CISA Known Exploited Vulnerabilities (KEV)

CVE-2021-35395 - Realtek AP-Router SDK Buffer Overflow Vulnerability -

Action Due Nov 17, 2021 Target Vendor : Realtek

Description : Realtek AP-Router SDK HTTP web server boa contains a buffer overflow vulnerability due to unsafe copies of some overly long parameters submitted in the form that lead to denial-of-service (DoS).

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2021-35395

CVE-2017-16651 - Roundcube Webmail File Disclosure Vulnerability -

Action Due May 03, 2022 Target Vendor : Roundcube

Description : Roundcube Webmail contains a file disclosure vulnerability caused by insufficient input validation in conjunction with file-based attachment plugins, which are used by default.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2017-16651

CVE-2020-11652 - SaltStack Salt Path Traversal Vulnerability -

Action Due May 03, 2022 Target Vendor : SaltStack

Description : SaltStack Salt contains a path traversal vulnerability in the salt-master process ClearFuncs which allows directory access to authenticated users. Salt users who follow fundamental internet security guidelines and best practices are not affected by this vulnerability.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2020-11652

CVE-2020-16846 - SaltStack Salt Shell Injection Vulnerability -

Action Due May 03, 2022 Target Vendor : SaltStack

Description : SaltStack Salt allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt API using the SSH client. This vulnerability affects any users running the Salt API.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2020-16846

CVE-2018-2380 - SAP Customer Relationship Management (CRM) Path Traversal Vulnerability -

Action Due May 03, 2022 Target Vendor : SAP

Description : SAP Customer Relationship Management (CRM) contains a path traversal vulnerability that allows an attacker to exploit insufficient validation of path information provided by users.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Known

Notes : https://nvd.nist.gov/vuln/detail/CVE-2018-2380

CVE-2010-5326 - SAP NetWeaver Remote Code Execution Vulnerability -

Action Due May 03, 2022 Target Vendor : SAP

Description : SAP NetWeaver Application Server Java Platforms Invoker Servlet does not require authentication, allowing for remote code execution via a HTTP or HTTPS request.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2010-5326

CVE-2016-9563 - SAP NetWeaver XML External Entity (XXE) Vulnerability -

Action Due May 03, 2022 Target Vendor : SAP

Description : SAP NetWeaver Application Server Java Platforms contains an unspecified vulnerability in BC-BMT-BPM-DSK which allows remote, authenticated users to conduct XML External Entity (XXE) attacks.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2016-9563

CVE-2020-6287 - SAP NetWeaver Missing Authentication for Critical Function Vulnerability -

Action Due May 03, 2022 Target Vendor : SAP

Description : SAP NetWeaver Application Server Java Platforms contains a missing authentication for critical function vulnerability allowing unauthenticated access to execute configuration tasks and create administrative users.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2020-6287

CVE-2020-6207 - SAP Solution Manager Missing Authentication for Critical Function Vulnerability -

Action Due May 03, 2022 Target Vendor : SAP

Description : SAP Solution Manager User Experience Monitoring contains a missing authentication for critical function vulnerability which results in complete compromise of all SMDAgents connected to the Solution Manager.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2020-6207

CVE-2019-16256 - SIMalliance Toolbox Browser Command Injection Vulnerability -

Action Due May 03, 2022 Target Vendor : SIMalliance

Description : SIMalliance Toolbox Browser contains an command injection vulnerability that could allow remote attackers to retrieve location and IMEI information or execute a range of other attacks by modifying the attack message.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2019-16256

CVE-2020-10148 - SolarWinds Orion Authentication Bypass Vulnerability -

Action Due May 03, 2022 Target Vendor : SolarWinds

Description : SolarWinds Orion API contains an authentication bypass vulnerability that could allow a remote attacker to execute API commands.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2020-10148

CVE-2021-35211 - SolarWinds Serv-U Remote Code Execution Vulnerability -

Action Due Nov 17, 2021 Target Vendor : SolarWinds

Description : SolarWinds Serv-U contains an unspecified memory escape vulnerability which can allow for remote code execution.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Known

Notes : https://nvd.nist.gov/vuln/detail/CVE-2021-35211

CVE-2016-3643 - SolarWinds Virtualization Manager Privilege Escalation Vulnerability -

Action Due May 03, 2022 Target Vendor : SolarWinds

Description : SolarWinds Virtualization Manager allows for privilege escalation through leveraging a misconfiguration of sudo.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2016-3643

CVE-2020-10199 - Sonatype Nexus Repository Remote Code Execution Vulnerability -

Action Due May 03, 2022 Target Vendor : Sonatype

Description : Sonatype Nexus Repository contains an unspecified vulnerability that allows for remote code execution.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2020-10199

CVE-2019-7481 - SonicWall SMA100 SQL Injection Vulnerability -

Action Due May 03, 2022 Target Vendor : SonicWall

Description : SonicWall SMA100 contains a SQL injection vulnerability allowing an unauthenticated user to gain read-only access to unauthorized resources.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Known

Notes : https://nvd.nist.gov/vuln/detail/CVE-2019-7481

CVE-2021-20022 - SonicWall Email Security Unrestricted Upload of File Vulnerability -

Action Due Nov 17, 2021 Target Vendor : SonicWall

Description : SonicWall Email Security contains an unrestricted upload of file with dangerous type vulnerability that allows a post-authenticated attacker to upload a file to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20023 to achieve privilege escalation.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Known

Notes : https://nvd.nist.gov/vuln/detail/CVE-2021-20022

CVE-2021-20023 - SonicWall Email Security Path Traversal Vulnerability -

Action Due Nov 17, 2021 Target Vendor : SonicWall

Description : SonicWall Email Security contains a path traversal vulnerability that allows a post-authenticated attacker to read files on the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20022 to achieve privilege escalation.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Known

Notes : https://nvd.nist.gov/vuln/detail/CVE-2021-20023

CVE-2021-20016 - SonicWall SSLVPN SMA100 SQL Injection Vulnerability -

Action Due Nov 17, 2021 Target Vendor : SonicWall

Description : SonicWall SSLVPN SMA100 contains a SQL injection vulnerability that allows remote exploitation for credential access by an unauthenticated attacker.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Known

Notes : https://nvd.nist.gov/vuln/detail/CVE-2021-20016

CVE-2020-12271 - Sophos SFOS SQL Injection Vulnerability -

Action Due May 03, 2022 Target Vendor : Sophos

Description : Sophos Firewall operating system (SFOS) firmware contains a SQL injection vulnerability when configured with either the administration (HTTPS) service or the User Portal is exposed on the WAN zone. Successful exploitation may cause remote code execution to exfiltrate usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords).

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Known

Notes : https://nvd.nist.gov/vuln/detail/CVE-2020-12271

CVE-2017-6327 - Symantec Messaging Gateway Remote Code Execution Vulnerability -

Action Due May 03, 2022 Target Vendor : Symantec

Description : Symantec Messaging Gateway contains an unspecified vulnerability which can allow for remote code execution. With the ability to perform remote code execution, an attacker may also desire to perform privilege escalating actions.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2017-6327