Category Archives: Advisories

ZDI-24-502: (Pwn2Own) TP-Link Omada ER605 Buffer Overflow Remote Code Execution Vulnerability

Read Time:18 Second

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605 routers. Authentication is not required to exploit this vulnerability. However, devices are vulnerable only if configured to use the Comexe DDNS service. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2024-5243.

Read More

ZDI-24-501: (Pwn2Own) TP-Link Omada ER605 Stack-based Buffer Overflow Remote Code Execution Vulnerability

Read Time:18 Second

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605 routers. Authentication is not required to exploit this vulnerability. However, devices are vulnerable only if configured to use the Comexe DDNS service. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2024-5242.

Read More

ZDI-24-500: (Pwn2Own) TP-Link Omada ER605 Comexe DDNS Response Handling Heap-based Buffer Overflow Remote Code Execution Vulnerability

Read Time:18 Second

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605 routers. Authentication is not required to exploit this vulnerability. However, devices are vulnerable only if configured to use the Comexe DDNS service. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2024-5228.

Read More

ZDI-24-499: (Pwn2Own) TP-Link Omada ER605 PPTP VPN username Command Injection Remote Code Execution Vulnerability

Read Time:18 Second

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605 routers. Authentication is not required to exploit this vulnerability. However, devices are only vulnerable if configured to use a PPTP VPN with LDAP authentication. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2024-5227.

Read More

Genesis Market Malware Attack

Read Time:1 Minute, 23 Second

 What is the attack?The FortiGuard Lab’s EDR team recently identified malware infection exhibiting strong similarities to the previously reported Genesis Market malicious campaign that was dismantled by law enforcement in early 2023. The investigation traced some initial compromises to tools used for circumventing software licensing and counterfeit GPG MSI installers embedded with PowerShell scripts. Following the initial infection, the malware deploys a victim-specific DLL into the machine’s memory. This malware targets Edge, Chrome, Brave, and Opera browsers by installing a “Save to Google Drive” extension, which it uses to steal login credentials and sensitive personal data.What is Genesis Market?Genesis Market is a black market that deals in stolen login credentials, browser cookies, and online fingerprints. Its operation involves infecting victims, extracting data from their browsers, and maintaining persistence on the victim’s machine to steal new data. Although law enforcement agencies dismantled it in the first half of 2023, recent traces of infections suggest a possible attempt to revive its operations. What is the recommended Mitigation?Maintain general awareness and training about the risk of phishing and social engineering attacks. Ensure that all systems and software are kept up-to-date with the latest patches. Organizations can raise the security awareness of their employees that are being targeted by phishing, drive-by download and other forms of cyberattacks using Security Awareness Training.What FortiGuard Coverage is available?FortiEDR in full prevention mode prevents these attacks from propagating onto the machine pre-infection and can prevent exfiltration of data. FortiGuard AV service detects and blocks all the known malware and Web Filtering service has blocked all the known IoCs related to the campaign.

Read More

chromium-125.0.6422.76-1.fc40

Read Time:17 Second

FEDORA-2024-44edce9689

Packages in this update:

chromium-125.0.6422.76-1.fc40

Update description:

update to 125.0.6422.76

* High CVE-2024-5157: Use after free in Scheduling
* High CVE-2024-5158: Type Confusion in V8
* High CVE-2024-5159: Heap buffer overflow in ANGLE
* High CVE-2024-5160: Heap buffer overflow in Dawn

Read More

chromium-125.0.6422.76-1.fc39

Read Time:17 Second

FEDORA-2024-87bb7ffab1

Packages in this update:

chromium-125.0.6422.76-1.fc39

Update description:

update to 125.0.6422.76

* High CVE-2024-5157: Use after free in Scheduling
* High CVE-2024-5158: Type Confusion in V8
* High CVE-2024-5159: Heap buffer overflow in ANGLE
* High CVE-2024-5160: Heap buffer overflow in Dawn

Read More