ZeroDay Findings
Sign inSign up

Every 4 hours

Cyber

Original briefings from the security press, rewritten for operators. Each story keeps the date of the report it is based on, links the identifiers it discusses, and points back to the original publication.

Threat intelligence

Trackers and reporting desks followed on the same four-hour update. New public reports are rewritten into the briefings below.

PrioritySourceWebsiteInformation
Ransomware.liveWebsiteRansomware.liveInformationRansomware groups, victims, incidents
The DFIR ReportWebsiteThe DFIR ReportInformationDetailed intrusion investigations
SANS Internet Storm CenterWebsiteSANS ISCInformationAttack observations and incident analysis
abuse.ch ThreatFoxWebsiteThreatFoxInformationIndicators of compromise
abuse.ch URLhausWebsiteURLhausInformationMalware distribution infrastructure
abuse.ch MalwareBazaarWebsiteMalwareBazaarInformationMalware hashes and metadata
abuse.ch Feodo TrackerWebsiteFeodo TrackerInformationBotnet command-and-control infrastructure
AlienVault OTXWebsiteAlienVault OTXInformationCommunity threat-intelligence indicators
PhishTankWebsitePhishTankInformationPhishing intelligence
Shadowserver FoundationWebsiteShadowserverInformationInternet exposure and threat reporting

  1. Jun 16, 2024 · ZeroDay Catalog

    Critical OS Command Injection Vulnerability in GeoVision Devices

    GeoVision devices are affected by a serious OS command injection vulnerability, allowing remote attackers to execute arbitrary commands.

    What changed

    A significant vulnerability has been identified in multiple GeoVision devices, specifically related to OS command injection. This flaw enables remote, unauthenticated attackers to inject and execute arbitrary system commands, posing a severe security risk.

    The affected products may include those that are already end-of-life (EoL) or end-of-service (EoS), which further complicates their security posture.

    Who is affected

    Organizations utilizing GeoVision products should be particularly vigilant, as the following groups are at risk:

    Users of GeoVision devices, including those running gv-dsp LPR firmware, are directly impacted by this vulnerability.

    • GeoVision device users, especially those with outdated firmware.
    • Organizations relying on video surveillance systems that incorporate GeoVision technology.
    • Security teams managing networked devices in environments where GeoVision products are deployed.

    What to do

    Given the nature of this vulnerability, immediate action is recommended. Users should evaluate their current deployment of GeoVision devices and consider the following steps:

    Discontinue the use of affected products, particularly if they are EoL or EoS, to mitigate potential risks.

    • Assess the inventory of GeoVision devices in use and identify those affected by this vulnerability.
    • Implement network segmentation to isolate vulnerable devices from critical systems.
    • Monitor for unusual activity that may indicate exploitation attempts.

    Original report

  2. May 2, 2024 · ZeroDay Catalog

    Critical Authentication Bypass Vulnerability in TP-Link TL-WR841N Routers

    A significant authentication bypass vulnerability has been identified in TP-Link TL-WR841N routers, allowing attackers to access sensitive information without authentication.

    What changed

    A newly discovered vulnerability in the TP-Link TL-WR841N routers allows network-adjacent attackers to exploit an authentication bypass flaw. This vulnerability is particularly concerning as it does not require authentication to access sensitive information.

    The flaw is rooted in the httpd service, which operates on TCP port 80 by default, leading to potential disclosure of stored credentials.

    Who is affected

    The vulnerability impacts users of TP-Link TL-WR841N routers, particularly those who have not updated their firmware to mitigate this issue.

    Network administrators and organizations utilizing these routers in their infrastructure should be particularly vigilant.

    • TP-Link TL-WR841N routers
    • Home users relying on TP-Link for network connectivity
    • Small to medium-sized businesses using TP-Link devices

    What to do

    It is crucial for affected users to take immediate action to secure their devices. Updating the firmware to the latest version provided by TP-Link is strongly recommended to mitigate this vulnerability.

    Network administrators should review their security policies and consider additional measures to protect against unauthorized access.

    • Update the firmware of TP-Link TL-WR841N routers as soon as possible.
    • Monitor network traffic for any unusual activity that may indicate exploitation attempts.
    • Consider implementing additional security measures, such as firewalls or intrusion detection systems.

    Original report