Author: Zack

Security Advisory

Linux Local Privilege Escalation via udisksd and libblockdev (CVE-2025-6019) PoC released 

Summary : A local privilege escalation vulnerability poc has been released, tracked as CVE-2025-6019, discovered in the udisksd daemon and its backend libblockdev library, affecting widely used Linux distributions including Fedora and SUSE.

Severity High 
CVSS Score 7.0 
CVEs CVE-2025-6019 
POC Available Yes 
Actively Exploited No 
Exploited in Wild No 
Advisory Version 1.0 

Overview 

CVE-2025-6019 is a local privilege escalation (LPE) vulnerability affecting systems where: 

  • udisksd is installed and running (e.g., Fedora, SUSE) 
  • Users in the allow active group are trusted to execute disk-related actions 
  • libblockdev fails to validate privileged backend operations under unprivileged contexts 

This flaw allows unprivileged users in the “allow_active” group to escalate privileges and execute commands as root by exploiting insecure trust boundaries in D-Bus IPC communication. 

Vulnerability Name CVE ID Product Affected Severity 
​Local Privilege Escalation Vulnerability  CVE-2025-6019 udisksd / libblockdev  High 

Technical Summary 

This vulnerability is triggered when an attacker in the “allow_active” group issues a crafted D-Bus request to the udisksd daemon using tools like udisksctl. Because the daemon improperly relies on group membership alone (without UID validation), it mistakenly grants root-level mount permissions. 

An attacker can exploit this by  

  • Crafting a malicious disk image (like XFS with a SUID-root shell). 
  • Using “udisksctl mount -b /dev/loop0” to mount it as root. 
  • Escalating privileges and compromising the system. 
CVE ID System Affected  Vulnerability Details Impact 
CVE-2025-6019 Fedora, SUSE, and other Linux distros using udisks2/libblockdev Improper user validation in D-Bus authorization allows unprivileged users to perform privileged disk operations.  Local privilege escalation to root 

Remediation: 

Here are the recommendations below 

  • Update “udisks2” and “libblockdev” to the latest versions provided by your distribution. 
  • Audit and restrict membership of the “allow_active” group. 
  • Disable unsafe or legacy D-Bus actions in system services where possible. 

Conclusion: 
CVE-2025-6019 highlights a breakdown in privilege boundary enforcement within a core system component used by many Linux desktop environments.

The availability of a public PoC, combined with the low complexity of exploitation, makes this vulnerability highly dangerous, particularly in multi-user or shared computing environments. 

Organizations must act swiftly to patch vulnerable systems, reassess group-based privilege models and implement stricter D-Bus and Polkit rules to reduce attack surface. 

References: 

Security Advisory

12-Year-Old Sudo Vulnerability & Chroot Flaw Enable Privilege Escalation  

Summary : Security Advisory: Two critical vulnerabilities CVE-2025-32462 and CVE-2025-32463 have been identified in the widely used Sudo utility, enabling local privilege escalation to root. System administrators rely on Sudo to enforce the principle of least privilege and maintain an audit trail of administrative actions.

The flaw, present in Sudo’s codebase for over 12 years, was discovered by Rich Mirch of the Stratascale Cyber Research Unit and affects both stable (v1.9.0–1.9.17) and legacy (v1.8.8–1.8.32) versions of Sudo.

Severity Critical 
CVSS Score 9.3 
CVEs CVE-2025-32463, CVE-2025-32462 
POC Available Yes 
Actively Exploited No 
Exploited in Wild No 
Advisory Version 1.0 

Overview 

These flaws affect both legacy and modern versions of Sudo and impact Linux and Unix-like systems, including Ubuntu and macOS. One vulnerability (CVE-2025-32462)remained undiscovered for over 12 years. Both have been fixed in Sudo version 1.9.17p1. 

Vulnerability Name CVE ID Product Affected Severity Fixed Version 
​Chroot Option Arbitrary Code Execution vulnerability  CVE-2025-32463 Sudo  Critical  1.9.17p1 
Host Option Privilege Escalation vulnerability  CVE-2025-32462 Sudo   Low  1.9.17p1 

Technical Summary 

CVE-2025-32463 – Chroot Privilege Escalation via Path Confusion 

Introduced in Sudo version 1.9.14, this vulnerability abuses the –chroot (-R) feature, allowing attackers to run commands as root even if not permitted in the sudoers file.

The flaw arises because Sudo began resolving paths inside the chroot environment before validating permissions. This allowed attackers to trick Sudo into referencing malicious configuration files (e.g., fake /etc/nsswitch.conf) and loading arbitrary shared libraries (e.g.-libnss_/woot1337.so.2) during the privilege escalation process. 

CVE-2025-32462 – Host Option Bypass 

CVE-2025-32462 exploits improper handling of the –host (-h) option in Sudo, allowing users to bypass hostname-based access restrictions and execute commands as root. 

CVE ID System Affected  Vulnerability Details Impact 
CVE-2025-32463 Stable 1.9.0 – 1.9.17  Exploits the -R chroot option to load attacker-controlled shared libraries, leading to root access even when user lacks necessary permissions.  Arbitrary code execution as root 
CVE-2025-32462 Stable 1.9.0 – 1.9.17 Legacy 1.8.8 – 1.8.32  Allows local users to abuse the -h option to bypass Host or Host_Alias restrictions and execute commands as root across unintended systems.  Local privilege escalation to root 

Remediation: 

Upgrade Sudo to version 1.9.17p1 or later or the appropriate patched package version provided by your Linux distribution. 

