cybersecurity

Wanna chat about something non-infosec amongst those of us who frequent /c/cybersecurity? Here’s your chance! (Keep things civil & respectful please)

You can now follow the Vulnerability-Lookup >Discourse topic on Mastodon: >@vulnerability-lookup@discourse.ossbase.org

https://discourse.ossbase.org/c/vulnerability-lookup-org/6

#Mastodon #Discourse #ActivityPub #VulnerabilityLookup

cross-posted from: https://lemmy.sdf.org/post/36028716

Archived

Security firm Forescout identified almost 35,000 solar power devices from 42 vendors with exposed management interfaces. These devices include inverters, data loggers, monitors, gateways and other communication equipment.

Key Findings

• Despite being a rapidly growing renewable energy source, there are security issues with remote inverter management, via cloud applications or direct access to management interfaces within inverters.
• Internet-exposed solar power devices are much more popular in Europe and Asia than in other regions. Europe accounts for 76% of exposed devices, followed by 17% in Asia and the remaining 8% in the rest of the world. Germany and Greece each account for 20% of the total devices worldwide, followed by Japan and Portugal with 9% each then Italy with 6%.
• Four of the top 10 vendors with exposed devices are headquartered in Germany, two in China and one each in Austria, Japan, US and Italy. This distribution also does not match the top 10 vendors worldwide by market share, since 9 of those are Chinese.

Mitigation Recommendations

• Do not expose inverter management interfaces to the internet.
• Patch devices as soon as possible and consider retiring those that for some reason cannot be patched.
• If a device needs to be managed remotely, consider placing it behind a VPN and following CISA’s guidelines for remote access.
• Follow the NIST guidelines for the cybersecurity of smart inverters in residential and commercial installations.

Weekly thread to discuss whatever you’re working on, big or small, at work or in your free time.

Introduction

This vulnerability report has been generated using data aggregated on Vulnerability-Lookup, with contributions from the platform’s community.

It highlights the most frequently mentioned vulnerability for May 2025, based on sightings collected from various sources, including MISP, Exploit-DB, Bluesky, Mastodon, GitHub Gists, The Shadowserver Foundation, Nuclei, and more. For further details, please visit this page.

The final section focuses on exploitations observed through The Shadowserver Foundation's honeypot network.

Top 10 vulnerabilities of the month

Vulnerability	Vendor	Product	Severity	VLAI Severity
CVE-2025-31324	SAP_SE	SAP NetWeaver (Visual Composer development server)	Critical	Critical
CVE-2025-4427	Ivanti	Endpoint Manager Mobile	Medium	Critical
CVE-2025-37899	Linux	Linux		High
CVE-2025-4428	Ivanti	Endpoint Manager Mobile	High	High
CVE-2025-32756	Fortinet	FortiVoice	Critical	Critical
CVE-2025-4664	Google	Chrome	Medium	Medium
CVE-2025-20188	Cisco	Cisco IOS XE Software	Critical	Critical
CVE-2017-18368	ZyXEL	P660HN-T1A	Critical	Critical
CVE-2015-2051	D-Link	DIR-645	High	Critical
CVE-2024-38475	Apache Software Foundation	Apache HTTP Server	Critical	Critical

Evolution for the top 5 vulnerabilities

• CVE-2025-31324 - SAP / SAP NetWeaver (Visual Composer development server)
• CVE-2025-4427 - Ivanti / Endpoint Manager Mobile
• CVE-2025-37899 - Linux / Linux
• CVE-2025-4428 - Ivanti / Endpoint Manager Mobile
• CVE-2025-32756 - Fortinet / FortiVoice

Insights from contributors

CVE-2025-22252: Authentication Vulnerability in FortiOS, FortiProxy, and FortiSwitchManager leads to Unauthenticated Admin Access
CVE-2025-22252 is a missing authentication for critical function vulnerability in devices configured to use a remote TACACS+ server for authentication configured to use ASCII authentication. It may allow an attacker with knowledge of an existing admin account to access the device as a valid admin via an authentication bypass, potentially resulting in complete system compromise, data theft and service disruption.

CVE-2025-30663: Additional information
In its security release of 13 May 2025, Zoom addressed two vulnerabilities that could be exploited for privilege escalation: • CVE-2025-30663, a time-of-check time-of-use race condition affecting some Zoom Workplace Apps. If successfully exploited, an authenticated user could conduct an escalation of privilege via local access. • CVE-2025-30664 is an improper neutralization of special elements flaw affecting some Zoom Workplace Apps. Successful exploitation could allow an authenticated user to conduct an escalation of privilege via local access.

CVE-2025-41229: More information
The vulnerabilities could be used by attackers to gain access to services and data. They can also be used to execute arbitrary commands and cause a denial of service. Confidentiality, integrity and availability are all impacted. The only solution is to upgrade immediately.

