Week of June 10, 2024: CISA KEV Additions, Globe Life and Key Tronic Disclosures

Security leaders tracked five new CISA Known Exploited Vulnerabilities additions, twenty industrial-control-system advisories, and cybersecurity-related SEC filings from Globe Life and Key Tronic during the week of June 10-16, 2024. CISO moves also made news, as Cisco named a new Asia-Pacific CISO, Schneider Electric named a new unit CSO, and a veteran CISO joined Cloud Communications Group as an executive advisor.

CISA Adds PHP-CGI and ARM Mali GPU Flaws to KEV Catalog

CISA added two vulnerabilities to its Known Exploited Vulnerabilities Catalog on June 12, 2024, citing evidence of active exploitation. The entries covered CVE-2024-4610, an ARM Mali GPU Kernel Driver use-after-free vulnerability, and CVE-2024-4577, a PHP-CGI OS command injection vulnerability. Under Binding Operational Directive 22-01, federal civilian agencies must remediate catalog vulnerabilities by set deadlines, and CISA urged all organizations to prioritize these fixes as part of routine vulnerability management practice. (CISA)

CISA Adds Android, Windows, and Telerik Bugs to KEV Catalog

On June 13, 2024, CISA added three more vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: CVE-2024-32896, an Android Pixel privilege escalation flaw; CVE-2024-26169, a Microsoft Windows Error Reporting Service privilege management vulnerability; and CVE-2024-4358, a Progress Telerik Report Server authentication bypass by spoofing vulnerability. Federal civilian executive branch agencies were required to remediate the flaws under Binding Operational Directive 22-01, and CISA recommended that all organizations treat the catalog as a prioritized patching list. (CISA)

CISA Issues Twenty Industrial Control System Advisories

CISA released twenty Industrial Control Systems advisories on June 13, 2024, covering products from Siemens, Rockwell Automation, Fuji Electric, Motorola Solutions, and Mitsubishi Electric. The bulletins spanned devices and software including Siemens SIMATIC and SCALANCE lines, Rockwell's FactoryTalk View SE, and Motorola's Vigilant License Plate Readers, offering technical details and mitigations for operators of industrial environments. CISA encouraged users and administrators managing these systems to review each advisory and apply recommended mitigations promptly to reduce exposure in operational technology networks. (CISA)

Globe Life Discloses Web Portal Access Review After Regulator Inquiry

Globe Life Inc. disclosed in a Form 8-K dated June 14, 2024 that, following an inquiry from a state insurance regulator on June 13, 2024, it began reviewing potential vulnerabilities in access permissions and user identity management for a company web portal that likely allowed unauthorized access to certain consumer and policyholder information. Globe Life removed external access to the portal, activated its incident response plan, and retained security experts, while stating the issue appeared specific to that portal and had not materially affected operations as of the filing date. (SEC EDGAR / Globe Life Inc.)

Key Tronic Confirms Data Exfiltration in Amended Cybersecurity Disclosure

In a Form 8-K/A filed June 14, 2024, Key Tronic Corporation updated its disclosure of a cybersecurity incident first reported in May 2024, stating that the threat actor had accessed and exfiltrated limited data from the company's environment, including some personally identifiable information. The company said it was notifying affected parties and regulators as required, had incurred approximately $600,000 in external cybersecurity expert costs to date, and expected the incident's financial impact to be material for the quarter ending June 29, 2024. (SEC EDGAR / Key Tronic Corporation)

Cisco and Schneider Electric Name New Security Leaders

Cisco named Sean Duca as Chief Information Security Officer and Practice Leader for its Asia Pacific, Japan and China region, moving from his prior post as VP and Regional Chief Security Officer for APAC at Palo Alto Networks. Separately, Schneider Electric named Megan Samford Chief Security Officer of its US National Security Agreements and US Federal Business unit; Samford, with Schneider since 2020, previously served as VP and Chief Product Security Officer for the company's Energy Management unit after earlier security roles at Rockwell Automation and GE. (SecurityWeek)