U.S. Cybersecurity Agency CISA Adds Three New Vulnerabilities in KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday included a few security flaws to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of lively exploitation.

The record of shortcomings is as follows –

• CVE-2022-47986 (CVSS rating: 9.8) – IBM Aspera Faspex Code Execution Vulnerability
• CVE-2022-41223 (CVSS rating: 6.8) – Mitel MiVoice Join Code Injection Vulnerability
• CVE-2022-40765 (CVSS rating: 6.8) – Mitel MiVoice Join Command Injection Vulnerability

CVE-2022-47986 is described as a YAML deserialization flaw in the file transfer remedy that could allow for a distant attacker to execute code on the system.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

Specifics of the flaw and a evidence-of-idea (PoC) ended up shared by Assetnote on February 2, a working day following which the Shadowserver Foundation said it “picked up exploitation attempts” in the wild.

The lively exploitation of the Aspera Faspex flaw arrives soon just after a vulnerability in Fortra’s GoAnywhere MFT-managed file transfer software package (CVE-2023-0669) was abused by danger actors with likely one-way links to the Clop ransomware procedure.

CISA also added two flaws impacting Mitel MiVoice Join (CVE-2022-41223 and CVE-2022-40765) that could allow an authenticated attacker with internal network access to execute arbitrary code.

Precise specifics surrounding the character of the attacks are unclear. The vulnerabilities were being patched by Mitel in October 2022.

In mild of in-the-wild exploitation, Federal Civilian Govt Branch (FCEB) agencies are required to apply the needed updates by March 14, 2023, to protected networks against prospective threats.

CISA, in a similar enhancement, also produced an Industrial Handle Programs (ICS) advisory that relates to critical flaws (CVE-2022-26377 and CVE-2022-31813) in Mitsubishi Electric’s MELSOFT iQ AppPortal.

“Prosperous exploitation of these vulnerabilities could enable a destructive attacker to make unidentified impacts this kind of as authentication bypass, information disclosure, denial-of-assistance, or bypass IP tackle authentication,” the company reported.

Located this write-up interesting? Adhere to us on Twitter  and LinkedIn to examine more exclusive articles we submit.