cyber.hendryadrian.com
Security News · cyble.com

Cyble Reports Exploitation Attempts and 54 Vulnerabilities in CISA ICS Advisories

· Original article ↗

Summary

Cyble reports attacks against about 20 known flaws, alongside malware, phishing and brute-force activity. CISA issued 14 ICS advisories covering 54 vulnerabilities, including 13 rated critical.

Key points

  • Cyble sensors recorded exploitation attempts against flaws in WordPress, Apache Solr, Langflow, n8n and older IoT and embedded-device software.
  • CISA's 14 ICS advisories covered 54 vulnerabilities: 13 critical, 18 high, 18 medium and five low.
  • Critical issues affected products including Toptech fuel-terminal systems, Lantronix gateways, MikroTik routers and VIVOTEK cameras; some products had no vendor fix referenced.
  • A MacSync infostealer campaign targeted cryptocurrency users and developers with fake wallet disk images, stealing credentials, wallet data and development-related files.
  • Sensors also observed malware activity, phishing and advance-fee scams, and brute-force attempts against exposed remote-access and database services.
  • Recommended steps include patching exposed systems, replacing default credentials, restricting exposed services, segmenting IT and OT networks, and isolating unpatched ICS products.

Article Details

Event Type
Weekly vulnerability and threat activity report covering exploitation attempts observed by Cyble sensors and CISA industrial control system advisories.
Impact
Cyble reported attempts against about 20 known vulnerabilities, alongside malware, phishing, and brute-force activity. CISA issued 14 ICS advisories covering 54 vulnerabilities, including 13 rated critical. Reported risks include remote code execution, unauthorized firmware installation, exposure of credentials and system data, and potential interference with industrial processes. Some affected products had no vendor fix referenced.

CVE

CVE-2017-0147WannaCry: Ransomware that spreads through the EternalBlue exploit, targeting CVE-2017-0147 CVE-2018-10561A Mirai variant is also targeting Dasan GPON home routers by chaining CVE-2018-10561 and CVE-2018-10562.CVE-2018-10562A Mirai variant is also targeting Dasan GPON home routers by chaining CVE-2018-10561 and CVE-2018-10562.CVE-2019-0708CVE-2019-0708, a critical unauthenticated RCE in Microsoft Remote Desktop Services CVE-2019-12255A group of four Wind River VxWorks TCP buffer overflows: CVE-2019-12255, CVE-2019-12260, CVE-2019-12261, and CVE-2019-12263 CVE-2019-12260A group of four Wind River VxWorks TCP buffer overflows: CVE-2019-12255, CVE-2019-12260, CVE-2019-12261, and CVE-2019-12263 CVE-2019-12261A group of four Wind River VxWorks TCP buffer overflows: CVE-2019-12255, CVE-2019-12260, CVE-2019-12261, and CVE-2019-12263 CVE-2019-12263A group of four Wind River VxWorks TCP buffer overflows: CVE-2019-12255, CVE-2019-12260, CVE-2019-12261, and CVE-2019-12263 CVE-2020-11899CVE-2020-11899, an IPv6 out-of-bounds read in the Treck TCP/IP stack, drew far more exploitation attempts than any other CVE this week.CVE-2020-11900CVE-2020-11900, an IPv4 tunneling double-free in the Treck TCP/IP stack CVE-2020-11910CVE-2020-11910, an ICMPv4 out-of-bounds read in the Treck TCP/IP stack CVE-2023-46604Armatura One is affected by CVE-2023-46604, a critical deserialization flaw, plus hardcoded key and credential issues.CVE-2024-25600CVE-2024-25600, a code injection flaw in Bricks Builder 1.9.6 and earlier CVE-2024-4577CVE-2024-4577, a critical PHP-CGI argument injection flaw CVE-2024-6587CVE-2024-6587 — LiteLLM CVE-2024-7591CVE-2024-7591, an OS command injection flaw in Progress LoadMaster CVE-2025-2010CVE-2025-2010, an unauthenticated SQL injection flaw in the JobWP WordPress plugin CVE-2025-3248Sensors also caught attempts against an older Langflow code injection flaw, CVE-2025-3248.CVE-2025-46565CVE-2025-46565, a file access control bypass in the Vite development server CVE-2025-58360CVE-2025-58360, an XML external entity (XXE) flaw in GeoServer’s GetMap operation CVE-2025-68613CVE-2025-68613 — n8n CVE-2026-100291Anjvision’s YSSD-RTMP-H5 firmware has nine vulnerabilities, led by CVE-2026-100291, a critical insecure default setting.CVE-2026-22755CVE-2026-22755 — VIVOTEK Cameras (Critical) CVE-2026-4020CVE-2026-4020 — Gravity SMTP CVE-2026-44825CVE-2026-44825 — Apache Solr CVE-2026-60137Attackers can chain it with CVE-2026-60137 to achieve SQL injection and potentially remote code execution (RCE).CVE-2026-63030CVE-2026-63030 — WordPress REST API CVE-2026-63713They include multiple SQL injection flaws (such as CVE-2026-72510 and CVE-2026-63713), an unrestricted file upload flaw (CVE-2026-70356), and files exposed to external parties (CVE-2026-71379).CVE-2026-70356They include multiple SQL injection flaws (such as CVE-2026-72510 and CVE-2026-63713), an unrestricted file upload flaw (CVE-2026-70356), and files exposed to external parties (CVE-2026-71379).CVE-2026-71379They include multiple SQL injection flaws (such as CVE-2026-72510 and CVE-2026-63713), an unrestricted file upload flaw (CVE-2026-70356), and files exposed to external parties (CVE-2026-71379).CVE-2026-72510They include multiple SQL injection flaws (such as CVE-2026-72510 and CVE-2026-63713), an unrestricted file upload flaw (CVE-2026-70356), and files exposed to external parties (CVE-2026-71379).CVE-2026-84409CVE-2026-91191 and CVE-2026-84409 — Lantronix G520 Series (High) CVE-2026-84411CVE-2026-84411 — MikroTik RouterOS (Critical) CVE-2026-91191CVE-2026-91191 and CVE-2026-84409 — Lantronix G520 Series (High) CVE-2026-9198CVE-2026-9198 — Langflow CVE-2026-95102CVE-2026-95102 — Monta (Critical) CVE-2026-96587The Viidure Dashcam Android app, version 3.3.1.260403 and earlier, contains hardcoded credentials (CVE-2026-96587, critical).