Conclusion: 
These Sudo vulnerabilities, especially CVE-2025-32463 with a CVSS score of 9.3, represent a serious threat to system integrity. Exploitable without complex tooling and with a public Proof-of-Concept (PoC) already available, this vulnerability underscores the risks posed by long-standing design flaws in foundational system utilities.

Administrators are strongly advised.

Update Sudo to version 1.9.17p1 or later on all systems. Organizations must act swiftly to patch affected systems, audit privileged access, and secure their Sudo configurations.

This incident reinforces the urgent need for continuous security reviews even for the most trusted and widely deployed open-source components and prevent unauthorized privilege escalation on affected systems.

References: 

Blogs

Cyber-Breach on Qantas Airliner re-echo’s Cyber Risk associated with Third Party

Third-party vendors are critical to and business or industry – but they confirm to significant amount of cyber risk. Qanatas airline confirmed of cyber attack where nearly  six million customers data may have been compromised. The airliner issued statement that said credit card details, financial information, and passport details were not part of the breach.

Qantas said in a statement: “We are continuing to investigate the proportion of the data that has been stolen, though we expect it will be significant. An initial review has confirmed the data includes some customers’ names, email addresses, phone numbers, birth dates and frequent flyer numbers.”

The alarming aspect of a third-party data breach is the sheer scale of impact. Hackers have the potential to attack thousands of organizations in one fell swoop.

KPMG, study showed how 73% of organizations have experienced at least one significant disruption from a third-party cyber incident within the last three years. 

Qantas Group chief executive Vanessa Hudson said the company was working closely with the National Cyber Security Coordinator and the Australian Cyber Security Centre.

We sincerely apologies to our customers and we recognize the uncertainty this will cause. Our customers trust us with their personal information, and we take that responsibility seriously,” she said.

In the breach that affected Qantas airliner which is one of the oldest, did not point to any hackers group. This data breach is one of Australia’s biggest breach in years which caused major setback and reputation damage to an airliner.

Last week, FBI said Scattered Spider group  was targeting airlines and that Hawaiian Airlines (HAII.UL) and Canada’s WestJet had already reported breaches. Read more on our blogs:

Key pointer of the Qantas Breach

The Cyber hacker broke into a database containing the personal information of millions of customer.

The breach was executed by hackers who targeted a call center and gained access to a third-party customer service platform containing six million names, email addresses, phone numbers, birth dates and frequent flyer numbers.

Third party risk management is complex but neglecting can be fatal for organizations whose data volume is huge such as airliners.

The airline is emailing affected customers and has set up a dedicated support line at 1800 971 541 (or +61 2 8028 0534 from overseas).

If we observe in recent past 2020, the solar Winds attack that happened where Solar winds confirmed that its network had been penetrated by a malicious actor and a complex malware program inserted into software updates of its technology platform – SolarWinds OrionⓇ.

Such is the magnitude of the attack that the malware program comprised a multistage process, scanning downstream customer networks to detect security tools it could avoid or disable, and stealthily connecting to the attacker’s command and control servers. The malware persisted for months before initial detection.

The solar winds attack cost to the company amounted to significant loss with Incident response and forensic services cost companies 11% of their annual revenue (an average of $12 million). 

How to make sure your vendor don’t create unnecessary risk that pose challenge for organization at large

First ensure your third party vendor’s meet the required robust security posture

Vendor risk assessment must be done holistically by streamlining due diligence

Upon discovery of any vulnerabilities, it is important that customizing and updating security requirements of the newly discovered threats and patch.

As a part of better threat mitigation strategy it is important that to automate vendors onboarding this will provide agility.

Managing Third party risk with Intru360

A research with KPMG found that found 61% of businesses underestimate third party risk management and often also struggle to have a healthy operation model and scale it same time.

KPMG research further found that Third-party/nth-party risk management that covers all third-party relationships over the entire life cycle; subjects vendors that support critical activities or are heavily relied upon to more comprehensive and rigorous oversight; and considers transition, contingency, recovery, and duplicity alternatives.

With most of the technology investments fail to provide visibility into third-party risk, we at Intercept help you to expand the scope and cover third parties related risk areas by identifying.

Intru360 gives security analysts and SOC managers a clear view across the organization, helping them fully understand the extent and context of an attack. It also simplifies workflows by automatically handling alerts, allowing for faster detection of both known and unknown threats.

In vendor security and management here are some of the features we offer to make sure cyber health of each and every supplier is checked and alerts are placed to get notification.

Prebuilt playbooks and automated response capabilities.

Over 400 third-party and cloud integrations.

More than 1,100 preconfigured correlation rules.

Ready-to-use threat analytics, threat intelligence service feeds, and prioritization based on risk.

