CISA Warns of Active Threats: Essential for Windows and Network Admins

CISA Warns of High-Risk Exploits – A Wake-Up Call for Windows and Network Admins​

The US Cybersecurity and Infrastructure Security Agency (CISA) recently sounded the alarm on a series of active attacks targeting vulnerabilities in a mix of network devices and software. Among the affected are Cisco RV routers, Hitachi Vantara’s Pentaho BA server, Progress’s WhatsUp Gold, and notably—the Windows operating system. Whether you’re patching your routers or safeguarding your Windows environment, this serves as a stark reminder that legacy vulnerabilities can—and do—remain a threat.

---

A Closer Look at the Vulnerabilities​

Cisco RV Routers: The Frontline Breach​

CISA has flagged a vulnerability in the web-based management interface of Cisco’s RV series small business routers. Key details include:

• Vulnerability: CVE-2023-20118
• Risk Rating: Medium (CVSS 6.5)
• Attack Vector: Authenticated attackers can execute arbitrary commands from within the network by sending carefully crafted HTTP packets.
• Update Status: A patch has been available since April 2023.

This breach highlights the importance of maintaining up-to-date firmware on devices that serve as your network’s gatekeepers. For businesses relying on small business routers, ensuring that remote management interfaces are secure is paramount.

Hitachi Vantara Pentaho BA Server: A Double-Edged Sword​

For those running Hitachi Vantara’s Pentaho BA server, the situation is even more concerning. CISA’s warning outlines two high-risk vulnerabilities actively exploited by malicious actors:

• Authorization Bypass Vulnerability:
• CVE: CVE-2022-43939
• Risk: High (CVSS 8.6)
• Injection Vulnerability:
• CVE: CVE-2022-43769
• Risk: High (CVSS 8.8)
• Attack Mechanism: This flaw allows the injection of “special elements” by exploiting Spring templates within the server.

These vulnerabilities, both patched in April 2023, underscore a common theme: even a well-secured system might harbor hidden doors for unauthorized access if software updates are not promptly applied.

Windows Under the Lens: Legacy Vulnerabilities Still Lurk​

Among the attacked vulnerabilities is one that affects Windows systems, capturing the attention of Windows admins everywhere. The vulnerability in the Win32k component—critical for system security—permits privilege escalation on affected versions:

• Affected Versions: Windows versions up to Windows 10 and Windows Server 2019.
• Vulnerability: CVE-2018-8639
• Risk Rating: High (CVSS 7.8)

Despite being seven years old, this flaw demonstrates that legacy vulnerabilities are not merely historical footnotes. They can continue to provide gateways for compromise, particularly if patches are not applied. This serves as a reminder for Windows administrators to rigorously review and update security patches, even for vulnerabilities that might seem outdated.

WhatsUp Gold: A Critical Threat in Network Monitoring​

In an environment where network monitoring tools are expected to enhance security, Progress’s WhatsUp Gold faces a critical vulnerability:

• Vulnerability: CVE-2024-4885
• Risk Rating: Critical (CVSS 9.8)
• Attack Mechanism: Through a directory traversal flaw, attackers are able to inject and execute arbitrary code without needing to log in.

The discovery of such a high-severity vulnerability in a tool designed to enhance IT supervision is particularly worrisome. It reinforces the idea that security tools must themselves adhere to rigorous security standards.

---

Broader Implications for IT and Windows Admins​

Aging Vulnerabilities: Dead but Not Forgotten​

It might be surprising to discover that vulnerabilities first reported as long ago as 2018—and in some cases, even older—are still exploited in current attacks. Here are some strategic takeaways:

• Legacy Systems Are a Risk: Even if a vulnerability is several years old, if the corresponding patch has not been applied, it remains a viable target.
• Regular Audits are Essential: IT managers should ensure that they conduct periodic reviews of their network infrastructure. This includes cataloging all installed devices and checking for outdated software that could be lurking as a potential threat.
• Timely Updates Save the Day: With patches available for these vulnerabilities, the solution is clear—maintain a consistent update schedule for routers, servers, and client systems alike.

The Windows Perspective​

For IT professionals managing Windows environments, the legacy Windows vulnerability should serve as a wake-up call. While Microsoft continues to roll out regular updates for Windows 10, Windows 11, and Windows Server editions, many organizations still operate on older or unsupported software editions. This divergence can lead to security gaps that attackers are keen to exploit.

Keeping Up with the Attack Landscape​

This warning from CISA is not an isolated incident. Just last week, similar alerts were issued regarding attacks on Microsoft Partner Center, groupware Zimbra, Adobe ColdFusion, and Oracle Agile PLM. The network of threats is expansive, and malware authors will target any vulnerability they can leverage—no matter how old.

---

Practical Steps for Administrators​

Given these concerning updates and the broad spectrum of vulnerable products, here are actionable steps IT managers should take:

• Inventory Your Assets:
• Catalogue all network devices and software.
• Identify systems that might be running the affected versions.
• Update Immediately:
• Apply the latest patches and firmware updates, specifically for Cisco RV routers, Hitachi Vantara Pentaho BA servers, and WhatsUp Gold.
• Ensure that Windows 10 and Windows Server 2019 systems are up-to-date with the latest patches addressing the Win32k vulnerability (CVE-2018-8639).
• Audit for Suspicious Activity:
• Examine network logs and system behaviors for any signs of intrusion.
• Consider employing additional monitoring tools to flag unusual network traffic that might indicate active exploitation.
• Educate and Prepare:
• Keep the IT team informed about the latest security advisories and vulnerability threats.
• Review and update your incident response protocols to ensure quick reaction if an attack is detected.

---

In Summary​

CISA’s latest warning vividly illustrates that the battle against cyber threats is ongoing. Whether it’s a relatively new vulnerability in a critical network appliance or an old flaw in Windows systems, attackers continuously seek easy targets in environments where updates are neglected. The message is clear: complacency is not an option.

• Stay Current: Ensure that all systems, including legacy Windows installations, are updated promptly with available patches.
• Be Proactive: Regularly audit and monitor your network environment.
• Prioritize Security: For every software component—from routers to enterprise servers—maintain diligence in applying updates and reviewing security practices.

For IT professionals managing Windows environments, the stakes are especially high. By rigorously following these steps and maintaining an up-to-date security posture, you can protect your network from the multifaceted threats evinced by these active attacks. After all, in today’s digital landscape, even seven-year-old vulnerabilities are capable of causing modern headaches.
Stay vigilant, and keep those patches coming!

---

Source: https://www.heise.de/en/news/Attacks-on-security-leaks-in-Cisco-RV-routers-WhatsUp-Gold-and-Windows-10302954.html