{"id":9382,"date":"2025-03-11T04:48:46","date_gmt":"2025-03-11T04:48:46","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/cisa-adds-5-exploited-vulnerabilities-to-kev-list\/"},"modified":"2025-03-11T04:48:48","modified_gmt":"2025-03-11T04:48:48","slug":"cisa-adds-5-exploited-vulnerabilities-to-kev-list","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/cisa-adds-5-exploited-vulnerabilities-to-kev-list\/","title":{"rendered":"CISA Adds 5 Exploited Vulnerabilities to KEV List"},"content":{"rendered":"\n<\/p>\n<div>\n<p><span class=\"p-author\"><i class=\"icon-font icon-calendar\">\ue802<\/i><span class=\"author\">Mar 11, 2025<\/span><i class=\"icon-font icon-user\">\ue804<\/i><span class=\"author\">Ravie Lakshmanan<\/span><\/span><span class=\"p-tags\">Enterprise Security \/ Vulnerability<\/span><\/p>\n<\/div>\n<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\">\n<a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhuhBdk8iKdR0XAU0xg5cdgT1i8YmKq5sKjb0zM9fwQC4twm4dsnLJCl9LZKOdjpvj_ZwJQW2WVGwohOYiMBjn3qxPwWYqzJfIshtz7qm9YlSjxQRHXJejZJ6RfNiOXmWeyp81hODi8t3-nCu2WGsJvkfPlsns4J_AOnH-7YlOUKB9NMCEdimY6E00o096c\/s728-rw-e365\/cisa.png\" style=\"clear: left; display: block; float: left;  text-align: center;\" rel=\"nofollow noopener\" target=\"_blank\"><\/p>\n<p><\/a>\n<\/div>\n<p>The United States Cybersecurity and Infrastructure Security Agency (CISA) has recently added five security vulnerabilities to its catalog of Known Exploited Vulnerabilities (KEV), which affect Advantive VeraCore and Ivanti Endpoint Manager (EPM). This decision was made based on evidence of active exploitation of these vulnerabilities in the wild.<\/p>\n<p>The following vulnerabilities have been identified:<\/p>\n<ul>\n<li><strong>CVE-2024-57968<\/strong>: A vulnerability in Advantive VeraCore that allows an unauthenticated remote attacker to upload files to unintended folders via upload.apsx due to unrestricted file upload.<\/li>\n<li><strong>CVE-2025-25181<\/strong>: A SQL injection vulnerability in Advantive VeraCore that enables a remote attacker to execute arbitrary SQL commands.<\/li>\n<li><strong>CVE-2024-13159<\/strong>: An absolute path traversal vulnerability in Ivanti EPM that allows an unauthenticated remote attacker to leak sensitive information.<\/li>\n<li><strong>CVE-2024-13160<\/strong>: Another absolute path traversal vulnerability in Ivanti EPM that allows an unauthenticated remote attacker to leak sensitive information.<\/li>\n<li><strong>CVE-2024-13161<\/strong>: An absolute path traversal vulnerability in Ivanti EPM that allows an unauthenticated remote attacker to leak sensitive information.<\/li>\n<\/ul>\n<p>The exploitation of VeraCore vulnerabilities has been linked to a Vietnamese threat actor known as the XE Group. This group has been observed using reverse shells and web shells to maintain persistent remote access to compromised systems.<\/p>\n<div class=\"dog_two clear\">\n<center class=\"cf\"><br \/>\n<a href=\"https:\/\/thehackernews.uk\/cis-securesuite\" rel=\"nofollow noopener sponsored\" target=\"_blank\" title=\"Cybersecurity\"><br \/>\n<img fetchpriority=\"high\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhsFQaSLfkFdKcodtNnSya8V2yj1C_ZVcqQImhnHDikdLhrgZ4hoAIdzNPEjMn6tIl2dSBa9PZVJm5Q6CW4Iprd32O0xaNt3UTVX1U9kEK629GDLqpr7Dd6lynygeNXdkuKNi_TlVZ1vRZI_fXFdvFwBm25WNf4tQHZfgpXHiaw1nnd6E5jLX8vrn4fB3mN\/s728-e100\/cis-d.png\" width=\"727\" height=\"90\"\/><br \/>\n<\/a><br \/>\n<\/center>\n<\/div>\n<p>Meanwhile, there are currently no public reports on how the three Ivanti EPM vulnerabilities are being exploited in real-world attacks. However, a proof-of-concept (PoC) exploit was released by Horizon3.ai last month, which described these vulnerabilities as &#8220;credential coercion&#8221; bugs that could allow an unauthenticated attacker to compromise servers.