Sources: https://www.techtarget.com/whatis/feature/SolarWinds-hack-explained-Everything-you-need-to-know

https://kpmg.com/us/en/articles/2022/ten-key-regulatory-challenges-2023-risk-governance.html
https://www.sbs.com.au/news/article/qantas-data-breach-everything-we-know-so-far-about-stolen-customer-details/49iggxre0

Blogs

Scattered Spider Group Target Aviation Sector; Third Party Providers to Vendors at Risk. Solutions to Improve Security Posture

Recently the Scattered Spider Hacker group or cybercriminals are targeting the airline industry at large and keen interest on aviation sector.

The Scattered Spider group relies mostly on social engineering techniques that can impersonate employees or contractors to deceive IT help desks into granting access” and frequently involves methods to bypass multifactor authentication (MFA), as per observation by FBI.

Earlier the group breached at least two major US airlines in June, bypassed security protocols by exploiting remote access tools and manipulating support staff as reported by CNN .

There is a growing cyber risk on aviation sector and how the air traffic control is managed during attack which makes subsequent aviation systems vulnerable to cyberattacks due to outdated technology in many cases.

And cyber criminals are resorting to advanced techniques by which they can halt operations via cyberattacks that have the ability to take over or invade technology systems which in turn disrupt information flow from the aircraft to pilots to the airlines’ operations center resulting in chaos and delay in flight operations.

Every operation and service delivered by airlines is supported by technology and once that is not responding ,subsequent operations are halted i.e. flight management software, air traffic control communications, baggage handling systems and in-flight entertainment platforms will fail inevitability.
Recently the Scattered Spider group was behind a big data breach potentially exposing Social Security numbers, insurance claims and health information of tens of millions of customers.

Repercussions of Data Breaches Impacting Third parties

Cybercriminals often take advantage of fragile cyber security posture linked to smaller third parties that provide services to larger, well-established enterprises or industry. In-fact many vendors dont have cybersecurity protection and proper cybersecurity awareness in place to mitigate against attacks.

Cyber attacks have evolved to become increasingly complex, making vendor risk management critical. With rise in digital transformation, cloud services and AI technology has given cyber criminals greater potential to penetrate unsecured networks and systems more then ever.

Address the Threat Landscape with Best Practices

Data breaches that originate from third-party vendors cause big fines and legal consequences are huge and affect primary organization. Along with these challenges, organizations often rely on third parties for critical services and cyber criminals take advantage of these vulnerability.

Organizations can still take steps to mitigate and defend against these attacks even as they onboard new vendors or service providers.

Let us see the emerging threats across third-party vendors:

  • Supply chain attacks by cybercriminals often target companies that supply services to many different companies (e.g. MSPs, IT) they cause great impact as IoT and other hardware devices manufactured by third parties can be infected malicious firmware .These malware can steal sensitive data. 
  • Ransomware-as-a-Service (RaaS)The dark web often sells kits (RaaS) and now it is combined with generative AI making attractive for cyber criminals to launch attacks. RaaS can disrupt critical services of organizations.
  • Threat from third parties Unintentional human error occur where providers misconfigure not so accurate data or data deletion happens or poor cybersecurity practices of easy passwords circulating among users. There could also be vendors with financial motives who don’t go through the same security process known as insider threat and don’t pass security test laid for regular employees.
  • Software supply chain attacks As we witnessed outsourcing third-party SaaS services and cloud technology makes it easy to target vulnerabilities in software code. This impacting hundreds of well-established organizations using the same software and same chain of malware flows.
  • Cloud vulnerabilities The provider or cloud service is responsible for securing the cloud infrastructure while the customer or vendor is responsible for securing their data and applications. A lack of proper security measures by the customer or third party can result in data breaches, data loss or supply chain attacks. Since cloud service or data center is all outsources so security lapse may happen
  • Advanced Persistent Threats (APTs) is linked to State-sponsored attacks who generally target third parties to penetrate into systems over an extended period of time. For example, they might compromise a third-party network to gain lateral access to the main organization’s IT infrastructure, making it difficult to detect in time.   
  • Deepfake and social engineering attacks. Emerging AI-technology can manipulate employee or C-level executives to trick users into divulging information to execute identity fraud, phishing attacks, sign fraudulent contracts, or gain unauthorized access to restricted systems and networks. 
  • Zero-day exploits exploited by cyber criminals before they are identified by developers and third-party providers and patched. At times if patch is slow process attackers launch attacks during this delay.   

Solutions that will improve Security Posture with Intru360 from Intruceptlabs

The new business environment demands IT support for a wider range of monitoring, security and compliance requirements. This creates significant burdens on network performance and network security as more appliances need access to incoming data.

Intrucept platform (Intru360) cover overall risk, detection, prevention, correlation, investigation, and response across endpoints, users, networks, and SaaS applications, offering end-to-end visibility.

Intru360 gives security analysts and SOC managers a clear view across the organization, helping them fully understand the extent and context of an attack. It also simplifies workflows by automatically handling alerts, allowing for faster detection of both known and unknown threats.

Identify latest threats without having to purchase, implement, and oversee several solutions or find, hire, and manage a team security analyst.

Sources: https://www.darkreading.com/cyberattacks-data-breaches/scattered-spider-hacking-spree-airline-sector

Uncategorized

Google Chrome Zero-Day Vulnerability (CVE-2025-6554) Actively Exploited – Patch Now 

Summary : Security Advisory: Google has issued an urgent security update for Chrome browser users worldwide, addressing a high-severity zero-day vulnerability in the Chrome browser CVE-2025-6554 actively being exploited by cybercriminals.

