Threat Source Newsletter (May 13, 2021)
Summary: Microsoft's May 2021 Patch Tuesday disclosed 55 vulnerabilities, the fewest since January 2020, including a wormable remote code execution flaw in the HTTP protocol stack, CVE-2021-31166, with a CVSS score of 9.8 out of 10 that an unauthenticated attacker could exploit by sending a specially crafted packet to a targeted server. Cisco also patched three critical vulnerabilities across SD-WAN vManage and HyperFlex HX, the most serious being CVE-2021-1468 at 9.8, which could let an attacker call privileged actions and create new administrative-level accounts.
What's compelling: A 9.8 wormable flaw in the HTTP stack means an unpatched server can be compromised by a single crafted packet, and Microsoft itself recommends prioritizing patching of affected servers.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2021-1468CVE-2021-31166
- Related
- CVE-2021-31166: Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Apr 06, 2022