Week of April 3, 2023: CISA Expands KEV Catalog as Cisco, ICS Advisories Land

The week of April 3, 2023 brought a steady stream of vulnerability disclosures for security leaders to track, including CISA's addition of six vulnerabilities to its Known Exploited Vulnerabilities Catalog, new Cisco advisories covering remote code execution and command injection flaws, and seven Industrial Control Systems advisories spanning SCADA and PLC vendors. CISA also opened its second annual Emergency Communications Month and the sixth annual National Supply Chain Integrity Month, underscoring resilience themes alongside the week's patching workload.

CISA Adds Five Vulnerabilities to Known Exploited Vulnerabilities Catalog

On April 7, 2023, CISA added five vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation, including three Veritas Backup Exec Agent flaws (CVE-2021-27876, CVE-2021-27877, CVE-2021-27878), a Microsoft Windows Certificate Dialog privilege escalation bug (CVE-2019-1388), and an Arm Mali GPU Kernel Driver information disclosure issue (CVE-2023-26083). Under Binding Operational Directive 22-01, federal civilian agencies faced set remediation deadlines for these entries, while CISA urged all organizations to prioritize patching to reduce exposure to active threats touching backup software, authentication dialogs, and mobile GPU drivers. (CISA)

Cisco Issues Advisories for Remote Code Execution and Command Injection Flaws

On April 7, 2023, Cisco published security advisories covering vulnerabilities in Secure Network Analytics, the Small Business RV320 and RV325 VPN routers, and Evolved Programmable Network Manager, Identity Services Engine, and Prime Infrastructure. CISA noted that a remote cyber threat actor could exploit the flaws to take control of an affected system and encouraged administrators to apply vendor updates. The advisories, tracked as cisco-sa-stealthsmc-rce, cisco-sa-sb-rv32x-cmdinject, and cisco-sa-adeos, addressed remote code execution and command injection weaknesses across widely deployed network management platforms and small-business routers. (CISA)

CISA Releases Seven Industrial Control Systems Advisories

On April 6, 2023, CISA published seven Industrial Control Systems advisories addressing products from Industrial Control Links, JTEKT, Korenix, Hitachi Energy, mySCADA, and Rockwell Automation. The advisories covered SCADA controllers, programmable logic controller software, industrial network switches, and diagnostics tools, detailing vulnerabilities and exploits affecting operational technology environments. CISA encouraged asset owners and administrators across critical infrastructure sectors to review the mitigations in each advisory, reflecting continued scrutiny of SCADA and PLC supply chains underpinning manufacturing, energy, and utility operations during that week. (CISA)

CISA Flags Vulnerability in Nexx Smart Home Devices

On April 4, 2023, CISA released an Industrial Control Systems advisory, ICSA-23-094-01, covering a vulnerability in the Nexx Smart Home Device. The advisory provided technical details about the security issue and recommended mitigations for users and administrators of the connected home product. Its publication alongside CISA's broader ICS advisory series that week highlighted continued attention to consumer and small-business smart-home equipment within the agency's critical infrastructure and connected-device vulnerability tracking during the first week of April 2023. (CISA)

CISA Adds Zimbra Cross-Site Scripting Flaw to KEV Catalog

On April 3, 2023, CISA added CVE-2022-27926, a cross-site scripting vulnerability in Zimbra Collaboration, to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. Under Binding Operational Directive 22-01, federal civilian agencies were required to remediate the flaw by a set due date, while CISA again urged all organizations to prioritize patching known exploited vulnerabilities as part of routine vulnerability management, given continued targeting of email collaboration platforms by malicious cyber actors during that period. (CISA)

CISA Launches Second Annual Emergency Communications Month

On April 3, 2023, CISA kicked off its second annual Emergency Communications Month, encouraging partners to enroll in free priority telecommunications services such as the Government Emergency Telecommunications Service and Wireless Priority Service. CISA Director Jen Easterly said the agency's mission includes ensuring interoperable, secure, and resilient emergency communications for the nation. The campaign also highlighted Telecommunications Service Priority and the Tribal Emergency Communications Team, programs meant to keep critical voice and data circuits functioning when networks become degraded or congested during a crisis. (CISA)

CISA and Partners Kick Off National Supply Chain Integrity Month

On April 3, 2023, CISA joined the Office of the Director of National Intelligence's National Counterintelligence and Security Center, the Office of the National Cyber Director, the Department of Defense, and industry partners to launch the sixth annual National Supply Chain Integrity Month. CISA Assistant Director for the National Risk Management Center Mona Harrington said organizations must take a comprehensive approach to supply chain resilience, including smart procurement and basic cyber hygiene. The campaign organized weekly themes on essentials, small and medium-sized businesses, vendor trustworthiness, and common supply chain threats facing ICT and software ecosystems. (CISA)