OEM Google 
Severity High 
CVSS Score N/A 
CVEs CVE-2025-6554 
POC Available No 
Actively Exploited Yes 
Exploited in Wild Yes 
Advisory Version 1.0 

Overview 

This is a type confusion flaw in Chrome’s V8 JavaScript engine allows arbitrary code execution and it’s actively being exploited in the wild. 

The vulnerability was discovered by Clément Lecigne of Google’s Threat Analysis Group (TAG) on June 25, 2025, and a temporary mitigation was pushed on June 26, 2025. This internal discovery highlights the ongoing security monitoring efforts within Google’s infrastructure.

The mitigation measure passed through a configuration change pushed to all stable channel users across all platforms.

                Vulnerability Name CVE ID Product Affected Severity Fixed Version 
​Type Confusion in V8 Engine vulnerability  CVE-2025-6554 Google Chrome  High  138.0.7204.96/.97 (Windows)  
138.0.7204.92/.93 (Mac)  
138.0.7204.96 (Linux) 

Technical Summary 

CVE-2025-6554 is a type confusion vulnerability in Chrome’s V8 JavaScript engine. It allows threat actors to exploit memory misinterpretation and execute arbitrary code, potentially compromising the browser or the underlying system. Google has confirmed active exploitation of this flaw. 

CVE ID System Affected  Vulnerability Details Impact 
CVE-2025-6554 Chrome on Windows, macOS, Linux Type confusion in the V8 JavaScript engine allows improper memory handling, leading to code execution  Remote code execution.  Potential system compromise.  

Remediation: 

A full fix is available in the latest stable channel update. Users are strongly advised to update immediately to ensure full protection. 

  • Users should immediately update Google Chrome to the latest patched version: 
  • Windows: 138.0.7204.96/.97 
  • macOS: 138.0.7204.92/.93 
  • Linux: 138.0.7204.96 

Conclusion: 

The exploitation of CVE-2025-6554 in the wild highlights the urgency of applying the latest Chrome security update. Type confusion vulnerabilities like this can lead to full system compromise and are highly sought-after by cybercriminals. Users and organizations should take immediate action to mitigate potential risks. 

Organizations using Chrome in enterprise environments should prioritize this update across their networks.

The combination of confirmed active exploitation and the high-severity rating makes this patch deployment critical for maintaining organizational cybersecurity posture.

Refer to Intruceptlabs products & solution for better cyber security posture with Intru360, Gaarud Node

References: 

Blogs

Iran & Israel war shaping cyber warfare; Hacktivism a tool used widely for Proxy Warfare

Iran & Israel war shaping cyber warfare; Hacktivism a tool used widely for Proxy Warfare

The latest in geo -politics is Israeli air strikes on Iran that triggered Hacktivist to attack and they chose social media platform to announce their activities ‘The Telegram platform’. Now cyber war fare is taking a different path and has no borders and enemy is not visible. One shot of attack is enough to bring down and cripple and entire system starting from banking systems to power grids.

Hacktivist group often uses Telegram as first approach to share about their cyber-attacks and victims list. The hacktivist group DieNet claimed that they will attack Israeli radio stations and   announced it in Telegram.

Israeli cyber officials expect more spear-phishing, malware and similar patterns of attack attempts in the days ahead. Iran is currently engaged in a cyber-conflict with Israel and uses major two hacktivist groups that helps conduct destructive cyber-attacks, linked to Iran’s Ministry of Intelligence and Security (MOIS).

According to NSFOCUS Fuying Lab, hacker groups targeting Israel and Iran have been active since 2025. Up to now, there are about 170 hacker groups attacking Israel, with about 1,345 cyber attacks on Israel, including about 447 cyber attacks launched against Israel after the conflict broke out. (The Hacktivist Cyber Attacks in the Iran-Israel Conflict – Security Boulevard)

In the past Russia has used “hacktivism” as a tool for proxy warfare for various forms of cyber activities to create fear and uncertainty on their opponent.

The Iranian Cyber Units or forces are mostly linked to MOIS and IRGC the hackers group who use fake identities or front groups to hide their state connections.

Surge in Disruptive Cyber Operations

According to Radware, a global cybersecurity provider, Israel has faced an average of 30 DDoS attacks per day since the conflict’s onset. These attacks primarily target government and public institutions (27%), manufacturing (20%), telecommunications (12%), and media platforms (9%).

DDoS operations overload online services, rendering them inaccessible and often accompany website defacements and data leaks to maximise disruption during crises.

The pro-Iranian hacker group’s attacks on Israel peaked on June 16, the day after the Israeli military’s “massive strike” against multiple Iranian weapons production sites, including surface-to-surface missile production sites, detection radar bases and surface-to-air missile launchers in Tehran.

The targets of attack were mainly concentrated on Israeli government and public sector, national defense, aerospace, education and other industries.

The War in disguise-fought with malicious coding

Now along with tanks and war machineries, another kind of war is being simultaneous wagged i.e. cyber warfare. Here it is unconventional warfare no border no clear enemy. Everything is in disguise to create more sensation and install fear. This is being conducted by either by various state sponsored espionage or individual groups who are posing challenge for nation security.

