Week of April 1, 2024: Ivanti Gateway Flaws, MarineMax's Amended Breach Filing

Security leaders tracked CISA's April 4 advisories covering Ivanti Connect Secure and Policy Secure gateways, two newly exploited Android Pixel vulnerabilities added to the KEV catalog, and industrial control system flaws in Hitachi Energy and Schweitzer Engineering Laboratories products. MarineMax filed an amended cybersecurity incident disclosure with the SEC, while Maxar Technologies and the Department of Homeland Security each named new chief information security officers, and CISA opened a new High-Risk Communities resource hub for civil society groups.

CISA Adds Two Actively Exploited Android Pixel Flaws to KEV Catalog

CISA added two vulnerabilities to its Known Exploited Vulnerabilities Catalog on April 4, 2024, based on evidence of active exploitation. The entries, CVE-2024-29745 and CVE-2024-29748, affect Android Pixel devices and cover an information disclosure flaw and a privilege escalation flaw respectively. Under Binding Operational Directive 22-01, federal civilian agencies must remediate catalog vulnerabilities by set deadlines, and CISA urged all organizations to prioritize patching since such flaws remain frequent attack vectors for malicious cyber actors. (CISA)

Ivanti Patches Four Flaws in Connect Secure and Policy Secure Gateways

Ivanti released security updates on April 4, 2024 for all supported versions of its Connect Secure and Policy Secure gateways, addressing four vulnerabilities including heap overflow, null pointer dereference, and XML entity expansion issues. CISA warned that a cyber threat actor could exploit one of these flaws to take control of an affected system, and urged administrators to apply the updates covering CVE-2024-21894, CVE-2024-22052, CVE-2024-22053, and CVE-2024-22023 without delay. (CISA)

CISA Issues ICS Advisories for Hitachi Energy and Schweitzer Engineering Laboratories

CISA published two Industrial Control Systems advisories on April 4, 2024, covering Hitachi Energy's Asset Suite 9 and Schweitzer Engineering Laboratories' SEL product line. The advisories detailed current vulnerabilities and exploits affecting operational technology used across critical infrastructure sectors, with CISA encouraging asset owners and administrators to review the technical details and apply recommended mitigations to reduce exposure in industrial environments. (CISA)

MarineMax Updates SEC Disclosure on March Cybersecurity Incident

MarineMax filed an amended Form 8-K with the SEC on April 1, 2024, updating its material cybersecurity incident disclosure. The boat retailer said a cybercrime organization had accessed a limited portion of its retail information environment and exfiltrated some customer and employee personally identifiable information. The company stated the affected environment had been remediated, that operations continued in all material respects, and that it intended to notify affected parties and regulators as required by law. (SEC EDGAR)

Maxar and DHS Name New Chief Information Security Officers

SecurityWeek's industry moves roundup for the week of April 1, 2024 reported that space technology company Maxar Technologies hired Norm Laudermilch as Chief Information Security Officer, tasking him with securing the company's attack surface including on-orbit and mission systems. The same roundup noted the US Department of Homeland Security appointed Hemant Baidwan as its new CISO, with Baidwan moving up from Deputy CISO, a role in which he had led the Hack DHS bug bounty program. (SecurityWeek)

CISA Launches High-Risk Communities Webpage for Civil Society Cyber Defense

CISA published a new High-Risk Communities webpage on April 2, 2024, consolidating cyber hygiene guidance, a repository of local cyber volunteer programs, and free or discounted security tools for civil society organizations facing elevated digital threats. The resources, including the Project Upskill guide series, grew out of a year-long Joint Cyber Defense Collaborative effort and were timed to the agency's ongoing Strategic Dialogue on Cybersecurity of Civil Society Under Threat of Transnational Repression with the UK's National Cyber Security Centre. (CISA)