CISA Sets a Deadline – Patch Juniper Junos OS Vulnerabilities Before November 17

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has given a November 17, 2023, deadline for federal businesses and organizations to apply mitigations to safe versus a number of security flaws in Juniper Junos OS that came to gentle in August.

The agency on Monday additional 5 vulnerabilities to the Recognised Exploited Vulnerabilities (KEV) catalog, primarily based on proof of lively exploitation –

• CVE-2023-36844 (CVSS rating: 5.3) – Juniper Junos OS EX Sequence PHP External Variable Modification Vulnerability
• CVE-2023-36845 (CVSS score: 5.3) – Juniper Junos OS EX Collection and SRX Series PHP External Variable Modification Vulnerability
• CVE-2023-36846 (CVSS score: 5.3) – Juniper Junos OS SRX Sequence Missing Authentication for Critical Function Vulnerability
• CVE-2023-36847 (CVSS score: 5.3) – Juniper Junos OS EX Series Lacking Authentication for Critical Functionality Vulnerability
• CVE-2023-36851 (CVSS score: 5.3) – Juniper Junos OS SRX Series Missing Authentication for Critical Perform Vulnerability

The vulnerabilities, for every Juniper, could be fashioned into an exploit chain to realize distant code execution on unpatched units. Also extra to the record is CVE-2023-36851, which has been described as a variant of the SRX add flaw.

Juniper, in an update to its advisory on November 8, 2023, explained it’s “now aware of profitable exploitation of these vulnerabilities,” recommending that prospects update to the newest variations with speedy result.

The specifics bordering the character of the exploitation are now unfamiliar.

In a different inform, CISA has also warned that the Royal ransomware gang may perhaps rebrand as BlackSuit owing to the truth that the latter shares a “selection of discovered coding attributes identical to Royal.”

The development arrives as Cyfirma disclosed that exploits for critical vulnerabilities are getting provided for sale on darknet forums and Telegram channels.

“These vulnerabilities encompass elevation of privilege, authentication bypass, SQL injection, and remote code execution, posing major security hazards,” the cybersecurity organization stated, adding, “ransomware groups are actively hunting for zero-day vulnerabilities in underground community forums to compromise a huge variety of victims.”

It also follows revelations from Huntress that danger actors are concentrating on numerous healthcare corporations by abusing the widely-applied ScreenConnect remote accessibility software utilized by Transaction Facts Devices, a pharmacy administration software service provider, for first entry.

“The risk actor proceeded to take a number of steps, such as installing extra distant accessibility instruments these kinds of as ScreenConnect or AnyDesk circumstances, to make sure persistent access to the environments,” Huntress pointed out.

Discovered this article exciting? Adhere to us on Twitter  and LinkedIn to go through more exceptional content material we article.

Some parts of this article are sourced from:
thehackernews.com