Week of February 20, 2023: CISA Retires US-CERT, Adds Three Vulnerabilities to KEV

Security leaders tracked CISA's retirement of US-CERT and ICS-CERT into a unified CISA.gov, three newly catalogued actively exploited vulnerabilities in IBM Aspera Faspex and Mitel MiVoice Connect, and a CISA advisory warning of possible disruptive attacks tied to the one-year anniversary of Russia's invasion of Ukraine. The week also brought a cluster of vendor patches from Cisco, Fortinet, and VMware addressing flaws that could let remote attackers take control of affected systems.

CISA Adds Three Actively Exploited Vulnerabilities to KEV Catalog

CISA added three vulnerabilities to its Known Exploited Vulnerabilities Catalog on February 21, 2023, citing evidence of active exploitation. The additions covered CVE-2022-47986, a code execution flaw in IBM Aspera Faspex, along with CVE-2022-41223 and CVE-2022-40765, both affecting Mitel MiVoice Connect through code and command injection. Under Binding Operational Directive 22-01, federal civilian agencies faced remediation deadlines for the newly listed flaws, while CISA urged all organizations to prioritize patching such vulnerabilities given their frequent use as attack vectors against enterprise networks. (CISA)

CISA Flags ICS Advisories for Mitsubishi Electric and Philips Products

CISA released two Industrial Control Systems advisories on February 21, 2023, covering Mitsubishi Electric's MELSOFT iQ AppPortal and an update to Philips' Vue PACS medical imaging software. The advisories detailed current security issues, vulnerabilities, and exploits affecting the named ICS products and offered mitigations for administrators across industrial and healthcare technology environments. CISA encouraged operators of these systems to review the technical advisories directly and apply recommended fixes to reduce exposure stemming from weaknesses in control-system and medical-device software. (CISA)

Fortinet Patches Multiple Products Amid Exploitation Concerns

Fortinet issued security updates on February 21, 2023, addressing vulnerabilities across multiple of its products, warning that an attacker could exploit some of the flaws to take control of an affected system. CISA pointed administrators to Fortinet's advisories page for further detail and urged prompt application of the updates, along with validation of systems against published indicators of compromise. The advisory arrived amid continued scrutiny of Fortinet appliances as a target for network intrusions into enterprise environments. (CISA)

CISA Warns of Possible Attacks Around Ukraine Invasion Anniversary

On February 23, 2023, CISA warned that the United States and European nations could face disruptive and defacement attacks against websites timed to February 24, the one-year anniversary of Russia's invasion of Ukraine. The agency pointed organizations to its Shields Up resources, including DDoS attack guidance, and recommended increasing vigilance, strengthening resilience, and lowering thresholds for sharing threat information. The alert reflected continued concern among security leaders about geopolitical spillover into disruptive cyber activity targeting Western networks. (CISA)

Cisco Discloses Advisories Spanning ACI, Nexus, and ClamAV

Cisco published security advisories on February 23, 2023, for flaws across the Application Policy Infrastructure Controller, Cloud Network Controller, Nexus 9000 Series switches in ACI mode, and ClamAV, warning that a remote attacker could exploit some of the issues to take control of an affected system. The disclosures included a cross-site request forgery vulnerability, a Link Layer Discovery Protocol memory-leak denial-of-service flaw, and a ClamAV buffer overflow affecting multiple Cisco products. CISA urged administrators to review each advisory and apply the necessary updates. (CISA)

VMware Patches Carbon Black App Control Vulnerability

VMware released security updates on February 23, 2023, for Carbon Black App Control after identifying a vulnerability that a remote attacker could exploit to take control of an affected system. CISA pointed administrators toward VMware Security Advisory VMSA-2023-0004 for technical detail and urged prompt application of the fix. The advisory added to a week of vendor patches covering endpoint-protection and network infrastructure products that security teams were tracking for enterprise remediation. (CISA)

CISA Retires US-CERT and ICS-CERT Into Unified CISA.gov

CISA retired the long-standing US-CERT and ICS-CERT web properties on February 24, 2023, folding their alerts, advisories, and operational content into a redesigned CISA.gov intended to unify the agency's public-facing resources. CISA said it would continue coordinating federal cybersecurity programs, responding to incidents, and issuing threat and vulnerability notifications under the new site, which also introduced a consolidated vulnerability-reporting page. For security leaders accustomed to checking US-CERT bulletins, the change meant redirecting monitoring workflows to the unified CISA.gov domain. (CISA)