And sometimes this kind of cyber-attack is fatal as malicious code on any application software can damage the system. Imagine doctors not able to open the required files in their system to check patient history on time, due to swarm of malicious code being pushed in their system and is life threatening for the patient as there is a delay to start treatment.

Again malicious code threats are hidden in software and mask their presence to evade detection by traditional security technologies.

Once any encrypted coding being pushed by threat actors inside organizations network, they can enter network and mail, overload with email messages, steal data like passwords and even reformat hard drives.

Hacktivist are now more empowered and Cyber warfare is now fought in disguise to exert influence and destabilize adversaries. Many methods used by Iran in destructive cyber attacks mirror those used by large ransomware groups, such as abusing vulnerabilities in VPN applications to gain entrance. 

Emergence of New Axis in Cyber warfare

Those countries who lack in having a resilient cyber security infrastructure or organizations particularly fragile are soft targets becomes unintended battlegrounds in the global cyber war.

They make the easy victims either via hacking; data theft, cyber extortion and sometimes major cyber-attack that can sabotage their government systems.

If your capability suffers and able to provide effective defense then remaining vulnerable is an option slowly loosing creditability.

Either as a organization or country this growing disparity in cyber defense capacity has emerged as a new axis of global inequality and thriving grounds for threat actors.

The wave of cyber activity in this present state of Iran and Israel war, highlights how modern conflicts extend beyond physical battlegrounds. Attacks on infrastructure highlights the strategic importance of digital resilience.

Iranian state-sponsored hackers, particularly the APT35 group (also known as Charming Kitten), reportedly used AI to enhance their cyberattacks.

According to Check Point, these operations targeted Israeli cybersecurity experts, computer scientists, and tech executives with sophisticated phishing attempts. The attackers used fake messages and emails designed to trick people into sharing sensitive information, along with realistic decoys and fake login pages mimicking Google’s. 

Here are recommendations to secure your networks against cyber-attacks, happening in disguise. How to improve organizational resilience.

  • First have clear visibility across your network as traffic flows, without visibility it is not possible to stop attack. You can’t defend if your enemy is not visible. Once you have visibility, you can see across the threat landscape in your network and gather intelligence.
  • Now with insights one gathers it’s time to turn insights into action and understand the tactics employed by threat actors. These insights are keys to set up proactive defense.
  • Bring Intrucept as a part of your Security team. We are here to assist you as you need a deeper understanding of evolving threats and ways to mitigate them. Our next gen SIEM is a comprehensive solution for Security Information. It gathers information and then interprets, centralizing all security data for organizations.

For visibility Intru360 gives security analysts and SOC managers a clear view across the organization, helping them fully understand the extent and context of an attack.

  • Simply your workflows with Intru360, which automatically handles alerts, allow faster detection of both known and unknown threats.
  • When it is question of cyber security and threats most organizations face, one need’s to have confidence in the threat intelligence one uses
  • Once you are able to identify latest threats and you will not have to purchase, implement and oversee several solutions and even manage a team security analyst, it is easier. You get to save time and reduce complexity while researching for threats.

At the end we can say its not only responsibility for Government to respond or remain alert to cyber attacks and hackers foul play.

The present decade will witness more cyber war that is parallel along side when two nations go at war with each other deploying different AI-driven tools in their attacks. It is high time to stay alert and practice safe cyber security measures at individual level and enterprise level.

Sources: Reflections of the Israel-Iran Conflict on the Cyber World – SOCRadar® Cyber Intelligence Inc.

https://8am.media/eng/the-role-of-cyber-warfare-in-shaping-global-power-dynamics/#
Blogs

Fintech Cybersecurity; Best Practices to Navigate Risk & Challenges

Fintech apps have gained momentum as Paypal, Mint, Gpay and Stash have transformed the way payment is made in financial service industries in the last few years. Fintech platforms are mostly subject to varying security standards striving the threat landscapes across different regions of geography.

In this blog we will discover how Fintech’s are growing at a pace and scaling up along with rising user base making it difficult for security teams to detect at the same pace and understand the attack surface vastness. As Fintech companies grow at pace, its impossible to keep growing with smaller infrastructure and security practices that may not be sufficient for smaller operations. Also growth in user base, makes it difficult with security teams to have proper visibility over an ever-expanding attack surface. 

IntruceptLabs has a team of certified security experts who conduct manual penetration testing, identifying different business-centric vulnerabilities that an automated scan may not identify. GaarudNode from Intrucept provides a comprehensive security framework that ensures your applications are built, tested, and deployed with confidence.

The global aspect of operation in Fintech based organizations gives rise to data sovereignty issues, where some data must be within specific geographic limits. 

The Fintech Service (FaaS) market from past few yrs is experiencing substantial growth and the global market is projected to increase by USD 806.9 billion by 2029. This growth is fueled by increasing demand for digital financial solutions and the adoption of FaaS among businesses of all sizes.FaaS provides agility, flexibility, and seamless integration, making it attractive for businesses. 

Fintech’s mining Ground for cybercriminals

Apart from consumers and legitimate users across the globe, for cyber criminals Fintech’s are mining treasures as they can quiet probably gather or steal valuable personal and financial data.

