- CISA adds CVE-2023-28461 to its Known Exploited Vulnerabilities catalog
- Federal agencies have until December 16 to patch up
- The bug is being abused by a Chinese group known as Earth Kasha
The US Cybersecurity and Infrastructure Security Agency (CISA) has added a new critical vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, warning federal agencies they have a three-week deadline to apply the available patch, or stop using the affected software altogether.
The agency added a missing authentication vulnerability to KEV tracked under CVE-2023-28461, which has a severity score of 9.8, and allows crooks to execute arbitrary code on remote devices.
It was discovered in Array Networks AG and vxAG secure access gateways, and was fixed in March 2023, with the first clean version of the software being version 9.4.0.484.
Earth Kasha
“Array AG/vxAG remote code execution vulnerability is a web security vulnerability that allows an attacker to browse the filesystem or execute remote code on the SSL VPN gateway using flags attribute in HTTP header without authentication,” Array Networks said at the time. “The product can be exploited through a vulnerable URL.”
Federal organizations have until December 16 to patch the software.
CISA did not detail the attacks, but Trend Micro claims a threat actor known as Earth Kasha was using it.
This Chinese group, also known as MirrorFace, was apparently abusing Array AG, ProSelf, and FortiNet for initial access. The group mostly targets victims in Japan, although it was observed going after organizations in Taiwan, India, and Europe. Going after US-based targets is not that common, it would seem.
Earth Kasha seems to be tied to the APT10 advanced persistent threat. The group primarily focuses on sectors like government, technology, and academia, and deploys malware such as LODEINFO, NOOPDOOR, and MirrorStealer to steal credentials, maintain persistence, and exfiltrate sensitive data. Their campaigns often involve credential dumping, DLL side-loading, and encrypted payloads.
Via The Hacker News
Leave a comment