U.S. Cybersecurity Agency CISA Adds Three New Vulnerabilities in KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday included a few security flaws to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of lively exploitation.

The record of shortcomings is as follows –

• CVE-2022-47986 (CVSS rating: 9.8) – IBM Aspera Faspex Code Execution Vulnerability
• CVE-2022-41223 (CVSS rating: 6.8) – Mitel MiVoice Join Code Injection Vulnerability
• CVE-2022-40765 (CVSS rating: 6.8) – Mitel MiVoice Join Command Injection Vulnerability

CVE-2022-47986 is described as a YAML deserialization flaw in the file transfer remedy that could allow for a distant attacker to execute code on the system.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

Specifics of the flaw and a evidence-of-idea (PoC) ended up shared by Assetnote on February 2, a working day following which the Shadowserver Foundation said it “picked up exploitation attempts” in the wild.

The lively exploitation of the Aspera Faspex flaw arrives soon just after a vulnerability in Fortra’s GoAnywhere MFT-managed file transfer software package (CVE-2023-0669) was abused by danger actors with likely one-way links to the Clop ransomware procedure.

CISA also added two flaws impacting Mitel MiVoice Join (CVE-2022-41223 and CVE-2022-40765) that could allow an authenticated attacker with internal network access to execute arbitrary code.

Precise specifics surrounding the character of the attacks are unclear. The vulnerabilities were being patched by Mitel in October 2022.

In mild of in-the-wild exploitation, Federal Civilian Govt Branch (FCEB) agencies are required to apply the needed updates by March 14, 2023, to protected networks against prospective threats.

CISA, in a similar enhancement, also produced an Industrial Handle Programs (ICS) advisory that relates to critical flaws (CVE-2022-26377 and CVE-2022-31813) in Mitsubishi Electric’s MELSOFT iQ AppPortal.

“Prosperous exploitation of these vulnerabilities could enable a destructive attacker to make unidentified impacts this kind of as authentication bypass, information disclosure, denial-of-assistance, or bypass IP tackle authentication,” the company reported.

Located this write-up interesting? Adhere to us on Twitter  and LinkedIn to examine more exclusive articles we submit.