Money is constantly flowing through various associated apps and we don’t know when and how bad actors will launch clever tactics and spill of money through various associated apps .This is making cyber security posture for fintech’s difficult.

Yes, Organizations can take up cyber skilling and training seriously and help staff to use phishing-resistant multifactor authentication and robust identity-verification measures. Organisation can take up security strategies and devise it keeping uniformity in enforcement practices and incident reporting requirements.

The past decade gave a consistent rise in the number and sophistication of cyberattacks targeting financial institutions as observed.

Now that is posing significant threats to the stability and trust within the financial ecosystem as financial losses increase due to cyber breaches or data hack and causing operational disruptions including reputational damage.

Navigating the risk & challenges affecting Fintech service (FaaS)

Fintech security is directly related to API security as API’s are responsible for smooth functioning of ‘Fintech as a platform’.

It is the same API’s that are prime target of cyber criminals as there has been increase in Cloud computing, mobile apps usage and Internet of Things (IoT) all have accelerated the adoption of APIs. 

API’s are used by developers to integrate third party services ,also increase the functionable features and create solutions that are innovative in nature. Any flaw in API security could substantially damage the endpoints and is a common vulnerabilities. API ‘s can become insecure when endpoints finds failure to validate input, leading to injection attacks.

User identity Theft

Authentication vulnerabilities are issues that affect authentication processes and make websites and applications susceptible to security attacks in which an attacker can masquerade as a legitimate user.

Any flaw in authentication and authorization will give way to account compromises with insecure password that are crackable or single-factor authentication in systems lacking additional verification step. Authentication is a vital part of any website or application since it is simply the process of recognizing user identities.

Having authentication vulnerabilities have serious repercussions — whether it’s because of weak passwords or poor authentication design and implementation.

Threat actors use these vulnerabilities to get access into systems and user accounts to:

  • Steal sensitive information
  • Masquerade as a legitimate user
  • Gain control of the application
  • Destroy the system completely

Supply chain risk or third party integration

Often fintech applications interact with external services or providers. Any weaknesses arising in Supply chain from backdoors are embedded within financial apps via compromised third-party code. So many Vendor fail the risk assessments as they are unable to identify risks well before integration. 

Mostly fintech functions are mobile transfers require Apps interacting with traditional banks having legacy infrastructure to support. Integrating the modern high-tech apps with the legacy systems often used by established financial institutions is a difficult technical challenge. 

Regulatory Compliance

Fintech firms operate under regulatory landscape that is complex and changing and must comply with various frameworks, including GDPR,PCI etc, and few local financial regulations based on geographical points or country wise .

These regulations add up to lot of over head expenses and if something overlaps

The regulations adds massive, unnecessary overhead, as requirements often overlaps creating chaos. Complying with local regulations, requires resources that can be diverted away from other security efforts.

Moreover, if a Fintech platform ventures into multiple markets, it must comply with local regulations, which often requires a race against time and diverts resources away from other security efforts.

Enterprise security can prevent cyber attacks by enforcing account lockouts, rate limiting, IP-based monitoring, application firewalls, and CAPTCHAs.

AI Soft Spot by Cyber criminals

Now cyber criminals are using AI and machine learning to automate the testing process and find zero-day vulnerabilities—especially in APIs. Perhaps the most observed impact AI has had on cybercrime has been an increase in scams, particularly those leveraging deepfake technology. In certain dark web forums where experimentation takes place, few threat actors are claiming to employ AI to bypass facial recognition technology, create deepfake videos and adopt techniques to summaries large amount of data.

Cyber security best practices for Faas

The outputs derived from assessment of security testing must encompass the entire attack surface, including APIs, mobile applications and other interfaces to develop roadmaps to improve security. In any event of security breach any incident response planning by organizations will help to identify, mitigate threat and recover. 

GaarudNode from IntruceptLabs

GaarudNode is an all-in-one  solution designed to empower development teams with the tools they need to secure their applications throughout the development lifecycle. By combining the power of SAST, DAST, SCA, API security, and CSPM, GaarudNode provides a comprehensive security framework that ensures your applications are built, tested, and deployed with confidence.

The dashboard presents findings with ratings and remediation steps, allowing developers to easily address critical issues.

What else you get from GaarudNode?

  • Identifies security flaws early in the development process by scanning source code, helping developers detect issues like insecure coding practices or logic errors.
  • Tests running applications in real-time to identify vulnerabilities such as SQL injection, Cross-Site Scripting (XSS), and other runtime threats.
  • Detects vulnerabilities in third-party libraries and open-source components, ensuring that your dependencies don’t introduce risks.
  • Continuously tests and monitors your APIs for vulnerabilities such as authentication flaws, data exposure, and insecure endpoints.

Sources: https:www.apisec.ai

Security Advisory

Critical Unauthenticated RCE Vulnerabilities in Cisco ISE and ISE-PIC 

Cisco has disclosed two critical vulnerabilities CVE-2025-20281 and CVE-2025-20282 affecting its Identity Services Engine (ISE) and Passive Identity Connector (ISE-PIC).

