Hackers Actively Exploiting Cisco AnyConnect and GIGABYTE Drivers Vulnerabilities

Cisco has warned of energetic exploitation attempts targeting a pair of two-yr-outdated security flaws in the Cisco AnyConnect Secure Mobility Customer for Windows.

Tracked as CVE-2020-3153 (CVSS score: 6.5) and CVE-2020-3433 (CVSS rating: 7.8), the vulnerabilities could empower neighborhood authenticated attackers to carry out DLL hijacking and duplicate arbitrary data files to process directories with elevated privileges.

Although CVE-2020-3153 was resolved by Cisco in February 2020, a correct for CVE-2020-3433 was transported in August 2020.

“In October 2022, the Cisco Item Security Incident Reaction Crew turned informed of extra attempted exploitation of this vulnerability in the wild,” the networking machines maker stated in an current advisory.

“Cisco carries on to strongly advise that customers update to a preset software launch to remediate this vulnerability.”

The inform will come as the U.S. Cybersecurity and Infrastructure Security Agency (CISA) moved to add the two flaws to its Acknowledged Exploited Vulnerabilities (KEV) catalog, together with 4 bugs in GIGABYTE drivers, citing proof of active abuse in the wild.

The vulnerabilities — assigned the identifiers CVE-2018-19320, CVE-2018-19321, CVE-2018-19322, and CVE-2018-19323, and patched in May possibly 2020 — could permit an attacker to escalate privileges and operate malicious code to consider complete manage of an afflicted procedure.

The progress also follows a extensive report released by Singapore-primarily based Team-IB previous 7 days detailing the methods adopted by a Russian-speaking ransomware group dubbed OldGremlin in its assaults aimed at entities working in the region.

Main between its techniques for attaining preliminary entry is the exploitation of the earlier mentioned-stated Cisco AnyConnect flaws, with the GIGABYTE driver weaknesses used to disarm security software package, the latter of which has also been set to use by the BlackByte ransomware team.

Located this report exciting? Comply with THN on Fb, Twitter  and LinkedIn to go through a lot more exceptional content material we post.

Some parts of this article are sourced from:
thehackernews.com