CISA Known Exploited Vulnerabilities (KEV)

CVE-2021-3156 - Sudo Heap-Based Buffer Overflow Vulnerability -

Action Due Apr 27, 2022 Target Vendor : Sudo

Description : Sudo contains an off-by-one error that can result in a heap-based buffer overflow, which allows for privilege escalation.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2021-3156

CVE-2017-0148 - Microsoft SMBv1 Server Remote Code Execution Vulnerability -

Action Due Apr 27, 2022 Target Vendor : Microsoft

Description : The SMBv1 server in Microsoft allows remote attackers to execute arbitrary code via crafted packets.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Known

Notes : https://nvd.nist.gov/vuln/detail/CVE-2017-0148

CVE-2021-31166 - Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability -

Action Due Apr 27, 2022 Target Vendor : Microsoft

Description : Microsoft HTTP Protocol Stack contains a vulnerability in http.sys that allows for remote code execution.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2021-31166

CVE-2022-22965 - Spring Framework JDK 9+ Remote Code Execution Vulnerability -

Action Due Apr 25, 2022 Target Vendor : VMware

Description : Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2022-22965

CVE-2022-22675 - Apple macOS Out-of-Bounds Write Vulnerability -

Action Due Apr 25, 2022 Target Vendor : Apple

Description : macOS Monterey contains an out-of-bounds write vulnerability that could allow an application to execute arbitrary code with kernel privileges.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2022-22675

CVE-2022-22674 - Apple macOS Out-of-Bounds Read Vulnerability -

Action Due Apr 25, 2022 Target Vendor : Apple

Description : macOS Monterey contains an out-of-bounds read vulnerability that could allow an application to read kernel memory.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2022-22674

CVE-2021-45382 - D-Link Multiple Routers Remote Code Execution Vulnerability -

Action Due Apr 25, 2022 Target Vendor : D-Link

Description : A remote code execution vulnerability exists in all series H/W revisions routers via the DDNS function in ncc2 binary file.

Action : The impacted product is end-of-life and should be disconnected if still in use.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2021-45382

CVE-2022-1040 - Sophos Firewall Authentication Bypass Vulnerability -

Action Due Apr 21, 2022 Target Vendor : Sophos

Description : An authentication bypass vulnerability in User Portal and Webadmin of Sophos Firewall allows for remote code execution.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2022-1040

CVE-2021-34484 - Microsoft Windows User Profile Service Privilege Escalation Vulnerability -

Action Due Apr 21, 2022 Target Vendor : Microsoft

Description : Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2021-34484

CVE-2021-21551 - Dell dbutil Driver Insufficient Access Control Vulnerability -

Action Due Apr 21, 2022 Target Vendor : Dell

Description : Dell dbutil driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial-of-service (DoS), or information disclosure.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2021-21551

CVE-2018-10561 - Dasan GPON Routers Authentication Bypass Vulnerability -

Action Due Apr 21, 2022 Target Vendor : Dasan

Description : Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10562, exploitation can allow an attacker to perform remote code execution.

Action : The impacted product is end-of-life and should be disconnected if still in use.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2018-10561

CVE-2022-26871 - Trend Micro Apex Central Arbitrary File Upload Vulnerability -

Action Due Apr 21, 2022 Target Vendor : Trend Micro

Description : An arbitrary file upload vulnerability in Trend Micro Apex Central could allow for remote code execution.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2022-26871

CVE-2021-28799 - QNAP NAS Improper Authorization Vulnerability -

Action Due Apr 21, 2022 Target Vendor : QNAP

Description : QNAP NAS running HBS 3 contains an improper authorization vulnerability which can allow remote attackers to log in to a device.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Known

Notes : https://nvd.nist.gov/vuln/detail/CVE-2021-28799

CVE-2018-10562 - Dasan GPON Routers Command Injection Vulnerability -

Action Due Apr 21, 2022 Target Vendor : Dasan

Description : Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10561, exploitation can allow an attacker to perform remote code execution.

Action : The impacted product is end-of-life and should be disconnected if still in use.

Known To Be Used in Ransomware Campaigns? : Known

Notes : https://nvd.nist.gov/vuln/detail/CVE-2018-10562

CVE-2022-0543 - Debian-specific Redis Server Lua Sandbox Escape Vulnerability -

Action Due Apr 18, 2022 Target Vendor : Redis

Description : Redis is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2022-0543

CVE-2021-38646 - Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability -

Action Due Apr 18, 2022 Target Vendor : Microsoft

Description : Microsoft Office Access Connectivity Engine contains an unspecified vulnerability which can allow for remote code execution.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Known

Notes : https://nvd.nist.gov/vuln/detail/CVE-2021-38646

CVE-2021-34486 - Microsoft Windows Event Tracing Privilege Escalation Vulnerability -

Action Due Apr 18, 2022 Target Vendor : Microsoft

Description : Microsoft Windows Event Tracing contains an unspecified vulnerability which can allow for privilege escalation.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2021-34486

CVE-2021-20028 - SonicWall Secure Remote Access (SRA) SQL Injection Vulnerability -

Action Due Apr 18, 2022 Target Vendor : SonicWall

Description : SonicWall Secure Remote Access (SRA) products contain an improper neutralization of a SQL Command leading to SQL injection.

Action : The impacted product is end-of-life and should be disconnected if still in use.

Known To Be Used in Ransomware Campaigns? : Known

Notes : https://nvd.nist.gov/vuln/detail/CVE-2021-20028

CVE-2019-7483 - SonicWall SMA100 Directory Traversal Vulnerability -

Action Due Apr 18, 2022 Target Vendor : SonicWall

Description : In SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user to test for the presence of a file on the server.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2019-7483

CVE-2018-8440 - Microsoft Windows Privilege Escalation Vulnerability -

Action Due Apr 18, 2022 Target Vendor : Microsoft

Description : An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC).

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Known

Notes : https://nvd.nist.gov/vuln/detail/CVE-2018-8440