Malware

CoinMinerCoinMiner: Linux cryptominers that hijack CPU and GPU resources GafgytCRIL also observed Hajime, Gafgyt, and Wacatac activity.HajimeCRIL also observed Hajime, Gafgyt, and Wacatac activity.IRCBotIRCBot: Linux malware that uses IRC connections as a backdoor MacSyncMacSync Infostealer Targets Crypto Users MiraiA Mirai variant is also targeting Dasan GPON home routers by chaining CVE-2018-10561 and CVE-2018-10562.WacatacCRIL also observed Hajime, Gafgyt, and Wacatac activity.WannaCryWannaCry: Ransomware that spreads through the EternalBlue exploit, targeting CVE-2017-0147 

Vendors

AnjvisionAffected vendors include Toptech Systems, Lantronix, VIVOTEK, MikroTik, Armatura, Monta, Anjvision, and, unusually, CISA itself.ArmaturaAffected vendors include Toptech Systems, Lantronix, VIVOTEK, MikroTik, Armatura, Monta, Anjvision, and, unusually, CISA itself.CISAagainst Cyble’s global honeypot sensors, and what the Cybersecurity and Infrastructure Security Agency (CISA) disclosed for industrial control systems (ICS).CybleThis Cyble Research & Intelligence Labs (CRIL) weekly vulnerability report covers two views of risk: what attackers tried against Cyble’s global honeypot sensors, and what the Cybersecurity and Infrastructure SecurityLantronixAffected vendors include Toptech Systems, Lantronix, VIVOTEK, MikroTik, Armatura, Monta, Anjvision, and, unusually, CISA itself.MikroTikAffected vendors include Toptech Systems, Lantronix, VIVOTEK, MikroTik, Armatura, Monta, Anjvision, and, unusually, CISA itself.MontaAffected vendors include Toptech Systems, Lantronix, VIVOTEK, MikroTik, Armatura, Monta, Anjvision, and, unusually, CISA itself.Toptech SystemsAffected vendors include Toptech Systems, Lantronix, VIVOTEK, MikroTik, Armatura, Monta, Anjvision, and, unusually, CISA itself.VIVOTEKAffected vendors include Toptech Systems, Lantronix, VIVOTEK, MikroTik, Armatura, Monta, Anjvision, and, unusually, CISA itself.

