CISA Updates KEV Catalog: Major Vulnerabilities in Adobe ColdFusion & Windows Kernel

Once again, the Cybersecurity and Infrastructure Security Agency (CISA) takes charge in bolstering U.S. network defenses by updating its Known Exploited Vulnerabilities (KEV) Catalog. On December 16, 2024, CISA announced the addition of two serious vulnerabilities to its ongoing database of actively exploited CVEs. Think of this catalog as a living "Cyber Threat Most Wanted" list, calling out known security flaws that attackers are currently using to wreak havoc.
These updates come with a strong advisory for federal agencies—and honestly, for everyone else too—to address these vulnerabilities posthaste. If you're using the affected systems, it’s time to sit up and listen. Let's unpack the technical details and why this update is important.

---

The Two Culprits: What Are They?​

1. CVE-2024-20767: Adobe ColdFusion Improper Access Control Vulnerability​

This vulnerability is tied to Adobe ColdFusion, a rapid web application development tool often used for backend services and websites. As the name suggests, the problem lies in improper access control. Essentially, this flaw could allow attackers to bypass assigned permissions, granting them unauthorized access to sensitive data or powerful admin functions.
Let’s break this down: access control is like having a bouncer at a club—only the invited guests are let in, and even regular patrons can’t get into the VIP section. Now imagine someone finds a way to walk past that bouncer and crash the VIP lounge without anyone stopping them. That’s what improper access control feels like in the cyber world. Disgruntled bouncers aside, this vulnerability could give bad actors a foothold into ColdFusion environments without proper authorization.
Threat Scope:

• Attackers exploiting this vulnerability can access restricted areas of your application and potentially escalate their privileges.

Mitigation Tip:

• Adobe has issued patches for ColdFusion regularly. Ensure your system is up to date with the latest security updates to address this root-level access control flaw.

---

2. CVE-2024-35250: Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference​

The second vulnerability listed affects the Windows Kernel-Mode Driver, a pivotal component of the Windows operating system that enables communication between hardware and software. The issue here revolves around "untrusted pointer dereference." If you’re not a low-level coding guru, this might sound like tech talk befitting an elite hacking group’s handbook—but let's demystify it.
Pointers in programming are like directions to a specific data location. If those pointers are corrupted or tampered with, as in this case, they can lead the system to execute unintended instructions, often causing your system to crash or, worse, execute the attacker's malicious code. In simpler terms, imagine Google Maps giving you instructions to drive into a stranger’s garage instead of your workplace. That's pointer dereference gone wrong.
Why It Matters:

• Kernel access is like opening the Pandora's Box for your operating system. Attackers armed with this exploit can crash your system unpredictably or even gain full control of it.

---

Why Should You Care?​

For organizations large and small, these vulnerabilities are more than just technical hiccups—they're red carpets laid out for cybercriminals.

• They're actively exploited. These aren't theoretical issues sitting idle in a vulnerability scanner—CISA has confirmed that these are currently being used in the wild by malicious actors.
• They impact widely used platforms. Windows' kernel-mode drivers are part of every Windows OS, and Adobe ColdFusion is popular in enterprise-level web applications. That’s a concerningly large threat surface.
• Collateral damage is real. If your systems are exposed, you could look at threats ranging from data exfiltration to unauthorized access, server downtimes, and regulatory penalties.

---

CISA's Role: What Is the KEV Catalog Anyway?​

For the uninitiated, the Known Exploited Vulnerabilities Catalog is an initiative under CISA’s Binding Operational Directive (BOD) 22-01. The directive mandates that all Federal Civilian Executive Branch (FCEB) agencies remediate cataloged vulnerabilities by set deadlines to fortify systems against emerging threats.
CISA's KEV Catalog isn't just a "federal thing." While the directive applies specifically to U.S. federal agencies, everyone—from private businesses to individual organizations—is strongly urged to follow suit. Why? Because the catalog includes vulnerabilities that pose a credible threat to all, making it a solid blueprint for improving overall cybersecurity hygiene.
Here’s why BOD 22-01 is a big deal:

• Deadlines enforce accountability: FCEB agencies must address listed vulnerabilities within strict deadlines, ensuring patch management isn't endlessly delayed.
• Focuses remediation efforts efficiently: With an overwhelming number of vulnerabilities reported daily, knowing which ones are actively exploited lets IT teams focus their energy on the most critical threats.

Although only FCEB agencies are required to comply, the guidance aligns well with globally regarded best practices. There's a reason CISA is encouraging everyone to adopt it.

---

So, What’s the Fix?​

If you suspect your systems may be affected by either CVE-2024-20767 or CVE-2024-35250, here’s a plan of action:

1. Understand Your Exposure:
   • For Adobe ColdFusion, check your version and whether it's in the scope of the affected systems. Update to the latest patched version as recommended by Adobe.
   • For Windows Users, ensure your system is updated with the most recent Patch Tuesday releases. These patches often address such kernel vulnerabilities.
2. Stay Informed:
   • Periodically review CISA’s KEV Catalog for new entries, especially if you're a systems admin or IT pro juggling vulnerability management with other tasks.
   • Sign up for alerts or RSS feeds from the catalog page to get notified in real time.
3. Build a Strong Vulnerability Management Plan:
   • Prioritize "actively exploited vulnerabilities" like these two. That means dedicating resources toward testing and applying fixes ASAP.
   • Use vulnerability scanning tools to regularly assess your environment, flagging any unpatched or out-of-date systems.
4. Adopt Zero Trust:
   • While patching vulnerabilities is a must, zero-trust architectures ensure that even if attackers exploit a bug, their lateral movement within your network is limited. They won’t have free reign over your kingdom.

---

Why CISA’s Updates Shouldn’t Go Ignored​

At the end of the day, national-scale cyber actions like KEV play a critical role in keeping systems safer for everyone. Today's two CVEs, while particularly dangerous, are just a drop in the bucket when you think about the sheer number of entries in that catalog. However, by addressing them proactively, you’re honing your systems against threats that have been proven dangerous in real-world scenarios.
Cybersecurity threats evolve faster than morning trends on TikTok, but addresses like CISA’s KEV Catalog help us stay one step ahead. If you’re serious about protecting your Windows systems or critical web applications, these aren't just warnings—they’re a call to action.
So, what are you waiting for? Time to patch and protect. Today's vulnerability may be tomorrow's breach... Don't let it be yours!

---

Source: CISA CISA Adds Two Known Exploited Vulnerabilities to Catalog