The Chinese Leadership is ever ready to express its offensive Cyber Capability and keep the adversaries ‘on toes’. The Cyber Attacks may be more ‘Strategically Deterrent’ in nature than just being one with ‘Financial Motive’. In a recent report by the US Government, more specific the Federal Security agency, an Alert was issued that “Chinese state-sponsored attackers are placing a heavy reliance on known but commonly unpatched vulnerabilities to establish a broad network of compromised infrastructure”. However, from a technical perspective, it can be hard to definitively say one country or organisation is attempting to perform such action, yet, the patterns of such attacks, always point to China. The Attackers have now realised that the investment into new exploits may be time consuming, and that the availability of known zero-day vulnerabilities and those unpatched vulnerabilities of assets, will provide better yield. Also, it has been understood that any novel exploits may grab the most headlines and can then lead to identification of the attacker.
The referred advisory issued by the US provides a list of network device CVEs most frequently exploited by Chinese state-sponsored cyber actors since 2020. This advisory has been issued with due deliberation and after the same has been authenticated by National Security Agency (NSA), the Cybersecurity and Infrastructure Security Agency (CISA), and the Federal Bureau of Investigation (FBI). It builds on previous NSA, CISA, and FBI reporting to inform federal and state, local, tribal, and territorial (SLTT) government; critical infrastructure (CI), including the Defence Industrial Base (DIB); and private sector organizations of the US and its Global Partners, about notable trends and persistent tactics, techniques, and procedures (TTPs), while referring to attacks on the Cyber Domain from China or Chines State sponsored attackers either form its own soil or form outside their country.
India can never isolate itself from the prevailing global threat and cannot alienate itself from adopting ‘Enterprise Vulnerability Remediation Strategies‘ to ensure better coverage for less severe but actively exploited vulnerabilities. This can be achieved only through extensive campaigns and awareness drives to ensure and implement the process of “Patching” and “Updating” of known vulnerabilities
A set of Tables Numbered 1 to 17, is listed below and provides the detailed management of these known vulnerabilities and the flaws in: Routers, SSL VPNs, and Network Attached Storage (NAS) devices from the likes of Cisco, Fortinet, Netgear, Citrix, DrayTek, D-Link, Mikrotik, Zyxel and QNAP Products. The tables also contain other vulnerabilities that are enterprise related like: Router Configurations, Remote Code Execution (RCE), Authentication Bypass, Privilege Elevation, VPN Management, etc.
The Alert No (AA22-158A) (Cybersecurity & Infrastructure Security Agency): https://www.cisa.gov/uscert/ncas/alerts/aa22-158a (Click on link for the complete report….)
Table 1: Top network device CVEs exploited by Chinese cyber actors
|
Vendor CVE Vulnerability Type |
||
|
Cisco |
CVE-2018-0171 |
Remote Code Execution |
|
CVE-2019-15271 |
RCE |
|
|
CVE-2019-1652 |
RCE |
|
|
Citrix |
CVE-2019-19781 |
RCE |
|
DrayTek |
CVE-2020-8515 |
RCE |
|
D-Link |
CVE-2019-16920 |
RCE |
|
Fortinet |
CVE-2018-13382 |
Authentication Bypass |
|
MikroTik |
CVE-2018-14847 |
Authentication Bypass |
|
Netgear |
CVE-2017-6862 |
RCE |
|
Pulse |
CVE-2019-11510 |
Authentication Bypass |
|
CVE-2021-22893 |
RCE |
|
|
QNAP |
CVE-2019-7192 |
Privilege Elevation |
|
CVE-2019-7193 |
Remote Inject |
|
|
CVE-2019-7194 |
XML Routing Detour Attack |
|
|
CVE-2019-7195 |
XML Routing Detour Attack |
|
|
Zyxel |
CVE-2020-29583 |
Authentication Bypass |
Table 2: Information on Cisco CVE-2018-0171
|
Cisco CVE-2018-0171 CVSS 3.0: 9.8 (Critical) |
|
Vulnerability Description A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition, or to execute arbitrary code on an affected device. The vulnerability is due to improper validation of packet data. An attacker could exploit this vulnerability by sending a crafted Smart Install message to an affected device on TCP port 4786. A successful exploit could allow the attacker to cause a buffer overflow on the affected device, which could have the following impacts: Triggering a reload of the device, Allowing the attacker to execute arbitrary code on the device, causing an indefinite loop on the affected device that triggers a watchdog crash. |
