Week of June 6, 2022: PRC Network-Device Exploits and CISA's KEV Catalog Expansion

Security leaders tracked a joint CISA-NSA-FBI advisory detailing PRC state-sponsored exploitation of network devices and a rapid expansion of CISA's Known Exploited Vulnerabilities Catalog, which grew by 39 entries across two alerts issued June 8 and June 9, 2022. The week also brought patch guidance for widely used tools, including a Chrome security update and a fix for an information-disclosure flaw in Owl Labs' conferencing hardware.

CISA, NSA, and FBI Detail PRC State-Sponsored Exploitation of Network Devices

On June 10, 2022, CISA, the National Security Agency, and the FBI published joint advisory AA22-158A describing how People's Republic of China state-sponsored cyber actors exploited publicly known vulnerabilities in network devices to build broad compromised infrastructure. The advisory detailed targeting of major telecommunications companies and network service providers since 2020 and listed top exploited CVEs across Cisco, Citrix, DrayTek, D-Link, Fortinet, MikroTik, Netgear, Pulse, QNAP, and Zyxel products. The agencies urged patching, replacing end-of-life infrastructure, and adopting centralized patch management to reduce exposure. (CISA)

CISA Adds 36 Vulnerabilities to Known Exploited Vulnerabilities Catalog

On June 8, 2022, CISA added 36 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, citing evidence of active exploitation. CISA said such vulnerabilities remain a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise. The additions fell under Binding Operational Directive 22-01, which requires Federal Civilian Executive Branch agencies to remediate identified vulnerabilities by set due dates. CISA said it would keep adding vulnerabilities meeting its criteria and urged all organizations, not just federal agencies, to prioritize timely remediation of catalog entries as part of routine vulnerability management. (CISA)

CISA Adds Three More Vulnerabilities to KEV Catalog

One day later, on June 9, 2022, CISA added three more vulnerabilities to the Known Exploited Vulnerabilities Catalog, again based on evidence of active exploitation. The agency repeated its standard guidance that such flaws pose significant risk to the federal enterprise and are a frequent attack vector for malicious cyber actors. The additions were made under Binding Operational Directive 22-01, which sets remediation deadlines for Federal Civilian Executive Branch agencies, while CISA continued encouraging broader adoption of the catalog by private-sector and state, local, tribal, and territorial organizations. (CISA)

Google Patches Chrome Flaws CISA Flagged as Urgent

On June 10, 2022, CISA alerted administrators that Google had released Chrome version 102.0.5005.115 for Windows, Mac, and Linux to fix vulnerabilities that an attacker could exploit to take control of an affected system. The agency pointed users to Google's Chrome Release Note for details and recommended applying the update without delay. Because Chrome is widely deployed across enterprise endpoints, the advisory served as a reminder for security teams to confirm that browser patch management processes captured out-of-band releases promptly. (CISA)

Owl Labs Fixes Information-Disclosure Flaw in Meeting Owl Pro

On June 7, 2022, CISA highlighted security updates from Owl Labs addressing CVE-2022-31460, a vulnerability in the Meeting Owl Pro and Whiteboard Owl conferencing devices that an attacker could exploit to obtain sensitive information. CISA directed administrators to review the vendor's security advisories and update affected devices to Version 5.4.1.4. The alert reflected growing attention to collaboration hardware deployed across hybrid workplaces, alongside CISA's more frequent advisories on traditional network and IT equipment that week. (CISA)

CISA Publishes Criteria for Adding Vulnerabilities to the KEV Catalog

On June 7, 2022, CISA updated the Known Exploited Vulnerabilities catalog webpage and the FAQs for Binding Operational Directive 22-01 to spell out the criteria and process used to add vulnerabilities to the list. The clarification arrived during a week in which CISA added dozens of new entries to the catalog, giving security teams a clearer view of how candidate vulnerabilities are evaluated before federal remediation deadlines are set. CISA encouraged users and administrators to review the updated guidance as they built vulnerability management programs around the catalog. (CISA)