Week of January 20, 2025: CISA's Ivanti Advisory and New KEV Additions

Security leaders tracked a joint CISA-FBI advisory detailing how threat actors chained four Ivanti Cloud Service Appliance vulnerabilities to gain network access, alongside two new Known Exploited Vulnerabilities Catalog additions covering SonicWall SMA1000 appliances and a legacy jQuery flaw. CISA also issued nine Industrial Control Systems advisories spanning mySCADA, Hitachi Energy, Schneider Electric, Siemens, ZF, and HMS Networks products, while Cyberhaven, Trellix, Abnormal Security, and MorganFranklin Cyber announced new security and executive leadership appointments.

CISA and FBI Detail Ivanti Cloud Service Exploitation Chain

CISA and the FBI released a joint advisory describing how threat actors chained four vulnerabilities—CVE-2024-8963, CVE-2024-9379, CVE-2024-8190, and CVE-2024-9380—in Ivanti Cloud Service Appliances during exploitation activity in September 2024. Using trusted third-party incident response data, the agencies found the vulnerabilities were combined to gain initial access, execute remote code, harvest credentials, and implant webshells on victim networks. CISA and FBI urged administrators to upgrade to the latest supported Ivanti CSA version and hunt for indicators of compromise listed in the advisory. (CISA)

CISA Issues Six ICS Advisories for mySCADA, Hitachi Energy, Schneider Electric, HMS Networks

CISA published six Industrial Control Systems advisories covering products from mySCADA, Hitachi Energy, Schneider Electric, and HMS Networks. The releases addressed mySCADA myPRO Manager, Hitachi Energy's RTU500 Series, Schneider Electric's EVlink Home Smart and Schneider Charge, Easergy Studio, and EcoStruxure Power Build Rapsody, plus HMS Networks' Ewon Flexy 202. CISA encouraged asset owners and administrators to review each advisory for technical details and mitigations covering the affected industrial equipment used across manufacturing and energy environments. (CISA)

CISA Adds SonicWall SMA1000 Flaw to KEV Catalog

CISA added one new vulnerability to its Known Exploited Vulnerabilities Catalog, citing evidence of active exploitation. The entry covered CVE-2025-23006, a deserialization vulnerability affecting SonicWall SMA1000 appliances. The addition triggers remediation deadlines for federal civilian executive branch agencies under Binding Operational Directive 22-01, which requires agencies to patch catalog entries by a set due date. CISA urged all organizations, not just federal agencies, to prioritize remediation of catalog vulnerabilities as part of routine vulnerability management practice. (CISA)

CISA Adds Legacy jQuery XSS Flaw to KEV Catalog

CISA added CVE-2020-11023, a cross-site scripting vulnerability affecting jQuery, to its Known Exploited Vulnerabilities Catalog after confirming evidence of active exploitation. The addition joined the SonicWall entry added two days earlier and required remediation by federal civilian executive branch agencies under Binding Operational Directive 22-01. CISA reiterated that these vulnerability types remain frequent attack vectors for malicious actors and urged all organizations to prioritize remediation as part of routine vulnerability management. (CISA)

CISA Issues Three ICS Advisories for TCAS II, Siemens, ZF

CISA released three Industrial Control Systems advisories covering the Traffic Alert and Collision Avoidance System (TCAS) II, Siemens SIMATIC S7-1200 CPUs, and ZF's Roll Stability Support Plus (RSSPlus) product. The advisories provided technical details on current security issues, vulnerabilities, and exploits affecting the named equipment. CISA encouraged users and administrators across aviation, industrial automation, and commercial vehicle sectors to review the advisories for mitigation guidance applicable to their deployed systems. (CISA)

Cyberhaven, Trellix, Abnormal Security Announce New Security Leadership

Data security company Cyberhaven named Chris Bates as Chief Security Officer, following prior cybersecurity leadership roles at SentinelOne, Nike, and Fidelis Cybersecurity. Abnormal Security appointed Lisa Banks as Chief Financial Officer, drawing on finance experience at SpotOn, ServiceNow, and Cisco. Trellix announced that Vishal Rao would succeed Bryan Palma as its next Chief Executive Officer while continuing to lead Skyhigh Security, and MorganFranklin Cyber named Keith Hollender as CEO. (SecurityWeek)