{"id":12147,"date":"2022-11-18T06:00:45","date_gmt":"2022-11-18T13:00:45","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?post_type=patch_watch&#038;p=12147"},"modified":"2023-02-17T13:32:23","modified_gmt":"2023-02-17T20:32:23","slug":"dhs-cisa-kevs-weekly-edition-23-patch-before-you-hit-the-deadline","status":"publish","type":"patch_watch","link":"https:\/\/webdev.securin.xyz\/patch_watch\/dhs-cisa-kevs-weekly-edition-23-patch-before-you-hit-the-deadline\/","title":{"rendered":"DHS CISA KEVs Weekly Edition 23: Patch Before You Hit the Deadline"},"content":{"rendered":"<p dir=\"ltr\">In the first two weeks of November, CISA added 10 vulnerabilities to the KEV catalog. They are currently being exploited by hackers.\u00a0 In this blog, we have analyzed the CVEs that CISA recommends be patched in all federal organizations between 14-11-2022 and 29-11-2022.<\/p>\n<p><img decoding=\"async\" style=\"width: 750px; height: 410px;\" src=\"https:\/\/cybersecurityworks.com\/howdymanage\/uploads\/image\/patch-watch\/cisa\/dhs-23\/patchwatch-1-4.png\" alt=\"\" \/><\/p>\n<p>&nbsp;<\/p>\n<h2 dir=\"ltr\">Why are these CVEs important?<\/h2>\n<p>&nbsp;<\/p>\n<p dir=\"ltr\">From our analysis we found that:<\/p>\n<p>&nbsp;<\/p>\n<ul>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">CVE-2022-3723, the <a href=\"https:\/\/cybersecurityworks.com\/blog\/cyber-risk\/csws-threat-intelligence-october-24-2022-october-28-2022.html#CVE-2022-3723%20:%20Google%20Fixes%20Another%20Zero-Day%20Flaw\">7th zero-day vulnerability from Google<\/a> was exploited in the wild, following which a patch was released. A week later the CISA added it to the list of critical vulnerabilities.<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">CVE-2020-3433 and CVE-2020-3153 are CISCO Anyconnect Secure vulnerabilities which allow both remote code execution and privilege escalation in vulnerable devices.<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">CVE-2021-25337, CVE-2021-25370, and CVE-2021-25369 are Samsung device vulnerabilities which can be exploited to install spyware on phones.<\/p>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<h2 dir=\"ltr\">How Far Back Do They Go?<\/h2>\n<p>&nbsp;<\/p>\n<p dir=\"ltr\">Half of the CVEs are old vulnerabilities (discovered before 2022) and exploited by many ransomware groups. In particular, the BlackByte ransomware group is after the 2018 CVEs (CVE-2018-19321, CVE-2018-19322, CVE-2018-19323).<\/p>\n<p><img decoding=\"async\" style=\"width: 550px; height: 392px;\" src=\"https:\/\/cybersecurityworks.com\/howdymanage\/uploads\/image\/patch-watch\/cisa\/dhs-23\/patchwatch-2-4.png\" alt=\"\" \/><\/p>\n<h2 dir=\"ltr\"><\/h2>\n<h2 dir=\"ltr\">Which Vendors Are Affected?<\/h2>\n<p dir=\"ltr\">Microsoft and GIGABYTE have the most number of vulnerabilities to be patched by the end of this month. Notable vulnerabilities in Microsoft are CVE-2022-41073 (privilege escalation) and <a href=\"https:\/\/cybersecurityworks.com\/blog\/cyber-risk\/csws-threat-intelligence-november-7-2022-november-11-2022.html#Microsoft%20Fixes%2062%20vulnerabilities%20in%20November%20Patch%20Tuesday\">CVE-2022-41091<\/a> (Mark-of-the-web).<\/p>\n<p><img decoding=\"async\" style=\"width: 550px; height: 367px;\" src=\"https:\/\/cybersecurityworks.com\/howdymanage\/uploads\/image\/patch-watch\/cisa\/dhs-23\/patchwatch-3-4.png\" alt=\"\" \/><\/p>\n<p dir=\"ltr\">Organizations must keep themselves up-to-date with these vendor advisories and upgrade their products as and when new patches are released.