CISA Warns of Actively Exploited Vulnerabilities in Samsung and D-Link Devices
Based on evidence of active exploitation, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a set of eight vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog.
This contains two vulnerabilities for D-Link products and six flaws affecting Samsung cell phones. By 2021, every issue has been fixed.
This includes six shortcomings affecting Samsung smartphones and two vulnerabilities impacting D-Link devices. All the flaws have been patched as of 2021.
- CVE-2021-25394 (CVSS score: 6.4) – Samsung mobile devices race condition vulnerability
- CVE-2021-25395 (CVSS score: 6.4) – Samsung mobile devices race condition vulnerability
- CVE-2021-25371 (CVSS score: 6.7) – An unspecified vulnerability in the DSP driver used in Samsung mobile devices that allows the loading of arbitrary ELF libraries
- CVE-2021-25372 (CVSS score: 6.7) – Samsung mobile devices improper boundary check within the DSP driver in Samsung mobile devices
- CVE-2021-25487 (CVSS score: 7.8) – Samsung mobile devices out-of-bounds read vulnerability leading to arbitrary code execution
- CVE-2021-25489 (CVSS score: 5.5) – Samsung Mobile devices improper input validation vulnerability resulting in kernel panic
- CVE-2019-17621 (CVSS score: 9.8) – An unauthenticated remote code execution vulnerability in D-Link DIR-859 Router
- CVE-2019-20500 (CVSS score: 7.8) – An authenticated OS command injection vulnerability in D-Link DWL-2600AP
The two D-Link vulnerabilities were included in response to a Palo Alto Networks Unit 42 report published last month concerning threat actors linked to a Mirai botnet variant that used vulnerabilities in a number of IoT devices to spread the malware in a series of attacks starting in March 2023.
Our Readers ALSO READ
Tackling Critical Vulnerability in NAS Devices By Zyxel
It’s not immediately obvious, though, how Samsung device faults are being used in the field. But given the nature of the targeting, it’s likely that a commercial spyware vendor may have used them in extremely focused operations.
It’s worth noting that Google Project Zero disclosed a set of flaws in November 2022 that it said were weaponized as part of an exploit chain aimed at Samsung handsets.
Federal Civilian Executive Branch (FCEB) organizations must implement the necessary modifications by July 20, 2023, in order to secure their networks against potential threats in light of active exploitation.
Like this article? Follow our LinkedIn, and Facebook handles for the daily content we post.
