CISA Flags 8 Actively Exploited Flaws in Samsung and D-Link Devices

The U.S. Cybersecurity and Infrastructure Security Company (CISA) has positioned a established of 8 flaws to the Regarded Exploited Vulnerabilities (KEV) catalog, based on proof of energetic exploitation.

This includes six shortcomings affecting Samsung smartphones and two vulnerabilities impacting D-Link devices. All the flaws have been patched as of 2021.

• CVE-2021-25394 (CVSS score: 6.4) – Samsung mobile devices race problem vulnerability
• CVE-2021-25395 (CVSS rating: 6.4) – Samsung mobile products race problem vulnerability
• CVE-2021-25371 (CVSS score: 6.7) – An unspecified vulnerability in the DSP driver employed in Samsung cellular equipment that permits loading of arbitrary ELF libraries
• CVE-2021-25372 (CVSS score: 6.7) – Samsung cell gadgets improper boundary check inside of the DSP driver in Samsung cellular devices
• CVE-2021-25487 (CVSS rating: 7.8) – Samsung cellular equipment out-of-bounds read through vulnerability leading to arbitrary code execution
• CVE-2021-25489 (CVSS score: 5.5) – Samsung Cell products improper input validation vulnerability resulting in kernel worry
• CVE-2019-17621 (CVSS rating: 9.8) – An unauthenticated distant code execution vulnerability in D-Connection DIR-859 Router
• CVE-2019-20500 (CVSS score: 7.8) – An authenticated OS command injection vulnerability in D-Backlink DWL-2600AP

The addition of the two D-Link vulnerabilities follows a report from Palo Alto Networks Unit 42 very last month about danger actors linked with a Mirai botnet variant leveraging flaws in many IoT units to propagate the malware in a sequence of assaults commencing in March 2023.

On the other hand, it’s not quickly apparent how the flaws in Samsung equipment are becoming exploited in the wild. But supplied the nature of the focusing on, it’s most likely that they may have been put to use by a professional spyware seller in hugely specific attacks.

It really is value noting that Google Venture Zero disclosed a established of flaws in November 2022 that it reported had been weaponized as section of an exploit chain aimed at Samsung handsets.

In light of energetic exploitation, Federal Civilian Government Department (FCEB) businesses are necessary to utilize vital fixes by July 20, 2023, to safe their networks in opposition to potential threats.

Observed this post interesting? Adhere to us on Twitter  and LinkedIn to study far more exclusive content we publish.

Some parts of this article are sourced from:
thehackernews.com