These vulnerabilities allow unauthenticated, remote attackers to execute arbitrary commands on the underlying operating system with root privileges. The first flaw CVE-2025-20281 impacts ISE versions 3.3 and later, while the second CVE-2025-20282 is limited to version 3.4.

Summary 

OEM Cisco 
Severity Critical 
CVSS Score 10.0 
CVEs CVE-2025-20281, CVE-2025-20282 
POC Available No 
Actively Exploited No 
Exploited in Wild No 
Advisory Version 1.0 

Overview 

Cisco has disclosed two critical vulnerabilities CVE-2025-20281 and CVE-2025-20282 affecting its Identity Services Engine (ISE) and Passive Identity Connector (ISE-PIC).

These vulnerabilities allow unauthenticated, remote attackers to execute arbitrary commands on the underlying operating system with root privileges. The first flaw CVE-2025-20281 impacts ISE versions 3.3 and later, while the second CVE-2025-20282 is limited to version 3.4.

Both issues stem from insecure API implementations that fail to validate user input and uploaded files respectively.  

Given the critical nature of these bugs both scoring CVSS 9.8 & 10.0 Cisco has issued immediate fixes, with no workarounds available. Organizations using the affected versions are urged to apply the patches without delay. 

Vulnerability Name CVE ID Product Affected Severity Fixed Version 
​API Unauthenticated RCE vulnerability  CVE-2025-20281 ISE & ISE-PIC   Critical  3.3 Patch 6, 3.4 Patch 2 
Internal API Arbitrary File Execution vulnerability  CVE-2025-20282 ISE & ISE-PIC   Critical  3.4 Patch 2 

Technical Summary 

Two independent vulnerabilities allow an attacker to gain full control over affected Cisco ISE systems without authentication: 

  • CVE-2025-20281: Triggered via crafted requests to a public API, exploiting insufficient input validation to achieve RCE as root. 
  • CVE-2025-20282: Abuses an internal API that lacks file validation, enabling the upload and execution of malicious files in privileged directories. 

These vulnerabilities align with CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) and CWE-269 (Improper Privilege Management). 

CVE ID System Affected  Vulnerability Details Impact 
CVE-2025-20281 Cisco ISE & ISE-PIC 3.3 and later Insufficient validation in a public API allows remote attackers to send crafted requests, leading to unauthenticated command execution as the root user.  Remote code execution  
CVE-2025-20282 Cisco ISE & ISE-PIC 3.4 only An internal API fails to validate uploaded files. Attackers can upload files to system directories and execute them with root privileges.   Remote code execution 

Remediation: 

Cisco has released patches for affected versions of ISE and ISE-PIC. There are no known workarounds, and customers are strongly encouraged to apply the following updates: 

Cisco ISE / ISE-PIC Version CVE-2025-20281 Fixed In CVE-2025-20282 Fixed In 
3.2 and earlier Not affected Not affected 
3.3 3.3 Patch 6 Not affected 
3.4 3.4 Patch 2 3.4 Patch 2 

Conclusion: 
These vulnerabilities represent a severe risk to network security infrastructure, particularly because they impact Cisco ISE a cornerstone for identity and access control in many enterprises. The unauthenticated remote nature of the exploits, combined with root-level access and no required user interaction, significantly increases the threat surface.  

Although Cisco’s PSIRT has stated that there are no known instances of public exploitation, the ease of exploitation and severity (CVSS 10.0) make these vulnerabilities highly attractive to threat actors. Organizations should immediately apply the available patches and review their system logs for any signs of suspicious activity targeting ISE infrastructure. 

References: 

Security Advisory

Citrix NetScaler ADC/Gateway Vulnerability Exploited in the Wild (CVE-2025-6543) 

Summary : Security Advisory;

Citrix is warning that a vulnerability in NetScaler appliances tracked as CVE-2025-6543 is being actively exploited in the wild, causing devices to enter a denial of service condition.

The flaw impacts NetScaler ADC and NetScaler Gateway versions 14.1 before 14.1-47.46, 13.1 before 13.1-59.19, and NetScaler ADC 13.1-FIPS and NDcPP before 13.1-37.236-FIPS and NDcPP.

OEM Citrix 
Severity Critical 
CVSS Score 9.2 
CVEs CVE-2025-6543 
POC Available No 
Actively Exploited Yes 
Exploited in Wild Yes 
Advisory Version 1.0 

Overview 

A critical memory overflow vulnerability, CVE-2025-6543, has been discovered in NetScaler ADC and NetScaler Gateway products, potentially leading to denial-of-service and unintended control flow. The issue affects deployments configured as Gateway services. Active exploitation in the wild has been reported. 

Vulnerability Name CVE ID Product Affected Severity Fixed Version 
​Memory overflow vulnerability  CVE-2025-6543 NetScaler ADC and NetScaler Gateway  Critical  14.1-47.46 / 13.1-59.19 / 13.1-37.236 

Technical Summary 

CVE-2025-6543 is a memory overflow vulnerability in NetScaler ADC and Gateway products that can result in denial-of-service (DoS) or arbitrary control flow, particularly when the system is configured as a Gateway or AAA virtual server.

The flaw stems from improper restriction of operations within memory buffer bounds (CWE-119). This vulnerability has been exploited in real-world attacks. 

