8) -D-Link DIR-859 Router Command Execution Vulnerability
- CVE-2019-20500 (CVSS score: 7.8) – D-Link DWL-2600AP Access Point Command Injection Vulnerability
- CVE-2021-25487 (CVSS score: 7.8) – Samsung Mobile Devices Out-of-Bounds Read Vulnerability
- CVE-2021-25489 (CVSS score: 5.5) – Samsung Mobile Devices Improper Input Validation Vulnerability
- CVE-2021-25394 (CVSS score: 6.4) – Samsung Mobile Devices Race Condition Vulnerability
- CVE-2021-25395 (CVSS score: 6.4) – Samsung Mobile Devices Race Condition Vulnerability
- CVE-2021-25371 (CVSS score: 6.7) – Samsung Mobile Devices Unspecified Vulnerability
- CVE-2021-25372 (CVSS score: 6.7) – Samsung Mobile Devices Improper Boundary Check Vulnerability
The CVE-2019-17621 flaw is a remote command execution flaw that resides in the code used to manage UPnP requests. The vulnerability could be exploited by an unauthenticated attacker to take control of vulnerable devices. The vulnerability could be only exploited by an attacker with access to the same local area network segment of the vulnerable device.
Since March 2023, Unit 42 researchers have observed a variant of the Mirai botnet spreading by targeting tens of flaws in D-Link, Zyxel, and Netgear devices. The botnet targets multiple vulnerabilities in popular IoT devices, including the above issues.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts recommend also private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix this flaw by July 20, 2023.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Ultimate Member plugin)
