Latest Command Injection news

Cisco warns of NX-OS zero-day exploited to deploy custom malware

Cisco has patched an NX-OS zero-day exploited in April attacks to install previously unknown malware as root on vulnerable switches.
- Sergiu Gatlan
- July 01, 2024
- 01:46 PM
- 0
Zyxel issues emergency RCE patch for end-of-life NAS devices

Zyxel Networks has released an emergency security update to address three critical vulnerabilities impacting older NAS devices that have reached end-of-life.
- Bill Toulas
- June 04, 2024
- 01:28 PM
- 0
Palo Alto Networks fixes zero-day exploited to backdoor firewalls

Palo Alto Networks has started releasing hotfixes for a zero-day vulnerability that has been actively exploited since March 26th to backdoor PAN-OS firewalls.
- Sergiu Gatlan
- April 15, 2024
- 08:59 AM
- 1
Palo Alto Networks warns of PAN-OS firewall zero-day used in attacks

Today, Palo Alto Networks warns that an unpatched critical command injection vulnerability in its PAN-OS firewall is being actively exploited in attacks.
- Bill Toulas
- April 12, 2024
- 09:28 AM
- 0
Critical Rust flaw enables Windows command injection attacks

Threat actors can exploit a security vulnerability in the Rust standard library to target Windows systems in command injection attacks.
- Sergiu Gatlan
- April 09, 2024
- 04:20 PM
- 2
Over 90,000 LG Smart TVs may be exposed to remote attacks

Security researchers at Bitdefender have discovered four vulnerabilities impacting multiple versions of WebOS, the operating system used in LG smart TVs.
- Bill Toulas
- April 09, 2024
- 09:00 AM
- 3
Critical RCE bug in 92,000 D-Link NAS devices now exploited in attacks

Attackers are now actively targeting over 92,000 end-of-life D-Link Network Attached Storage (NAS) devices exposed online and unpatched against a critical remote code execution (RCE) zero-day flaw.
- Sergiu Gatlan
- April 08, 2024
- 06:17 PM
- 1
Over 92,000 exposed D-Link NAS devices have a backdoor account

A threat researcher has disclosed a new arbitrary command injection and hardcoded backdoor flaw in multiple end-of-life D-Link Network Attached Storage (NAS) device models.
- Bill Toulas
- April 06, 2024
- 10:16 AM
- 0
QNAP warns of critical auth bypass flaw in its NAS devices

QNAP warns of vulnerabilities in its NAS software products, including QTS, QuTS hero, QuTScloud, and myQNAPcloud, that could allow attackers to access devices.
- Bill Toulas
- March 08, 2024
- 03:03 PM
- 0
Fortinet warns of new FortiSIEM RCE bugs in confusing disclosure

Fortinet is warning of two new unpatched patch bypasses for a critical remote code execution vulnerability in FortiSIEM, Fortinet's SIEM solution.
- Lawrence Abrams
- February 07, 2024
- 07:55 PM
- 0
Over 1,450 pfSense servers exposed to RCE attacks via bug chain

Roughly 1,450 pfSense instances exposed online are vulnerable to command injection and cross-site scripting flaws that, if chained, could enable attackers to perform remote code execution on the appliance.
- Bill Toulas
- December 12, 2023
- 09:00 AM
- 2
Zyxel warns of multiple critical vulnerabilities in NAS devices

Zyxel has addressed multiple security issues, including three critical ones that could allow an unauthenticated attacker to execute operating system commands on vulnerable network-attached storage (NAS) devices.
- Bill Toulas
- November 30, 2023
- 10:11 AM
- 0
Fortinet warns of critical command injection bug in FortiSIEM

Fortinet is alerting customers of a critical OS command injection vulnerability in FortiSIEM report server that could be exploited by remote, unauthenticated attackers to execute commands through specially crafted API requests.
- Bill Toulas
- November 16, 2023
- 10:20 AM
- 0
QNAP warns of critical command injection flaws in QTS OS, apps

QNAP Systems published security advisories for two critical command injection vulnerabilities that impact multiple versions of the QTS operating system and applications on its network-attached storage (NAS) devices.
- Bill Toulas
- November 06, 2023
- 07:47 AM
- 0
Zyxel warns of critical command injection flaw in NAS devices

Zyxel is warning its NAS (Network Attached Storage) devices users to update their firmware to fix a critical severity command injection vulnerability.
- Bill Toulas
- June 20, 2023
- 10:26 AM
- 0
VMware fixes critical vulnerabilities in vRealize network analytics tool

VMware issued multiple security patches today to address critical and high-severity vulnerabilities in VMware Aria Operations for Networks, allowing attackers to gain remote execution or access sensitive information.
- Sergiu Gatlan
- June 07, 2023
- 11:09 AM
- 0
Hackers exploit critical Zyxel firewall flaw in ongoing attacks

Hackers are performing widespread exploitation of a critical-severity command injection flaw in Zyxel networking devices, tracked as CVE-2023-28771, to install malware.
- Bill Toulas
- May 31, 2023
- 01:54 PM
- 0
Aruba Networks fixes six critical vulnerabilities in ArubaOS

Aruba Networks published a security advisory to inform customers about six critical-severity vulnerabilities impacting multiple versions of ArubaOS, its proprietary network operating system.
- Bill Toulas
- March 01, 2023
- 05:15 PM
- 1
Cisco fixes bug allowing backdoor persistence between reboots

Cisco has released security updates this week to address a high-severity vulnerability in the Cisco IOx application hosting environment that can be exploited in command injection attacks.
- Sergiu Gatlan
- February 02, 2023
- 12:07 PM
- 0
Hackers exploit Cacti critical bug to install malware, open reverse shells

More than 1,600 instances of the Cacti device monitoring tool reachable over the internet are vulnerable to a critical security issue that hackers have already started to exploit.
- Ionut Ilascu
- January 15, 2023
- 07:39 PM
- 0