Week of January 31, 2022: CISA Adds Win32k Flaw to KEV; Citrix Agrees to $16.5B Buyout

Security leaders tracked a cluster of advisories and one major industry deal during the week of January 31, 2022, as CISA added a Windows Win32k privilege-escalation flaw to its Known Exploited Vulnerabilities Catalog, Cisco patched its Small Business RV-series routers, and the FBI warned Olympic-linked organizations of possible disruptive cyberattacks. The week also closed with news that Citrix Systems agreed to go private in a $16.5 billion deal with Vista Equity Partners and Evergreen Coast Capital.

CISA Adds Microsoft Win32k Flaw to Known Exploited Vulnerabilities Catalog

On February 4, 2022, CISA added CVE-2022-21882, a Microsoft Win32k privilege escalation vulnerability, to its Known Exploited Vulnerabilities Catalog, citing evidence of active exploitation by threat actors. The agency set a remediation due date of 02/18/2022 for federal civilian agencies under Binding Operational Directive 22-01, and urged all organizations to prioritize patching the flaw given its demonstrated use in attacks. CISOs tracking the catalog needed to confirm Windows patch coverage for affected systems before that deadline. (CISA)

Cisco Patches Small Business RV Series Router Vulnerabilities

On February 3, 2022, CISA highlighted Cisco security updates addressing vulnerabilities in the Small Business RV160, RV260, RV340, and RV345 Series routers. The flaws could let a remote attacker take control of an affected device, prompting CISA to urge administrators to review Cisco's advisory and apply patches promptly. Network teams needed to check router firmware versions immediately, since RV-series devices are commonly deployed at remote sites with limited IT oversight, making timely patching a priority for perimeter defense. (CISA)

CISA Issues Advisory on Airspan Networks Mimosa Vulnerabilities

On February 3, 2022, CISA released an Industrial Controls Systems Advisory detailing vulnerabilities in the Airspan Networks Mimosa product line used in wireless broadband deployments. An attacker able to exploit the flaws could achieve remote code execution, trigger a denial-of-service condition, or obtain sensitive information from affected equipment. CISA directed users and administrators to the ICSA-22-034-02 advisory for mitigation guidance, a reminder for operators of wireless and critical-infrastructure networks relying on Mimosa hardware to review patch status that week. (CISA)

Google Ships Chrome 98 Security Update

On February 2, 2022, CISA flagged Google's release of Chrome versions 98.0.4758.80/81/82 for Windows and 98.0.4758.80 for Mac and Linux, which addressed vulnerabilities that could let an attacker take control of an affected system. CISA encouraged users and administrators to review the Chrome release notes and apply the updates without delay. Given Chrome's broad enterprise footprint, security teams needed to push the browser update across managed fleets quickly to close the exploitable gaps described in the release. (CISA)

Critical Samba Flaw Could Allow Root Code Execution

Security updates released around the start of February 2022 fixed CVE-2021-44142, a critical out-of-bounds heap read/write flaw in Samba's vfs_fruit module that could let an attacker execute arbitrary code as root on affected installations. The bug was discovered and demonstrated at Pwn2Own Austin in November 2021 and independently reported by researchers at DEVCORE, affecting Samba versions prior to 4.13.17. Since Samba ships inside most Linux and Unix-like systems, including NAS devices, administrators needed to track downstream vendor patches alongside the core fix. (Help Net Security)

FBI Warns of Cyber Threats Tied to Beijing Winter Olympics

On February 1, 2022, CISA shared an FBI Private Industry Notification warning organizations tied to the February 2022 Beijing Winter Olympics and the March 2022 Paralympics that malicious actors could use disruptive tactics against the events, spanning denial-of-service attacks to insider threats. The notification also flagged risks from mobile applications built by untrusted vendors and recommended that athletes carry a temporary phone instead of their personal device while traveling to the Games. (CISA)

Citrix Agrees to $16.5 Billion Take-Private Deal

On February 1, 2022, Citrix Systems announced a definitive agreement for affiliates of Vista Equity Partners and Evergreen Coast Capital Corporation to acquire the company in an all-cash deal valued at $16.5 billion, including assumed debt, at $104.00 per share. The buyers planned to combine Citrix with Vista portfolio company TIBCO Software, taking Citrix private and off Nasdaq pending shareholder and regulatory approval. For CISOs relying on Citrix's remote-access and workspace products, the ownership change signaled a shift toward private operation expected to close mid-year. (Help Net Security)