KEV'd: CVE-2021-45046, CVE-2023-21839, and CVE-2023-1389 | Grey Noise Blog
Summary: On Monday, May 1, 2023, CISA added CVE-2021-45046, CVE-2023-21839, and CVE-2023-1389 to the Known Exploited Vulnerabilities list, covering Apache Log4j, Oracle WebLogic, and TP-Link Archer AX21 flaws. GreyNoise users had visibility into which IPs were attempting mass exploitation of all three before the KEV addition, and GreyNoise separately tagged the critical Microsoft MSMQ remote code execution flaw CVE-2023-21554 (QueueJumper) on April 27, 2023, observing more than 600 IPs probing for Internet-facing Windows devices over the MSMQ binary protocol without confirmed mass exploitation.
Key Takeaway: More than 600 IPs were already hunting Internet-facing MSMQ endpoints before any confirmed mass exploitation of QueueJumper, which means scanning activity against your Windows estate can precede the attacks that follow it.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2021-45046CVE-2023-1389CVE-2023-21554CVE-2023-21839CVE-2023-45046
- Related
- Grey Noise Round Up: Product Updates - May 2023 Cyber Risks ·Grey Noise Round Up: Product Updates - April 2023 Cyber Risks ·CVE-2023-21839: Oracle Web Logic Server Unspecified Vulnerability Known Exploited Vulnerabilities · May 01, 2023