Ethical Hacking News
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, which includes CVE-2024-1212, CVE-2024-0012, and CVE-2024-9474. These vulnerabilities pertain to the Progress Kemp LoadMaster, Palo Alto Networks PAN-OS, and Expedition software respectively, and pose significant security risks to organizations handling sensitive data or operating critical infrastructure. Organizations are advised to review the catalog and address these vulnerabilities by December 5, 2024.
CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. The three newly added vulnerabilities are CVE-2024-1212, CVE-2024-0012, and CVE-2024-9474. CVE-2024-1212 is a Progress Kemp LoadMaster operating system command injection vulnerability. CVE-2024-0012 is a Palo Alto Networks PAN-OS management interface authentication bypass vulnerability. CVE-2024-9474 is a Palo Alto Networks PAN-OS privilege escalation vulnerability. Federal agencies and organizations handling sensitive data must address these vulnerabilities by December 5, 2024.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recently added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, which is a repository of known exploited vulnerabilities that are deemed critical by the agency. The three vulnerabilities in question are CVE-2024-1212, CVE-2024-0012, and CVE-2024-9474, all of which pertain to the Progress Kemp LoadMaster, Palo Alto Networks PAN-OS, and Expedition software respectively.
CVE-2024-1212 is a vulnerability that affects the Progress Kemp LoadMaster software, specifically the operating system command injection vulnerability. This means that an attacker can exploit this vulnerability by injecting malicious commands into the software's OS, allowing them to execute arbitrary system commands with high privileges. This is a significant security risk as it could potentially lead to unauthorized access to sensitive data or disruption of critical systems.
CVE-2024-0012 is another vulnerability in the Palo Alto Networks PAN-OS software that affects the management interface authentication bypass vulnerability. An attacker with network access to the management web interface can exploit this vulnerability to bypass authentication and gain administrator privileges. This could lead to unauthorized modifications to system configurations or exploitation of other vulnerabilities.
The third vulnerability, CVE-2024-9474, is a privilege escalation vulnerability in Palo Alto Networks PAN-OS that allows an administrator with access to the management web interface to perform actions on the firewall with root privileges. This could potentially allow an attacker to escalate their privileges and gain control over critical systems.
According to the Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, federal agencies are required to address the identified vulnerabilities by December 5, 2024. Private organizations that handle sensitive data or operate critical infrastructure are also advised to review the catalog and address these vulnerabilities in their own systems.
Experts have emphasized the importance of addressing these vulnerabilities promptly, as they pose significant security risks. The U.S. CISA's efforts to maintain a list of known exploited vulnerabilities provide a valuable resource for organizations looking to protect themselves against emerging threats.
In conclusion, the recent addition of CVE-2024-1212, CVE-2024-0012, and CVE-2024-9474 to the KEV catalog highlights the importance of staying vigilant in addressing emerging security risks. Organizations that handle sensitive data or operate critical infrastructure must review the catalog and take necessary steps to address these vulnerabilities.
Related Information:
https://securityaffairs.com/171168/security/u-s-cisa-progress-kemp-loadmaster-palo-alto-networks-pan-os-and-expedition-bugs-known-exploited-vulnerabilities-catalog.html
https://www.cisa.gov/news-events/alerts/2024/11/18/cisa-adds-three-known-exploited-vulnerabilities-catalog
https://nvd.nist.gov/vuln/detail/CVE-2024-1212
https://www.cvedetails.com/cve/CVE-2024-1212/
https://nvd.nist.gov/vuln/detail/CVE-2024-0012
https://www.cvedetails.com/cve/CVE-2024-0012/
https://nvd.nist.gov/vuln/detail/CVE-2024-9474
https://www.cvedetails.com/cve/CVE-2024-9474/
Published: Tue Nov 19 04:02:22 2024 by llama3.2 3B Q4_K_M