Products

Apache SolrThey range from newly disclosed flaws in WordPress, Apache Solr, and Langflow to years-old bugs in GPON home routers and embedded TCP/IP stacks.Armatura OneAnjvision, Viidure, and Armatura One Bricks BuilderCVE-2024-25600, a code injection flaw in Bricks Builder 1.9.6 and earlier Cisco Adaptive Security Appliance (ASA)Scanning for the Cisco Adaptive Security Appliance (ASA) WebVPN login page Dasan GPONA Mirai variant is also targeting Dasan GPON home routers by chaining CVE-2018-10561 and CVE-2018-10562.GeoServerCVE-2025-58360, an XML external entity (XXE) flaw in GeoServer’s GetMap operation Gravity SMTPCVE-2026-4020 affects the Gravity SMTP WordPress plugin, versions 2.1.4 and earlier.JobWPCVE-2025-2010, an unauthenticated SQL injection flaw in the JobWP WordPress plugin LangflowThey range from newly disclosed flaws in WordPress, Apache Solr, and Langflow to years-old bugs in GPON home routers and embedded TCP/IP stacks.Lantronix G520 SeriesCVE-2026-91191 and CVE-2026-84409 — Lantronix G520 Series (High) LiteLLMCVE-2024-6587 is a server-side request forgery (SSRF) flaw in LiteLLM.MalcolmCISA Malcolm (15 Vulnerabilities) Microsoft Remote Desktop ServicesCVE-2019-0708, a critical unauthenticated RCE in Microsoft Remote Desktop Services MikroTik RouterOSCVE-2026-84411 — MikroTik RouterOS (Critical) n8nCVE-2025-68613 is a critical RCE flaw in the n8n workflow automation platform.Progress LoadMasterCVE-2024-7591, an OS command injection flaw in Progress LoadMaster QNAP QTSCommand injection flaws in QNAP QTS firmware TMS7Toptech Systems TMS7 and TopHAT (Critical) TopHATToptech Systems TMS7 and TopHAT (Critical) Treck TCP/IP stackCVE-2020-11899, an IPv6 out-of-bounds read in the Treck TCP/IP stack, drew far more exploitation attempts than any other CVE this week.Viidure Dashcam Android appThe Viidure Dashcam Android app, version 3.3.1.260403 and earlier, contains hardcoded credentials (CVE-2026-96587, critical).ViteCVE-2025-46565, a file access control bypass in the Vite development server VIVOTEK camerasCVE-2026-22755 — VIVOTEK Cameras (Critical) Wind River VxWorksA group of four Wind River VxWorks TCP buffer overflows: CVE-2019-12255, CVE-2019-12260, CVE-2019-12261, and CVE-2019-12263 WordPressThey range from newly disclosed flaws in WordPress, Apache Solr, and Langflow to years-old bugs in GPON home routers and embedded TCP/IP stacks.YSSD-RTMP-H5Anjvision’s YSSD-RTMP-H5 firmware has nine vulnerabilities, led by CVE-2026-100291, a critical insecure default setting.

Industries

ChemicalTMS7 is a terminal management system that controls liquid fuel and chemical distribution in the Energy, Chemical, and Transportation Systems sectors.Commercial FacilitiesEnergy was the most exposed sector this week, followed by Transportation Systems and Commercial Facilities.EnergyTMS7 is a terminal management system that controls liquid fuel and chemical distribution in the Energy, Chemical, and Transportation Systems sectors.Information TechnologyThe largest single combination, Energy, Information Technology, and Water and Wastewater, accounted for 27.8% of vulnerabilities.Transportation SystemsTMS7 is a terminal management system that controls liquid fuel and chemical distribution in the Energy, Chemical, and Transportation Systems sectors.Water and wastewaterThe largest single combination, Energy, Information Technology, and Water and Wastewater, accounted for 27.8% of vulnerabilities.

Related Articles