Malicious Tag Roundup (October 2021) | Cybersecurity Blog | Grey Noise

Summary: GreyNoise's October 1-29, 2021 tag roundup lists observed exploitation attempts against GitLab Community Edition (CVE-2021-22205), Apache Storm supervisor (CVE-2021-40865), Hikvision IP cameras and NVR firmware (CVE-2021-36260), SonicWall SMA100 (CVE-2021-20034) and SonicWall SSL-VPN, D-Link DIR-825 R1 (CVE-2020-29557) and DNS-320 (CVE-2020-25506), Micro Focus Operation Bridge Reporter (CVE-2021-22502), and Yealink Device Management Platform (CVE-2021-27561). The roundup also records attempts against a command injection flaw in legacy web servers tracked under CVE-2009-4487 through CVE-2009-4496, each tagged with malicious intent.
Bottom line: The list spans internet-facing cameras, VPN appliances, and device management platforms, so the exposed surface is not just servers but the edge hardware most organizations inventory least. A factory-reset flaw in SonicWall SMA100 and remote code execution in Hikvision firmware mean an unpatched appliance can be taken over or wiped by an attacker who never touches a user endpoint.

Read the original at GreyNoise Blog ↗

Topics: Detection & Response
Mentions: CVE-2009-4487 CVE-2009-4488 CVE-2009-4489 CVE-2009-4490 CVE-2009-4491 CVE-2009-4492 CVE-2009-4493 CVE-2009-4494 CVE-2009-4495 CVE-2009-4496 CVE-2020-25506 CVE-2020-29557 CVE-2021-20034 CVE-2021-22205 CVE-2021-22502 CVE-2021-36260 CVE-2021-40865
Related: New Mirai Variant Targeting Network Security Devices Cyber Risks ·
Threat Source newsletter (Oct. 7, 2021) Cyber Risks ·
CVE-2021-36260: Hikvision Improper Input Validation Known Exploited Vulnerabilities · Jan 10, 2022