CISA Sets a Deadline – Patch Juniper Junos OS Vulnerabilities Before November 17

The U.S. Cybersecurity and Infrastructure Security Company (CISA) has offered a November 17, 2023, deadline for federal businesses and corporations to use mitigations to secure in opposition to a quantity of security flaws in Juniper Junos OS that came to light-weight in August.

The agency on Monday additional 5 vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog, based mostly on proof of lively exploitation –

• CVE-2023-36844 (CVSS rating: 5.3) – Juniper Junos OS EX Collection PHP External Variable Modification Vulnerability
• CVE-2023-36845 (CVSS rating: 5.3) – Juniper Junos OS EX Series and SRX Sequence PHP Exterior Variable Modification Vulnerability
• CVE-2023-36846 (CVSS rating: 5.3) – Juniper Junos OS SRX Series Missing Authentication for Critical Perform Vulnerability
• CVE-2023-36847 (CVSS score: 5.3) – Juniper Junos OS EX Collection Lacking Authentication for Critical Perform Vulnerability
• CVE-2023-36851 (CVSS score: 5.3) – Juniper Junos OS SRX Collection Lacking Authentication for Critical Function Vulnerability

The vulnerabilities, for each Juniper, could be fashioned into an exploit chain to accomplish distant code execution on unpatched products. Also extra to the record is CVE-2023-36851, which has been described as a variant of the SRX add flaw.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

Juniper, in an update to its advisory on November 8, 2023, explained it can be “now aware of productive exploitation of these vulnerabilities,” recommending that prospects update to the most recent versions with instant influence.

The information encompassing the nature of the exploitation are presently mysterious.

In a independent warn, CISA has also warned that the Royal ransomware gang may possibly rebrand as BlackSuit owing to the point that the latter shares a “range of identified coding qualities similar to Royal.”

The progress will come as Cyfirma disclosed that exploits for critical vulnerabilities are currently being provided for sale on darknet message boards and Telegram channels.

“These vulnerabilities encompass elevation of privilege, authentication bypass, SQL injection, and distant code execution, posing significant security hazards,” the cybersecurity business mentioned, incorporating, “ransomware teams are actively searching for zero-working day vulnerabilities in underground community forums to compromise a big number of victims.”

It also follows revelations from Huntress that threat actors are targeting multiple healthcare corporations by abusing the commonly-utilised ScreenConnect distant obtain device used by Transaction Information Systems, a pharmacy administration program service provider, for initial entry.

“The threat actor proceeded to acquire several techniques, like setting up added remote accessibility instruments these types of as ScreenConnect or AnyDesk circumstances, to ensure persistent obtain to the environments,” Huntress mentioned.

Found this report fascinating? Stick to us on Twitter  and LinkedIn to read through additional exclusive information we write-up.