New SureMDM Vulnerabilities Could Expose Companies to Supply Chain Attacks

A variety of security vulnerabilities have been disclosed in 42 Gears’ SureMDM system administration remedy that could be weaponized by attackers to complete a provide chain compromise towards influenced organizations.

Cybersecurity organization Immersive Labs, in a technological produce-up detailing the results, stated that 42Gears introduced a collection of updates in between November 2021 and January 2022 to shut out multiple flaws influencing equally the platform’s Linux agent and the web console.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

The India-primarily based firm’s SureMDM is a cross-system cell device management support that makes it possible for enterprises to remotely keep an eye on, handle, and secure their fleet of business-owned devices and personnel-owned equipment. 42Gears claims that SureMDM is applied by over 10,000 corporations throughout the world.

The issues identified in the web dashboard are also of critical in character, perhaps permitting an attacker to acquire code execution about personal gadgets, desktops, or servers. On top of that, they could permit the injection of malicious JavaScript code as properly as make it achievable to sign up rogue gadgets and even spoof present equipment without the need of any authentication.

“By chaining the vulnerabilities affecting the web console jointly, an attacker could disable security tools and set up malware or other destructive code onto every single Linux, MacOS or Android system with SureMDM installed,” Kev Breen, Immersive Lab’s director of risk study, claimed. “An attacker does not want to know shopper facts to obtain this or even have an account on SureMDM.”

This could then perform out in the kind of a supply chain attack wherein the exploit could be executed when a consumer logs in to the SureMDM console, resulting in the compromise of each and every managed product in the corporation.

The second established of security weaknesses effect SureMDM’s Linux Agent up to and like 3..5 that could help an adversary to obtain distant code execution on the hosts as the root consumer. “This vulnerability could also be exploited with area entry to the influenced hosts in buy to escalate privileges from regular to root consumer,” Breen included.

Uncovered this write-up exciting? Abide by THN on Fb, Twitter  and LinkedIn to study a lot more exclusive articles we article.