Week of September 30, 2024: CISA Adds KEV Entries, Aembit Names New CISO

The week of September 30, 2024 was dominated by CISA activity: four vulnerabilities added to the Known Exploited Vulnerabilities Catalog on September 30, followed by Ivanti Endpoint Manager and Zimbra Collaboration entries on October 2 and October 3, alongside five new ICS advisories and joint operational-technology cybersecurity guidance from CISA, ASD's ACSC, the FBI, and the NSA. On the personnel side, Aembit named Mario Duarte as its first Chief Information Security Officer and Australia's CSIRO appointed Jamie Rossato to the same role, while CISA also published its 2023 Vulnerability Disclosure Platform annual report.

CISA Releases Three ICS Advisories for Transmitter and Power Systems

On October 3, 2024, CISA published three Industrial Control Systems advisories addressing security issues in the TEM Opera Plus FM Family Transmitter, Subnet Solutions PowerSYSTEM Center, and Delta Electronics DIAEnergie platforms. The agency encouraged users and administrators to review the technical details and mitigations included in each advisory, continuing its regular cadence of ICS vulnerability disclosures aimed at operators running transmitter, power-management, and energy-monitoring technology across critical infrastructure sectors. (CISA)

Zimbra Collaboration Flaw Added to CISA's Known Exploited Vulnerabilities Catalog

On October 3, 2024, CISA added CVE-2024-45519, a command execution vulnerability in Synacor's Zimbra Collaboration Suite, to its Known Exploited Vulnerabilities Catalog after confirming evidence of active exploitation. The addition triggered remediation deadlines for federal civilian executive branch agencies under Binding Operational Directive 22-01, and CISA urged all organizations operating Zimbra Collaboration environments to prioritize patching to reduce exposure to active attacks targeting the platform. (CISA)

Ivanti Endpoint Manager SQL Injection Bug Joins CISA Exploited Vulnerabilities List

On October 2, 2024, CISA added CVE-2024-29824, a SQL injection vulnerability in Ivanti Endpoint Manager, to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. Federal civilian executive branch agencies were required to remediate the flaw by the catalog's due date under Binding Operational Directive 22-01, and CISA again urged all organizations running Ivanti Endpoint Manager to treat the vulnerability as a priority patching item. (CISA)

CISA Issues Two Additional ICS Advisories for Networking and PLC Gear

On October 1, 2024, CISA released two Industrial Control Systems advisories covering the Optigo Networks ONS-S8 Spectra Aggregation Switch and the Mitsubishi Electric MELSEC iQ-F FX5-OPC module. Both advisories detailed current security issues, vulnerabilities, and available mitigations for operators running the affected switching and programmable logic controller communication products, part of CISA's ongoing effort to flag ICS exposure across critical infrastructure sectors. (CISA)

CISA Adds Four Vulnerabilities to KEV Catalog, Later Corrects Listing

On September 30, 2024, CISA added four vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation, including flaws in D-Link DIR-820 routers, DrayTek Vigor routers, and SAP Commerce Cloud. CISA later removed one entry, a Motion Spell GPAC vulnerability, from the catalog after identifying a transcription error. Federal civilian agencies were required to remediate the remaining flaws by the catalog's specified due dates. (CISA)

CISA Publishes 2023 Annual Report for Vulnerability Disclosure Platform

On September 30, 2024, CISA released its Vulnerability Disclosure Policy Platform 2023 Annual Report, covering the service's second full year of operation. The report highlighted CISA's work supporting federal civilian executive branch agencies in identifying vulnerabilities and engaging the public security researcher community, building on Binding Operational Directive 20-01, which requires every FCEB agency to establish a vulnerability disclosure policy consistent with industry best practices. (CISA)