Week of September 23, 2024: Ivanti KEV Addition, Telegram Data-Sharing Shift

Security leaders closed out September watching CISA add an actively exploited Ivanti Virtual Traffic Manager flaw to its Known Exploited Vulnerabilities catalog, while Five Eyes agencies published joint guidance on detecting Active Directory compromises and Cisco shipped its semiannual IOS and IOS XE security bundle. Telegram's shift toward sharing user IP addresses and phone numbers with law enforcement, a fresh proof-of-concept for a critical SolarWinds Web Help Desk bug, and new survey data on how the CrowdStrike outage reshaped German IT buying rounded out a week focused on identity, patching, and vendor risk.

CISA Adds Ivanti vTM Bypass Flaw to KEV Catalog

On September 24, 2024, CISA added CVE-2024-7593, an authentication bypass vulnerability in Ivanti Virtual Traffic Manager, to its Known Exploited Vulnerabilities Catalog after confirming active exploitation. The flaw could let an unauthenticated attacker bypass the admin panel and create a new admin account, exposing the management interface to further compromise. Federal civilian agencies were required to remediate the issue under Binding Operational Directive 22-01, and CISA urged all organizations to prioritize patching to reduce exposure to known exploited vulnerabilities such as this one. (CISA)

Five Eyes Agencies Issue Active Directory Compromise Guidance

On September 26, 2024, CISA, Australia's ACSC, the NSA, and partners from Canada, the UK, and New Zealand jointly released a guide titled Detecting and Mitigating Active Directory Compromises, addressing common techniques used to compromise the authentication platform underlying most enterprise networks. The agencies cautioned that recovering from such compromises is often costly and disruptive for organizations, and they recommended specific mitigations and detection strategies covering privilege escalation, credential theft, and lateral movement techniques used by malicious actors against Active Directory environments. (CISA)

Cisco Ships Semiannual IOS and IOS XE Security Bundle

On September 26, 2024, Cisco released its September 2024 Semiannual IOS and IOS XE Software Security Advisory Bundled Publication, addressing multiple vulnerabilities across its routing and switching software. CISA flagged the bundle the same day, noting that a cyber threat actor could exploit some of the included flaws to take control of an affected system. The agency urged administrators running Cisco IOS or IOS XE to review the bundled advisories and apply the necessary updates promptly to reduce exposure on enterprise networks. (CISA)

CISA Warns OT/ICS Devices Remain Easy Targets

On September 25, 2024, CISA warned that it continued to respond to active exploitation of internet-accessible operational technology and industrial control systems, including devices in the Water and Wastewater Systems sector. The agency said exposed systems let threat actors use default credentials, brute-force logins, or other unsophisticated methods to gain access and cause harm. CISA pointed OT/ICS operators in critical infrastructure sectors toward its existing guidance on defending against pro-Russia hacktivist activity and its Cross-Sector Cybersecurity Performance Goals as near-term mitigations. (CISA)

Telegram to Share User IP Addresses With Law Enforcement

On September 23, 2024, Telegram founder and CEO Pavel Durov announced that the platform would begin handing over IP addresses and phone numbers of users confirmed by valid legal orders to be suspects in cases violating its Terms of Service. The change broadened a policy that previously applied only to confirmed terror suspects and accompanied updates to Telegram's privacy policy and terms barring activity such as child abuse content and the sale of drugs or firearms. Telegram said any disclosures would appear in its quarterly transparency report. (Help Net Security)

PoC Published for Critical SolarWinds Web Help Desk Flaw

On September 25, 2024, researchers published proof-of-concept exploit code for CVE-2024-28987, a SolarWinds Web Help Desk vulnerability rooted in hardcoded developer credentials that let unauthenticated attackers remotely read and modify help desk ticket details. Horizon3.ai, which discovered and reported the flaw, said it found roughly 827 internet-reachable WHD instances and that organizations commonly exposed sensitive process details for onboarding, password resets, and shared-resource access. A hotfix for the vulnerability had been available for about a month at the time of the disclosure. (Help Net Security)

German Survey: CrowdStrike Outage Reshaping Security Buying

A survey conducted by Germany's BSI and digital association Bitkom, released September 23, 2024, found that of 311 German companies polled, 62% were directly affected by the faulty CrowdStrike sensor update and 48% were affected indirectly through suppliers or partners. Affected companies reported needing an average of 10 hours to resume operations and about 2 days and 422 human-hours overall to resolve the incident. Ten percent of polled organizations said they had already changed or planned to change cybersecurity providers following the disruption. (Help Net Security)