<\/p>\n<p>Given the active exploitation of these vulnerabilities, it is crucial that Federal Civilian Executive Branch (FCEB) agencies apply the necessary patches by March 31, 2025.<\/p>\n<p>This development comes as the threat intelligence firm GreyNose warned of mass exploitation of <a href=\"https:\/\/thehackernews.com\/2025\/03\/php-cgi-rce-flaw-exploited-in-attacks.html\" rel=\"noopener nofollow\" target=\"_blank\">CVE-2024-4577<\/a>, a critical vulnerability affecting PHP-CGI, with increased attack activity targeting Japan, Singapore, Indonesia, the United Kingdom, Spain, and India.<\/p>\n<p>According to GreyNoise, &#8220;more than 43% of IPs targeting CVE-2024-4577 in the past 30 days are from Germany and China.&#8221; The company also detected a coordinated spike in exploitation attempts against networks in multiple countries in February, suggesting additional automated scanning for vulnerable targets.<\/p>\n<p><\/p>\n<div class=\"cf note-b\">Found this article interesting? Follow us on <a href=\"https:\/\/twitter.com\/thehackersnews\" rel=\"noopener nofollow\" target=\"_blank\">Twitter <i class=\"icon-font icon-twitter\">\uf099<\/i><\/a> and <a href=\"https:\/\/www.linkedin.com\/company\/thehackernews\/\" rel=\"noopener nofollow\" target=\"_blank\">LinkedIn<\/a> to read more exclusive content we post.<\/div>\n<\/div>\n<p><script async src=\"\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><br \/>\n<br \/>\n<br \/><a href=\"https:\/\/thehackernews.com\/2025\/03\/cisa-adds-five-actively-exploited.html\" rel=\"nofollow noopener\" target=\"_blank\">Source Link<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\ue802Mar 11, 2025\ue804Ravie LakshmananEnterprise Security \/ Vulnerability The United States Cybersecurity and Infrastructure Security Agency (CISA) has recently added five security vulnerabilities to its catalog of Known Exploited Vulnerabilities (KEV),&#8230;<\/p>\n","protected":false},"author":19,"featured_media":9383,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[22],"tags":[46,39,32,31,33,34,35,40,36,37,42,44,43,41,38,45],"class_list":["post-9382","post","type-post","status-publish","format-standard","has-post-thumbnail","category-cybersecurity","tag-computer-security","tag-cyber-attacks","tag-cyber-news","tag-cyber-security-news","tag-cyber-security-news-today","tag-cyber-security-updates","tag-cyber-updates","tag-data-breach","tag-hacker-news","tag-hacking-news","tag-how-to-hack","tag-information-security","tag-network-security","tag-ransomware-malware","tag-software-vulnerability","tag-the-hacker-news"],"jetpack_featured_media_url":"https:\/\/fusionmindlabs.com\/blogs\/wp-content\/uploads\/sites\/9\/2025\/03\/cisa.png","_links":{"self":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/9382","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/comments?post=9382"}],"version-history":[{"count":1,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/9382\/revisions"}],"predecessor-version":[{"id":9384,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/9382\/revisions\/9384"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media\/9383"}],"wp:attachment":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media?parent=9382"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/categories?post=9382"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/tags?post=9382"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}