Source URL: https://www.cisa.gov/news-events/alerts/2024/12/18/cisa-adds-four-known-exploited-vulnerabilities-catalog
Source: Alerts
Title: CISA Adds Four Known Exploited Vulnerabilities to Catalog
Feedly Summary: CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.
CVE-2018-14933 NUUO NVRmini Devices OS Command Injection Vulnerability
CVE-2022-23227 NUUO NVRmini 2 Devices Missing Authentication Vulnerability
CVE-2019-11001 Reolink Multiple IP Cameras OS Command Injection Vulnerability
CVE-2021-40407 Reolink RLC-410W IP Camera OS Command Injection Vulnerability
These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.
Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the Known Exploited Vulnerabilities Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.
Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
AI Summary and Description: Yes
Summary: The text discusses new vulnerabilities added to CISA’s Known Exploited Vulnerabilities Catalog, highlighting the implications for security professionals in federal and other organizations. It emphasizes the importance of timely remediation to protect against active threats, particularly concerning specific vulnerabilities in devices commonly used in surveillance.
Detailed Description: The provided text outlines recent updates by the Cybersecurity and Infrastructure Security Agency (CISA) regarding vulnerabilities that are actively being exploited. The key points include:
– **New Vulnerabilities Listed**:
– CVE-2018-14933: NUUO NVRmini Devices OS Command Injection Vulnerability
– CVE-2022-23227: NUUO NVRmini 2 Devices Missing Authentication Vulnerability
– CVE-2019-11001: Reolink Multiple IP Cameras OS Command Injection Vulnerability
– CVE-2021-40407: Reolink RLC-410W IP Camera OS Command Injection Vulnerability
– **Significance of Vulnerabilities**:
– These vulnerabilities represent common attack vectors exploited by malicious cyber actors.
– They pose substantial risks to the security of federal networks and enterprises.
– **Binding Operational Directive (BOD) 22-01**:
– Establishes the Known Exploited Vulnerabilities Catalog, which is a dynamic list of CVEs posing significant risks.
– Requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by a given due date to mitigate active threats.
– **CISA’s Guidance for Organizations**:
– Although BOD 22-01 specifically addresses FCEB agencies, CISA strongly advises all organizations to prioritize the remediation of vulnerabilities in the catalog for more effective vulnerability management.
– CISA will keep updating the catalog with new vulnerabilities that meet the established criteria.
**Practical Implications for Security and Compliance Professionals**:
– **Vulnerability Management**: Organizations must integrate the proactive management of these vulnerabilities into their security protocols to ensure timely remediation.
– **Awareness of Active Threats**: Staying informed about the vulnerabilities listed in CISA’s catalog is essential for anticipating potential exploitation and securing their infrastructure against unknown threats.
– **Compliance Requirements**: For federal agencies, adherence to BOD 22-01 is mandatory, while for other organizations, aligning their vulnerability management strategies with such guidelines can bolster their security posture significantly.
Overall, the communication underscores the critical need for ongoing vigilance and effective remediation strategies in both federal and non-federal organizations to safeguard infrastructure against cyber threats.