2025-27920: Additional information
Microsoft discovered critical vulnerability CVE-2025-27920 affecting the messaging application Output Messenger. Microsoft additionally observed exploitation of the vulnerability since April 2024. According to Microsoft, the attacker needs to be authenticated, although the Output Messenger advisory indicates that privileges are not required to exploit the vulnerability. An attacker could upload malicious files into the server’s startup directory by exploiting this directory traversal vulnerability. This allows an attacker to gain indiscriminate access to the communications of every user, steal sensitive data and impersonate users, possibly leading to operational disruptions, unauthorized access to internal systems, and widespread credential compromise.

Continuous exploitation

• CVE-2023-0656 - SonicWall / SonicOS (not in CISA KEV)
• CVE-2022-26134 - Atlassian / Confluence Data Center
• CVE-2019-1653 - Cisco / Cisco Small Business RV Series Router Firmware

Thank you

Thank you to all the contributors and our diverse sources!

If you want to contribute to the next report, you can create your account.

Feedback and Support

If you have suggestions, please feel free to open a ticket on our GitHub repository. Your feedback is invaluable to us!
https://github.com/vulnerability-lookup/vulnerability-lookup/issues/

Weekly thread for any and all career, learning and general guidance questions. Thinking of taking a training or going for a cert? Wondering how to level up your career? Wondering what NOT to do? Got other questions? This is the time and place to ask!

crosspostato da: https://lemmy.sdf.org/post/35753834

Archived

Cipher, the cybersecurity division of Prosegur Group, has reported a 43% increase in cyberattacks against essential service operators in Spain during 2024. Its cyber intelligence division, Unit x63, highlights the focus on the energy sector, as critical infrastructure, which accounted for 9% of the total. This upward trend, continuing into 2025, points to a growing number of threats from espionage, sabotage and the exfiltration of sensitive data, reflecting the increasing sophistication and persistence of cyber attackers.

In early 2025, Cipher’s Unit x63 confirmed that several Spanish energy companies were targeted by ransomware campaigns, hit by data leaks and the subsequent sale of information on underground forums. Globally, geopolitical tensions have intensified attacks on sensitive infrastructure.

[...]

Threat landscape: key types of cyberattack targeting the energy sector.

Cyberespionage in the energy sector aims to covertly obtain critical information such as facility blueprints, proprietary technologies and strategic contracts. These attacks are typically state-sponsored or executed by Advanced Persistent Threat (APT) groups looking to gain geopolitical or economic advantage—or laying the groundwork for future sabotage [...]

Cyber sabotage in the energy sector seeks to disrupt or damage critical operations by targeting industrial systems such as SCADA, ICS, or PLCs. Unlike espionage, these attacks aim for destruction and demand high levels of sophistication, often linked to nation state [...]

Destructive malware has become a frequent weapon in geopolitical conflicts, severely impacting the energy sector, and is designed to erase data, disable systems, or sabotage operations. They can temporarily shut down businesses and cripple key infrastructure [...]

Hacktivist activity in the energy sector is on the rise in 2025, driven by political, social, and ideological motives [...] Pro-Russian collectives like NoName057(16) have launched DDoS campaigns against Western critical infrastructure. In 2024, a new group named “Mr. Hamza” emerged with strong anti-globalist rhetoric [...]

In 2025, disinformation campaigns aimed at the energy sector have intensified, seeking to erode public confidence in both governments and companies. Russian-led operations in Eastern Europe have targeted efforts to diversify away from Russian gas [...]

Cipher’s Unit x63 has identified a growing number of threats to the energy sector from state or para-state actors focused on espionage, sabotage, and strategic control. Russia remains the leading aggressor, with veteran groups such as Sandworm and APT28 expanding their activities across Europe.

[...]

China, Iran and North Korea have also stepped up operations. China's Volt Typhoon, active since 2023, and Iranian groups APT34 and CyberAvengers are behind global campaigns against critical infrastructure. North Korean units such as Lazarus and Kimsuky focus on energy and nuclear information. Additionally, the presence of cyber mercenaries developing tailored malware for state clients further complicates attribution and heightens supply chain risks.

[...]

crosspostato da: https://lemmy.sdf.org/post/35711367

Archived

Chinese efforts to spy on the Dutch are intensifying, with the focus on semiconductors, Dutch Defence Minister Ruben Brekelmans said on Saturday.

"The semiconductor industry, which we are technologically leading, or technology advanced, of course, to get that intellectual property - that's interesting to China," Brekelmans said in an interview on the sidelines of the Shangri-La Dialogue security meeting in Singapore.

[...]

When asked if the spying had stopped, Brekelmans said: "It's continuing. In our newest intelligence reports, our intelligence agency said that the biggest cyber threat is coming from China, and that we do see most cyber activity when it comes to us being as from China. That was the case last year, but that's still the case. So we only see this intensifying."

[...]

Dutch intelligence agencies first publicly attributed cyber espionage to China last year, when they said state-backed cyber spies had gained access to a Dutch military network in 2023.