CVE ID System Affected  Vulnerability Details Impact 
  CVE-2025-6543 NetScaler ADC & Gateway 14.1 before 14.1-47.46, 13.1 before 13.1-59.19 NetScaler ADC 13.1-FIPS and NDcPP before 13.1-37.236-FIPS and NDcPP Memory overflow due to improper memory boundary restrictions when configured as Gateway or AAA virtual servers  Denial-of-Service and Unintended control flow 

Remediation: 

  • Immediate Action: Affected customers are strongly advised to upgrade to the fixed versions: 
Product Version Recommended Fixed Build 
NetScaler ADC / Gateway 14.1 14.1-47.46 or later 
NetScaler ADC / Gateway 13.1 13.1-59.19 or later 
NetScaler ADC 13.1-FIPS / NDcPP 13.1-37.236 or later 

Note: Versions 12.1 and 13.0 are End-of-Life (EOL) and remain vulnerable. These should be replaced with supported, patched builds. 

Customers using FIPS or NDcPP variants should contact Citrix Support directly for access to the fixed builds. 

Conclusion: 
CVE-2025-6543 represents a highly critical risk to organizations utilizing NetScaler Gateway or ADC for secure access and application delivery.

Organizations still using outdated or end-of-life (EOL) versions are especially vulnerable and should prioritize upgrading to supported builds. 

This flaw follows a pattern of severe vulnerabilities affecting NetScaler products, including the recently disclosed CVE-2025-5777 (CVSS score: 9.3), which also posed a significant threat to enterprise infrastructure.

Together these issues highlight the urgent need for timely patching, continuous monitoring, and defense-in-depth strategies to safeguard critical network assets. 

With both flaws being critical bugs, administrators are advised to apply the latest patches from Citrix as soon as possible.

Companies should also monitor their NetScaler instances for unusual user sessions, abnormal behavior, and to review access controls.

References: 

Security Advisory

Privilege Escalation in Notepad++ v8.8.1 Installer via Binary Planting with Public PoC Available 

Security Advisory: A high-severity privilege escalation vulnerability has been discovered in the Notepad++ v8.8.1 and prior installer, which allows local attackers to gain SYSTEM-level privileges through uncontrolled executable search paths (binary planting).

The installer searches for executable dependencies in the current working directory without verification, allowing attackers to place malicious executables that will be loaded with SYSTEM privileges during installation.

OEM Notepad++ 
Severity High 
CVSS Score 7.3 
CVEs CVE-2025-49144 
POC Available Yes 
Actively Exploited No 
Exploited in Wild No 
Advisory Version 1.0 

Overview 

Exploitation requires minimal user interaction and a public Proof of Concept (PoC) is available. The issue is resolved in version v8.8.2. 

Vulnerability Name CVE ID Product Affected Severity Fixed Version 
​Privilege Escalation Vulnerability  CVE-2025-49144 Notepad++  High  v8.8.2 

Technical Summary 

The Notepad++ installer improperly searches for executable dependencies in the current directory without verifying their authenticity.

This insecure behavior allows attackers to place a malicious executable (e.g. regsvr32.exe) in the same directory as the installer. Upon execution the malicious file is loaded with SYSTEM-level privileges, granting full control over the machine. 

In real world scenario, an attacker could use social engineering or clickjacking to trick users into downloading both the legitimate installer and a malicious executable to the same directory (typically Downloads folder – which is known as Vulnerable directory). Upon running the installer, the attack executes automatically with SYSTEM privileges.

CVE ID System Affected  Vulnerability Details Impact 
  CVE-2025-49144  Notepad++ v8.8.1 and prior. The installer invokes executables without absolute path (e.g. regsvr32), allowing a malicious binary in the same directory to be executed with elevated privileges.  SYSTEM privilege escalation and full machine control 

Proof of Concept (PoC): 

  • Execution Flow: Attacker places a fake regsvr32.exe in the same directory as the Notepad++ installer. 
  • Trigger: When the user runs the installer, it loads the attacker’s file with SYSTEM privileges. 
  • Evidence: 
  • Process Monitor logs confirm that the installer is searching for executables in the local directory. 
  • Public PoC materials are hosted and shared, confirming reproducibility 

Remediation: 

  • Immediate Action: Upgrade to Notepad++ v8.8.2 or later which explicitly sets absolute paths when invoking executables like regsvr32. 

Recommendations: 

  • Configuration Check: Avoid executing installers from user-writable locations like the Downloads folder. Ensure installers are run from isolated, trusted directories. 
  • Environment Hardening: Implement endpoint detection for binary planting, restrict execution in commonly targeted directories. 

Conclusion: 
CVE-2025-49144 is a critical privilege escalation vulnerability with a working public PoC. It leverages a fundamental flaw in the Notepad++ installer’s handling of executable paths.

Given the low barrier to exploit and high impact, especially in environments where Notepad++ is widely used, immediate remediation is strongly advised. The presence of similar flaws in past versions highlights the persistent risk of insecure software packaging. 

This is a critical security vulnerability requiring immediate attention. While Microsoft classifies some binary planting issues as “Defense-in-Depth,” the severity of gaining SYSTEM privileges with minimal user interaction warrants priority remediation.

References: 

Scroll to top