Week of March 6, 2023: CISA Expands KEV List, Pushes Secure-by-Design Tech

Security leaders watched CISA add five actively exploited vulnerabilities to its Known Exploited Vulnerabilities Catalog during the week of March 6, 2023, while also publishing five industrial control systems advisories and flagging new Fortinet and Cisco fixes. CISA Director Jen Easterly also used the week to lay out expectations for secure-by-design technology products, and SAFECOM/NCSWIC released guidance on land mobile radio link-layer security.

CISA Adds Three Exploited Vulnerabilities to KEV Catalog

CISA added three vulnerabilities to its Known Exploited Vulnerabilities Catalog on March 7, 2023, citing evidence of active exploitation. The additions covered a Zoho ManageEngine ADSelfService Plus remote code execution flaw, an Apache Spark command injection vulnerability, and a Teclib GLPI remote code execution issue. Federal Civilian Executive Branch agencies were required to remediate the flaws under Binding Operational Directive 22-01, and CISA urged all organizations to prioritize patching these vulnerabilities as part of routine vulnerability management practice. (CISA)

CISA Adds Two More Exploited Vulnerabilities to KEV Catalog

Three days later, on March 10, 2023, CISA added two additional vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: a Plex Media Server remote code execution flaw and an XStream remote code execution vulnerability. The agency again pointed to Binding Operational Directive 22-01, which sets remediation deadlines for federal civilian agencies, and reiterated its standing guidance that all organizations treat catalog entries as high-priority patching targets regardless of sector. (CISA)

CISA Publishes Five Industrial Control Systems Advisories

CISA released five Industrial Control Systems advisories on March 9, 2023, covering products from Akuvox, B&R, ABB, STEP Tools, and Hitachi Energy. The advisories detailed technical specifics on vulnerabilities and exploits affecting operational technology used across critical infrastructure sectors. CISA directed asset owners and administrators to review each advisory for mitigation guidance, part of its routine cadence of OT and ICS vulnerability disclosures aimed at helping plant operators and critical infrastructure defenders reduce exposure to emerging ICS-targeted threats. (CISA)

Fortinet Issues March 2023 Vulnerability Advisories

Fortinet released its March 2023 set of vulnerability advisories addressing issues across multiple products, which CISA flagged on March 9, 2023. The advisories warned that an attacker could exploit the flaws to take control of an affected system. CISA encouraged administrators to review Fortinet's advisory page directly and apply vendor-issued updates promptly, given Fortinet appliances' common placement at network perimeters where unpatched vulnerabilities can expose organizations to remote compromise. (CISA)

Cisco Discloses IOS XR Denial-of-Service Flaw

Cisco published a security advisory on March 9, 2023 for a vulnerability in IOS XR Software running on ASR 9000 Series Routers. The flaw involved Bidirectional Forwarding Detection and could let a remote attacker trigger a denial-of-service condition on affected devices. CISA relayed the advisory the same day, directing network administrators to apply Cisco's fix and pointing to Cisco's broader security advisories page for lower-severity issues addressed in the same release cycle. (CISA)

CISA Director Previews Secure-by-Design Agenda for Vendors

CISA Director Jen Easterly published a blog post on March 10, 2023 outlining three principles she wants technology manufacturers to adopt: taking ownership of security outcomes rather than placing the burden on customers, embracing transparency about vulnerabilities, and publishing roadmaps for secure-by-design and secure-by-default development. The post followed a speech she gave at Carnegie Mellon University and framed unsafe-by-default technology as a cost that organizations and the public should no longer have to absorb. (CISA)

SAFECOM and NCSWIC Release Land Mobile Radio Security Guidance

SAFECOM and NCSWIC, working through CISA, published a whitepaper on March 7, 2023 examining Link Layer Authentication and Link Layer Encryption features for Project 25 land mobile radio systems used in public safety communications. The paper explained how the two features differ, noted that encryption support remains under standards development and unavailable on any P25 systems, and included a case study aimed at helping emergency communications operators assess whether their radio systems carry adequate safeguards. (CISA)