|
Recommended Mitigations
|
|
Detection Methods
|
|
Vulnerable Technologies and Versions The vulnerability affects Cisco devices that are running a vulnerable release of Cisco IOS or IOS XE software and have the smart install client feature enabled. Only smart install client switches are affected by this vulnerability described in this advisory. |
|
References http://www.securityfocus.com/bid/103538 |
Table 3: Information on Cisco CVE-2019-15271
|
Cisco CVE-2019-15271 CVSS 3.0: 8.8 (High) |
|
Vulnerability Description A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker to execute arbitrary commands with root privileges. The attacker must have either a valid credential or an active session token. The vulnerability is due to lack of input validation of the HTTP payload. An attacker could exploit this vulnerability by sending a malicious HTTP request to the web-based management interface of the targeted device. A successful exploit could allow the attacker to execute commands with root privileges. |
|
Recommended Mitigations
|
|
Detection Methods
|
|
Vulnerable Technologies and Versions This vulnerability affects the following Cisco Small Business RV Series Routers if they are running a firmware release earlier than 4.2.3.10:
|
|
References https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191106-sbrv-cmd-x |
Table 4: Information on Cisco CVE-2019-1652
|
Cisco CVE-2019-1652 CVSS 3.0: 7.2 (High) |
|
Vulnerability Description A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands. The vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending malicious HTTP POST requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux shell as root. Cisco has released firmware updates that address this vulnerability. |
|
Recommended Mitigations
|
|
Detection Methods
|
|
Vulnerable Technologies and Versions This vulnerability affects Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers running firmware releases 1.4.2.15 through 1.4.2.20. |
|
References http://www.securityfocus.com/bid/106728 |
Table 5: Information on Citrix CVE-2019-19781
|
Citrix CVE-2019-19781 CVSS 3.0: 9.8 (Critical) |
|
Vulnerability Description An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal. |
|
Recommended Mitigations
|
|
Detection Methods
|
|
Vulnerable Technologies and Versions The vulnerability affects the following Citrix product versions on all supported platforms:
|
|
References |
Table 6: Information on DrayTek CVE-2020-8515
|
DrayTek CVE-2020-8515 CVSS 3.0: 9.8 (Critical) |
|
Vulnerability Description DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via shell metacharacters to the cgi-bin/mainfunction.cgi URI. This issue has been fixed in Vigor3900/2960/300B v1.5.1. |
|
Recommended Mitigations
|
|
Detection Methods
|
|
Vulnerable Technologies and Versions
|
|
References https://draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-router-web-management-page-vulnerability-(cve-2020-8515)/ |
Table 7: Information on D-Link CVE-2019-16920
|
D-Link CVE-2019-16920 CVSS 3.0: 9.8 (Critical) |
|
Vulnerability Description Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a “PingTest” device common gateway interface that could lead to common injection. An attacker who successfully triggers the command injection could achieve full system compromise. Later, it was independently found that these are also affected: DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, and DIR-825. |
|
Recommended Mitigations
|
|
Detection Methods
|
|
Vulnerable Technologies and Versions
|
|
References https://www.kb.cert.org/vuls/id/766427 |
Table 8: Information on Fortinet CVE-2018-13382
|
Fortinet CVE-2018-13382 CVSS 3.0: 7.5 (High) |
|
Vulnerability Description An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to modify the password of an SSL VPN web portal user via specially crafted HTTP requests. |
|
Recommended Mitigations
|
|
Detection Methods
|
|
Vulnerable Technologies and Versions This vulnerability affects the following products:
FortiOS products are vulnerable only if the SSL VPN service (web-mode or tunnel-mode) is enabled and users with local authentication. |
|
References https://fortiguard.com/psirt/FG-IR-18-389 |
Table 9: Information on Mikrotik CVE-2018-14847
|
Mikrotik CVE-2018-14847 CVSS 3.0: 9.1 (Critical) |
|
Vulnerability Description MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface. |
