Week of April 7, 2025: Sensata Ransomware Disclosure, Krebs Clearance Revoked

Security leaders tracked Sensata Technologies' SEC disclosure of a ransomware incident, a presidential order revoking former CISA director Chris Krebs's security clearance along with clearances tied to SentinelOne, and three rounds of CISA Known Exploited Vulnerabilities additions spanning CrushFTP, Gladinet CentreStack, Windows CLFS, and Linux Kernel flaws. CISA also issued ten Industrial Control Systems advisories and warned FortiGate administrators about a new post-exploitation technique abusing previously patched Fortinet vulnerabilities.

Sensata Technologies discloses ransomware incident in SEC filing

Sensata Technologies Holding plc disclosed in a Form 8-K filed April 9, 2025, that it had experienced a ransomware incident encrypting devices on its network, discovered April 6, 2025. The company took its network offline, notified law enforcement, and found evidence that files were taken from its environment. The incident disrupted shipping, receiving, and manufacturing operations, with full restoration timing undetermined. Sensata stated it did not yet expect a material impact on second-quarter results but acknowledged the full scope remained unclear. (SEC EDGAR)

CISA adds CrushFTP authentication bypass to exploited vulnerabilities catalog

CISA added CVE-2025-31161, a CrushFTP authentication bypass vulnerability, to its Known Exploited Vulnerabilities Catalog on April 7, 2025, citing evidence of active exploitation. The addition triggered remediation deadlines for Federal Civilian Executive Branch agencies under Binding Operational Directive 22-01 and signaled to enterprise security teams that internet-facing file transfer software remained an active target for attackers. CISA again urged all organizations, not only federal agencies, to prioritize patching catalog vulnerabilities as part of routine vulnerability management practice. (CISA)

CISA flags exploited Gladinet CentreStack and Windows CLFS flaws

CISA added two more vulnerabilities to its Known Exploited Vulnerabilities Catalog on April 8, 2025: CVE-2025-30406, a hard-coded cryptographic key flaw in Gladinet CentreStack, and CVE-2025-29824, a use-after-free vulnerability in the Windows Common Log File System driver. Both carried evidence of active exploitation, prompting Federal Civilian Executive Branch agencies to remediate under Binding Operational Directive 22-01. CISA again urged all organizations to prioritize these flaws in their vulnerability management practices given the risk they pose to federal and private networks. (CISA)

CISA adds two Linux Kernel flaws to KEV catalog

CISA added two Linux Kernel vulnerabilities, CVE-2024-53197 and CVE-2024-53150, both out-of-bounds flaws, to its Known Exploited Vulnerabilities Catalog on April 9, 2025, based on evidence of active exploitation. The additions underscored continuing attacker interest in kernel-level memory-safety bugs as an attack vector and added further remediation deadlines for Federal Civilian Executive Branch agencies under Binding Operational Directive 22-01, while CISA again urged broader organizations to factor catalog entries into their vulnerability management programs. (CISA)

CISA releases ten Industrial Control Systems advisories

CISA released ten Industrial Control Systems advisories on April 10, 2025, covering products from Siemens, Rockwell Automation, ABB, Subnet Solutions, and INFINITT Healthcare. The advisories spanned Siemens's License Server, SIDIS Prime, Solid Edge, Industrial Edge Devices, Insights Hub Private Cloud, and SENTRON data manager products, plus Rockwell's Arena software, Subnet Solutions' PowerSYSTEM Center, ABB's Arctic Wireless Gateways, and INFINITT's PACS platform. CISA encouraged users and administrators to review the newly released advisories for technical details and mitigations. (CISA)

Fortinet warns of post-exploitation technique abusing patched FortiGate flaws

CISA published an alert on April 11, 2025, flagging a new post-exploitation technique that let a threat actor create a malicious file on FortiGate devices by leveraging previously exploited Fortinet vulnerabilities CVE-2024-21762, CVE-2023-27997, and CVE-2022-42475. The file could grant read-only access to the device's file system, potentially exposing configurations. Fortinet notified affected customers directly, and CISA recommended upgrading to patched FortiOS versions, reviewing device configurations, resetting exposed credentials, and disabling SSL-VPN as an interim mitigation. (CISA)