Brekelmans said security is becoming increasingly important for the Netherlands as China is "using their economic position for geopolitical purposes and also to pressure us".

[...]

The minister said the Netherlands has introduced instruments to protect key industries and vital interests but the country and region also need to reduce their dependency on China for critical raw materials.

"Both on the European Union level, but also on the national level, we need to make bigger steps in order to reduce those dependencies."

The first day of @thotcon 0xD was a total blast! Before the presentations even got started I had the amazing Cliff Stoll sitting next to me imparting his wisdom, his jokes, and being a lot of fun! If you are interested in #CyberSecurity you definitely need to read his book The Cuckoos Egg! @cybersecurity

cross-posted from: https://lemmy.sdf.org/post/35480023

Archived

[...]

Ambassador Peter Mandelson [UK ambassador to the U.S. in Washington] warned of the consequences if China continues to get ahead in AI and other key technologies.

“They will be able to do things which cascade down not just to their own country but everyone else’s across the world,” Mandelson said at an event hosted by the Atlantic Council in Washington on Tuesday.

[...]

Before being appointed ambassador, Lord Mandelson had criticized the Conservative-led government for mismanaging ties with China and called for a thaw in relations. He is a founder of Global Counsel, a firm that’s become one of the most influential advisory groups in the UK and has been expanding its coverage of China.

The Labour government under Prime Minister Keir Starmer has been pursuing closer ties with Beijing despite unease in Washington and other UK allies.

Mandelson said UK-China relations are unlikely to return to where they were a decade ago.

“We’re not going to to back to the ‘Golden Era’ of Cameron,” he said, referring to former Prime Minister David Cameron, whose government hosted Chinese President Xi Jinping in 2015 in a visit hailed as a breakthrough in ties.

Since then, London’s relationship with Beijing has deteriorated over a crackdown on pro-democracy protests in Hong Kong, its support for Russia’s war in Ukraine, and alleged cyberattacks and spying operations in the UK.

Mandelson also cautioned the European Union to be “much more skeptical” about building closer ties with China, even as the two sides step up their engagement to push back against the Trump administration’s tariffs.

The ambassador called for a “reboot” of the trans-Atlantic alliance not only in technology but also defense, pointing to the war in Ukraine as a “brutal wake-up call.” He said European defense needs to step up and become less dependent on the US.

[...]

“We [Europeans] have lived in a fantasy created by the US security guarantee, complacent that a friendly heavyweight across the water would be always there when the going gets tough,” he said.

cross-posted from: https://lemmy.sdf.org/post/35479238

Archived

A previously unknown Russian hacker group that has been given the moniker “Laundry Bear” has spent roughly a year targeting government and commercial entities in the Netherlands and other NATO and EU countries, according to a joint report from the Dutch General Intelligence and Security Service (AIVD) and the Military Intelligence and Security Service (MIVD).

The group, believed to be operating on behalf of the Kremlin, was first detected in September 2024 after stealing sensitive data on approximately 63,000 Dutch police officers. According to Politico, nearly the entire Dutch police force was affected by the breach.

[...]

A technical investigation into the victims indicated that Laundry Bear likely sought sensitive information on the procurement and production of military equipment by Western governments, as well as details on weapons deliveries to Ukraine. Dutch intelligence services observed that the group appears to possess a certain level of insight into the defense production and supply chains involved. Laundry Bear has also targeted companies developing advanced technologies that are difficult for Russia to acquire due to Western sanctions.

[...]

Microsoft is conducting its own investigation into the group, which exploited the company’s Exchange servers. Microsoft has named the threat actor “Void Blizzard.”

[...]

One example cited in the report includes a PDF attachment from Laundry Bear disguised as an invitation to a European Defense and Security Summit and containing a QR code that led to a phishing website.

Laundry Bear employed a variety of hacking techniques, including cookie theft and replacement, password brute-forcing, and phishing (using fake emails or messages to steal login credentials). While these methods are relatively simple, identifying the group behind the attacks is challenging. However, AIVD notes that APT28 (also known as Fancy Bear) — a group linked to Russia’s GRU military intelligence agency — uses similar methods and typically targets the same types of institutions.

This project implements a FastAPI-based local server designed to load one or more pre-trained NLP models during startup and expose them through a clean, RESTful API for inference.

For example, it leverages the Hugging Face transformers library to load the CIRCL/vulnerability-severity-classification-distilbert-base-uncased model, which specializes in classifying vulnerability descriptions according to their severity level. The server initializes this model once at startup, ensuring minimal latency during inference requests.

Clients interact with the server via dedicated HTTP endpoints corresponding to each loaded model. Additionally, the server automatically generates comprehensive OpenAPI documentation that details the available endpoints, their expected input formats, and sample responses—making it easy to explore and integrate the services.

The ultimate goal is to enrich vulnerability data descriptions through the application of a suite of NLP models, providing direct benefits to Vulnerability-Lookup and supporting other related projects.