The Shadowserver Foundation

Attention! According to the Cybersecurity and Infrastructure Security Agency SolarWinds CVE-2024-28986 is actively exploited The vulnerability has been added to CISA's KEV catalog. We added scanning of Internet exposed SolarWinds Web Help Desk instances to our daily Device ID reports: https://lnkd.in/dkWVZ97z 812 found on 2024-08-18, 527 in the US Exposure by country: https://lnkd.in/df5hjPVG Exposure by US state: https://lnkd.in/dVSZuXna Note: we do not make a vulnerability assessment on the exposed devices, this is just a population scan. SolarWinds advisory: https://lnkd.in/dhUQaYUY If you receive information from us about an exposed instance please make verify it is patched (and if not investigate also for signs of compromise) #cybersecurity #vulnerabilitymanagement #riskmanagement #exposedattacksurface #shadowserver #cybercivildefense

Ivanti vTM CVE-2024-7593 (CVSS 9.8 RCE): We are sharing Ivanti vTM devices exposed on the Internet in our Device ID report https://lnkd.in/dPu3utpY (no vulnerability assessment) Only 31 found 2024-08-17, but today we observed an exploit attempt based on the public PoC. Dashboard view of geolocated IPs of exposed Ivanti vTM devices: https://lnkd.in/dXpQugTC Patch info from Ivanti: https://lnkd.in/dqzp9wri #cybersecurity #vulnerabilitymanagement #riskmanagement #attacksurface #shadowserver #cybercivildefense

We have added a list of our daily threat/vulnerability/exposure reports sorted by severity to our GitHub https://lnkd.in/dSdypCPF Hopefully makes it easier to track! Make sure to use our API for automatically ingesting these reports & more - https://lnkd.in/d9rxKQ99 #cybersecurity #automation #vulnerabilityintelligence #threatintelligence #shadowserver #cybercivildefense

The public disclosure of known exploited vulnerabilities provides the security community with critical insights into real-world threats that are often immediately actionable. In the first half of 2024 alone, VulnCheck identified 390 vulnerabilities with known exploitation, collecting 10,611 references to exploitation in the wild. Among hundreds of reputable sources, we identified 68 different sources as the earliest reporters of exploitation during this period. This underscores the collaborative effort across the security industry, with increasing participation in vulnerability exploitation disclosure from vendors, security teams, non-profits, and government agencies. You can access the full VulnCheck KEV catalog by signing up for a free community account: https://vulncheck.com/kev #cybersecurity #infosecurity #riskmanagement #vulnerabilitymanagement

We are also scanning & reporting out Cisco Smart Software Manager On-Prem CVE-2024-20419 (CVSS 10.0 rated) vulnerable instances. Advisory published in July & now updated by Cisco with info on a PoC available. We see (only) over 40 instances vulnerable - https://lnkd.in/dFHUDCJT We share daily reports by IP (filtered by network/constituency) in our Vulnerable HTTP report - https://lnkd.in/dsA3E6A3 (tagged cve-2024-20419) Cisco Advisory with update information: https://lnkd.in/eQHC35MY #cybersecurity #vulnerabilitymanagement #riskmanagement #attacksurfacemanagement #shadowserver #cybercivildefense

The US Cybersecurity and Infrastructure Security Agency has published an alert on best practices in Cisco device configuration due to observed attacks exploiting amongst others the legacy Cisco Smart Install feature: https://lnkd.in/d5UqRmrC Shadowserver has been scanning and reporting out exposed Cisco Smart Install instances for many years in our free daily Accessible Cisco Smart Install report - https://lnkd.in/dttQYKS5 We see over 6000 IPs with Cisco Smart install feature still exposed to the Internet. You can track worldwide, country, province/state level exposure of Cisco Smart Install on our Dashboard (select source scan,scan6 and tag cisco-smart-install), for example: https://lnkd.in/d3seHKrH Make sure to block external access and disable Cisco Smart Install on your devices! Dashboard tracker: https://lnkd.in/dNVrB5aa Per State exposure in the United States: https://lnkd.in/dBQ8dWZ6 #cybersecurity #vulnerabilitymanagement #riskmanagement #cybercrime #attacksurfacemanagement #shadowserver #cybercivildefense

Let's adequately fund #cybersecurity nonprofits. The Internet depends on it! Please read: https://lnkd.in/dNS95ukk #CommonGoodCyber #CyberCivilDefense

Using Progress WhatsUp Gold? Starting Aug 1st, we see /NmAPI/RecurringReport CVE-2024-4885 exploitation callback attempts (so far 6 src IPs). Note: PoC is public! See Progress advisory: https://lnkd.in/dXMUyT5w Track CVE-2024-4885 attacks on our Dashboard: https://lnkd.in/dC-hjCnM #cybersecurity #vulnerability #vulnerabilitymanagement #riskmanagement #shadowserver #cybercivildefense

Happy to have The Shadowserver Foundation as one of the vulnerability exploitation data contributors to EPSS!