The US National Security Agency (NSA) has published a new cybersecurity advisory in which it details 25 of the most dangerous vulnerabilities actively being exploited in the wild by Chinese state-sponsored hackers and other cybercriminals.
Unlike zero-day vulnerabilities where hardware and software makers have yet to release a patch, all of the vulnerabilities in the NSA's advisory are well-known and patches have been made available to download from their vendors. However, the problem lies in the fact that organizations have yet to patch their systems, leaving them vulnerable to potential exploits and attacks.
The NSA provided further details on the nature of the vulnerabilities in its advisory while urging organizations to patch them immediately, saying:
- We've put together a list of the best antivirus software around
- Keep your applications up to date with the best patch management software
- Also check out our roundup of the best secure router
“Most of the vulnerabilities listed below can be exploited to gain initial access to victim networks using products that are directly accessible from the Internet and act as gateways to internal networks. The majority of the products are either for remote access or for external web services, and should be prioritized for immediate patching.”
Publicly known vulnerabilities
In its cybersecurity advisory, the NSA provides detailed information on each of the 25 vulnerabilities as well guidance on how to mitigate them. In the interest of time, we'll just be looking at a few of the most severe vulnerabilities but the full list can be found here.
The first bug in the list, tracked as CVE-2019-11510, relates to Pulse Secure VPN servers and how an unauthenticated remote attacker can expose keys or passwords by sending a specially crafted URI to perform an arbitrary file reading vulnerability.
Another notable bug from the list, tracked as CVE-2020-5902, affects the Traffic Management User Interface (TMUI) of F5 BIG-IP proxies and load balancers and it is vulnerable to a Remote Code Execution (RCE) vulnerability that if exploited, could allow a remote attacker to take over an entire BIG-IP device.
The Citrix Application Delivery Controller (ADC) and Gateway systems are vulnerable to a directory traversal bug, tracked as CVE-2019-19781, that can lead to remote code execution where an attacker does not need to possess valid credentials for the device.
The advisory also mentions BlueKeep, SigRed, Netlogon, CurveBall and other more well-known vulnerabilities.
To avoid falling victim to any potential attacks exploiting these vulnerabilities, the NSA recommends that organizations keep their systems and products updated and patched as soon as possible after vendors release them.
- We've also highlighted the best endpoint protection software
Via ZDNet