|
Recommended Mitigations
|
|
Detection Methods
|
|
Vulnerable Technologies and Versions This vulnerability affected the following MikroTik products:
|
|
References https://blog.mikrotik.com/security/winbox-vulnerability.html |
Table 10: Information on Netgear CVE-2017-6862
|
Netgear CVE-2017-6862 CVSS 3.0: 9.8 (Critical) |
|
Vulnerability Description NETGEAR WNR2000v3 devices before 1.1.2.14, WNR2000v4 devices before 1.0.0.66, and WNR2000v5 devices before 1.0.0.42 allow authentication bypass and remote code execution via a buffer overflow that uses a parameter in the administration webapp. The NETGEAR ID is PSV-2016-0261. |
|
Recommended Mitigations
|
|
Detection Methods
|
|
Vulnerable Technologies and Versions This vulnerability affects the following products:
|
|
References https://kb.netgear.com/000038542/Security-Advisory-for-Unauthenticated-Remote-Code-Execution-on-Some-Routers-PSV-2016-0261 |
Table 11: Information on Pulse CVE-2019-11510
|
Pulse CVE-2019-11510 CVSS 3.0: 10 (Critical) |
|
Vulnerability Description In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitrary file reading vulnerability. |
|
Recommended Mitigations
|
|
Detection Methods
|
|
Vulnerable Technologies and Versions This vulnerability affects the following Pulse Connect Secure products:
|
|
References https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101/ |
Table 12: Information on Pulse CVE-2021-22893
|
Pulse CVE-2021-22893 CVSS 3.0: 10 (Critical) |
|
Vulnerability Description Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild. |
|
Recommended Mitigations
|
|
Detection Methods
|
|
Vulnerable Technologies and Versions This vulnerability affects Pulse Connect Secure 9.0R3/9.1R1 and higher. |
|
References https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101/ |
Table 13: Information on QNAP CVE-2019-7192
|
QNAP CVE-2019-7192 CVSS 3.0: 9.8 (Critical) |
|
Vulnerability Description This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix these vulnerabilities, QNAP recommend updating Photo Station to their latest versions. |
|
Recommended Mitigations Update Photo Station to versions:
|
|
Detection Methods
|
|
Vulnerable Technologies and Versions This vulnerability affects QNAP Photo Station versions 5.2.11, 5.4.9, 5.7.10, and 6.0.3 or earlier. |
|
References https://www.qnap.com/zh-tw/security-advisory/nas-201911-25 |
Table 14: Information on QNAP CVE- 2019-7193
|
QNAP CVE-2019-7193 CVSS 3.0: 9.8 (Critical) |
|
Vulnerability Description This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP recommend updating QTS to their latest versions. |
|
Recommended Mitigations Update QTS to versions:
|
|
Detection Methods
|
|
Vulnerable Technologies and Versions This vulnerability affects QNAP QTS 4.3.6 and 4.4.1 or earlier. |
|
References https://www.qnap.com/zh-tw/security-advisory/nas-201911-25 |
Table 15: Information on QNAP CVE-2019-7194
|
QNAP CVE-2019-7194 CVSS 3.0: 9.8 (Critical) |
|
Vulnerability Description This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions. |
|
Recommended Mitigations Update Photo Station to versions:
|
|
Detection Methods
|
|
Vulnerable Technologies and Versions This vulnerability affects QNAP Photo Station versions 5.2.11, 5.4.9, 5.7.10, and 6.0.3 or earlier. |
|
References https://www.qnap.com/zh-tw/security-advisory/nas-201911-25 |
Table 16: Information on QNAP CVE-2019-7195
|
QNAP CVE-2019-7195 CVSS 3.0: 9.8 (Critical) |
|
Vulnerability Description This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions. |
|
Recommended Mitigations Update Photo Station to versions:
|
|
Detection Methods
|
|
Vulnerable Technologies and Versions This vulnerability affects QNAP Photo Station versions 5.2.11, 5.4.9, 5.7.10, and 6.0.3 or earlier. |
|
References https://www.qnap.com/zh-tw/security-advisory/nas-201911-25 |
Table 17: Information on Zyxel CVE-2020-29583
|
Zyxel CVE-2020-29583 CVSS 3.0: 9.8 (Critical) |
|
Vulnerability Description Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the SSH server or web interface with admin privileges. |
|
Recommended Mitigations
|
|
Detection Methods
|
|
Vulnerable Technologies and Versions This vulnerability affects the following technologies and versions:
|
|
References http://ftp.zyxel.com/USG40/firmware/USG40_4.60(AALA.1)C0_2.pdf |
The Alert NO (AA22-158A) (Cybersecurity & Infrastructure Security Agency): https://www.cisa.gov/uscert/ncas/alerts/aa22-158a (Click on link for the complete report….)