<\/p>\n<p>&nbsp;<\/p>\n<h2 dir=\"ltr\">Severity Scores<\/h2>\n<p>&nbsp;<\/p>\n<p dir=\"ltr\">Most of the vulnerabilities are ranked high on the CVSS scoring scale. Exploiting such vulnerabilities will allow attackers to cause maximum damage to their victim networks. CISCO (CVE-2020-3433 and CVE-2020-3153) vulnerabilities are actively exploited by the OldGremlin ransomware group.<\/p>\n<p><img decoding=\"async\" style=\"width: 550px; height: 417px;\" src=\"https:\/\/cybersecurityworks.com\/howdymanage\/uploads\/image\/patch-watch\/cisa\/dhs-23\/patchwatch-5-4.png\" alt=\"\" \/><\/p>\n<p>&nbsp;<\/p>\n<h2 dir=\"ltr\">Software Weaknesses<\/h2>\n<p>&nbsp;<\/p>\n<p dir=\"ltr\">The following CWEs have caused the vulnerabilities that need to be patched this week.<\/p>\n<p><img decoding=\"async\" style=\"width: 550px; height: 394px;\" src=\"https:\/\/cybersecurityworks.com\/howdymanage\/uploads\/image\/patch-watch\/cisa\/dhs-23\/patchwatch-4-4.png\" alt=\"\" \/><\/p>\n<p>&nbsp;<\/p>\n<p dir=\"ltr\">CVE-2018-19320, CVE-2022-41073, CVE-2022-41128, CVE-2022-41125, CVE-2018-19321, CVE-2022-41091, CVE-2018-19323 do not have any CWE associated with it.<\/p>\n<p>&nbsp;<\/p>\n<p><iframe class=\"airtable-embed\" style=\"background: transparent; border: 1px solid #ccc;\" src=\"https:\/\/airtable.com\/embed\/shrea4asaZl7h3HPK?backgroundColor=blue&amp;viewControls=on\" width=\"100%\" height=\"533\" frameborder=\"0\"><\/iframe><\/p>\n<p dir=\"ltr\" style=\"text-align: center;\"><strong>Table: DHS CISA KEVs<\/strong><\/p>\n<p dir=\"ltr\">We urge organizations to implement patches for these CVEs at the earliest.\u00a0 10 of these vulnerabilities are trending right now and need immediate attention.With CSW\u2019s threat-based approach and vulnerability intelligence, security teams can prioritize the threats, including all KEVs, and minimize their attack surface.<\/p>\n<p dir=\"ltr\">For the latest news regarding vulnerabilities that are exploited and critical threats, read our blog on <a href=\"https:\/\/cybersecurityworks.com\/blog\/cyber-risk\/csws-threat-intelligence-november-14-2022-november-18-2022.html\">Weekly Threat Intelligence<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the first two weeks of November, CISA added 10 vulnerabilities to the KEV catalog. They are currently being exploited by hackers.\u00a0 In this blog, we have analyzed the CVEs that CISA recommends be patched in all federal organizations between 14-11-2022 and 29-11-2022. &nbsp; Why are these CVEs important? &nbsp; From our analysis we found [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":14436,"parent":0,"menu_order":0,"template":"","meta":{"content-type":""},"patch_category":[],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/patch_watch\/12147"}],"collection":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/patch_watch"}],"about":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/types\/patch_watch"}],"author":[{"embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/users\/1"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/media\/14436"}],"wp:attachment":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/media?parent=12147"}],"wp:term":[{"taxonomy":"patch_category","embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/patch_category?post=12147"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}