Week of August 19, 2024: CISA Expands KEV Catalog, CISO-Adjacent Moves

Security leaders watched CISA add six actively exploited vulnerabilities to its Known Exploited Vulnerabilities Catalog during the week of August 19, 2024, including a Versa Networks Director flaw and a Jenkins CLI path traversal bug, while the agency also published joint event-logging guidance with the FBI, NSA, and Australia's ACSC. The same week, SecurityWeek's industry-moves column recorded new appointments touching state government, identity governance, and SEC-adjacent legal advisory work.

CISA Adds Versa Networks Director Flaw to KEV Catalog

On August 23, 2024, CISA added CVE-2024-39717, a dangerous file type upload vulnerability affecting Versa Networks Director, to its Known Exploited Vulnerabilities Catalog after confirming active exploitation. Federal Civilian Executive Branch agencies were required to remediate the flaw under Binding Operational Directive 22-01. CISA urged all organizations, not just federal agencies, to prioritize patching catalog entries as part of routine vulnerability management, given that these vulnerability types remain common initial access vectors for threat actors targeting network infrastructure devices such as Versa's SD-WAN management platform. (CISA)

CISA Adds Four Vulnerabilities Spanning Cameras, Linux and Exchange to KEV

On August 21, 2024, CISA added four vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: two Dahua IP camera authentication bypass flaws, a Linux kernel heap-based buffer overflow, and a Microsoft Exchange Server information disclosure vulnerability. Federal civilian agencies were directed to remediate under Binding Operational Directive 22-01 by CISA's set deadlines. CISA again encouraged private-sector organizations to treat catalog entries as a baseline for vulnerability management prioritization across camera, operating system, and email infrastructure. (CISA)

Jenkins CLI Path Traversal Bug Added to KEV Catalog

CISA added CVE-2024-23897, a path traversal vulnerability in the Jenkins command line interface, to its Known Exploited Vulnerabilities Catalog on August 19, 2024, citing evidence of active exploitation. The addition triggered remediation obligations for Federal Civilian Executive Branch agencies under Binding Operational Directive 22-01. Jenkins instances exposed to the flaw could allow attackers to read arbitrary files on the controller file system through the CLI, and CISA reiterated guidance that all organizations, regardless of federal status, prioritize patching catalog vulnerabilities in their own risk management programs. (CISA)

CISA Publishes Five ICS Advisories Covering Rockwell, MOBOTIX, Avtec and Mitsubishi

CISA released five Industrial Control Systems advisories on August 22, 2024, covering Rockwell Automation Emulate3D, Rockwell Automation 5015-AENFTXT, MOBOTIX P3 and Mx6 cameras, Avtec Outpost 0810, and an updated advisory for the Mitsubishi Electric MELSEC iQ-R Series. The advisories detailed current security issues, vulnerabilities, and exploits affecting operational technology products used across manufacturing and critical infrastructure environments. CISA encouraged asset owners and administrators to review each advisory for technical details and mitigations applicable to their specific deployments of the affected vendor equipment. (CISA)

ACSC, CISA, FBI and NSA Issue Joint Event Logging Best Practices

On August 21, 2024, Australia's ACSC, CISA, the FBI, and the NSA, joined by international partners, released joint best practices for event logging and threat detection aimed at helping organizations define a baseline logging program. The guidance responded to the rising use of living-off-the-land techniques, including living-off-the-land binaries and fileless malware, that let intrusions blend into normal network activity. The agencies directed IT decision makers, OT operators, and network administrators toward the recommendations to improve detection of malicious activity, anomalous behavior, and compromised accounts or devices. (CISA)

SecurityWeek Tracks Florida CIO, Saviynt, TextNow and SEC-Adjacent Moves

SecurityWeek's industry-moves roundup for the week of August 19, 2024, reported that Warren Sponholtz became Chief Information Officer of the State of Florida after serving as the state's Deputy CISO, that Simon Gooch joined identity governance vendor Saviynt as Senior Vice President of Expert Services following more than 25 years at Accenture, and that Sean Bonawitz was named senior director and head of Trust & Safety at TextNow. The same roundup noted David Hirsch, formerly head of the SEC's Crypto Assets and Cyber Unit, joined law firm McGuireWoods as a Washington, D.C. partner advising on cybersecurity and crypto matters. (SecurityWeek)