Security advisory

Uncategorized

Google Chrome Zero-Day Vulnerability (CVE-2025-6554) Actively Exploited – Patch Now 

Summary : Security Advisory: Google has issued an urgent security update for Chrome browser users worldwide, addressing a high-severity zero-day vulnerability in the Chrome browser CVE-2025-6554 actively being exploited by cybercriminals.

OEM Google 
Severity High 
CVSS Score N/A 
CVEs CVE-2025-6554 
POC Available No 
Actively Exploited Yes 
Exploited in Wild Yes 
Advisory Version 1.0 

Overview 

This is a type confusion flaw in Chrome’s V8 JavaScript engine allows arbitrary code execution and it’s actively being exploited in the wild. 

The vulnerability was discovered by Clément Lecigne of Google’s Threat Analysis Group (TAG) on June 25, 2025, and a temporary mitigation was pushed on June 26, 2025. This internal discovery highlights the ongoing security monitoring efforts within Google’s infrastructure.

The mitigation measure passed through a configuration change pushed to all stable channel users across all platforms.

                Vulnerability Name CVE ID Product Affected Severity Fixed Version 
​Type Confusion in V8 Engine vulnerability  CVE-2025-6554 Google Chrome  High  138.0.7204.96/.97 (Windows)  
138.0.7204.92/.93 (Mac)  
138.0.7204.96 (Linux) 

Technical Summary 

CVE-2025-6554 is a type confusion vulnerability in Chrome’s V8 JavaScript engine. It allows threat actors to exploit memory misinterpretation and execute arbitrary code, potentially compromising the browser or the underlying system. Google has confirmed active exploitation of this flaw. 

CVE ID System Affected  Vulnerability Details Impact 
CVE-2025-6554 Chrome on Windows, macOS, Linux Type confusion in the V8 JavaScript engine allows improper memory handling, leading to code execution  Remote code execution.  Potential system compromise.  

Remediation: 

A full fix is available in the latest stable channel update. Users are strongly advised to update immediately to ensure full protection. 

  • Users should immediately update Google Chrome to the latest patched version: 
  • Windows: 138.0.7204.96/.97 
  • macOS: 138.0.7204.92/.93 
  • Linux: 138.0.7204.96 

Conclusion: 

The exploitation of CVE-2025-6554 in the wild highlights the urgency of applying the latest Chrome security update. Type confusion vulnerabilities like this can lead to full system compromise and are highly sought-after by cybercriminals. Users and organizations should take immediate action to mitigate potential risks. 

Organizations using Chrome in enterprise environments should prioritize this update across their networks.

The combination of confirmed active exploitation and the high-severity rating makes this patch deployment critical for maintaining organizational cybersecurity posture.

Refer to Intruceptlabs products & solution for better cyber security posture with Intru360, Gaarud Node

References: 

Security Advisory

Critical Unauthenticated RCE Vulnerabilities in Cisco ISE and ISE-PIC 

Cisco has disclosed two critical vulnerabilities CVE-2025-20281 and CVE-2025-20282 affecting its Identity Services Engine (ISE) and Passive Identity Connector (ISE-PIC).

These vulnerabilities allow unauthenticated, remote attackers to execute arbitrary commands on the underlying operating system with root privileges. The first flaw CVE-2025-20281 impacts ISE versions 3.3 and later, while the second CVE-2025-20282 is limited to version 3.4.

Summary 

OEM Cisco 
Severity Critical 
CVSS Score 10.0 
CVEs CVE-2025-20281, CVE-2025-20282 
POC Available No 
Actively Exploited No 
Exploited in Wild No 
Advisory Version 1.0 

Overview 

Cisco has disclosed two critical vulnerabilities CVE-2025-20281 and CVE-2025-20282 affecting its Identity Services Engine (ISE) and Passive Identity Connector (ISE-PIC).

These vulnerabilities allow unauthenticated, remote attackers to execute arbitrary commands on the underlying operating system with root privileges. The first flaw CVE-2025-20281 impacts ISE versions 3.3 and later, while the second CVE-2025-20282 is limited to version 3.4.

Both issues stem from insecure API implementations that fail to validate user input and uploaded files respectively.  

Given the critical nature of these bugs both scoring CVSS 9.8 & 10.0 Cisco has issued immediate fixes, with no workarounds available. Organizations using the affected versions are urged to apply the patches without delay. 

Vulnerability Name CVE ID Product Affected Severity Fixed Version 
​API Unauthenticated RCE vulnerability  CVE-2025-20281 ISE & ISE-PIC   Critical  3.3 Patch 6, 3.4 Patch 2 
Internal API Arbitrary File Execution vulnerability  CVE-2025-20282 ISE & ISE-PIC   Critical  3.4 Patch 2 

Technical Summary 

Two independent vulnerabilities allow an attacker to gain full control over affected Cisco ISE systems without authentication: 

  • CVE-2025-20281: Triggered via crafted requests to a public API, exploiting insufficient input validation to achieve RCE as root. 
  • CVE-2025-20282: Abuses an internal API that lacks file validation, enabling the upload and execution of malicious files in privileged directories. 

These vulnerabilities align with CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) and CWE-269 (Improper Privilege Management). 

CVE ID System Affected  Vulnerability Details Impact 
CVE-2025-20281 Cisco ISE & ISE-PIC 3.3 and later Insufficient validation in a public API allows remote attackers to send crafted requests, leading to unauthenticated command execution as the root user.  Remote code execution  
CVE-2025-20282 Cisco ISE & ISE-PIC 3.4 only An internal API fails to validate uploaded files. Attackers can upload files to system directories and execute them with root privileges.   Remote code execution 

Remediation: 

Cisco has released patches for affected versions of ISE and ISE-PIC. There are no known workarounds, and customers are strongly encouraged to apply the following updates: 

Cisco ISE / ISE-PIC Version CVE-2025-20281 Fixed In CVE-2025-20282 Fixed In 
3.2 and earlier Not affected Not affected 
3.3 3.3 Patch 6 Not affected 
3.4 3.4 Patch 2 3.4 Patch 2 

Conclusion: 
These vulnerabilities represent a severe risk to network security infrastructure, particularly because they impact Cisco ISE a cornerstone for identity and access control in many enterprises. The unauthenticated remote nature of the exploits, combined with root-level access and no required user interaction, significantly increases the threat surface.  

Although Cisco’s PSIRT has stated that there are no known instances of public exploitation, the ease of exploitation and severity (CVSS 10.0) make these vulnerabilities highly attractive to threat actors. Organizations should immediately apply the available patches and review their system logs for any signs of suspicious activity targeting ISE infrastructure. 

References: 

Security Advisory

Citrix NetScaler ADC/Gateway Vulnerability Exploited in the Wild (CVE-2025-6543) 

Summary : Security Advisory;

Citrix is warning that a vulnerability in NetScaler appliances tracked as CVE-2025-6543 is being actively exploited in the wild, causing devices to enter a denial of service condition.

The flaw impacts NetScaler ADC and NetScaler Gateway versions 14.1 before 14.1-47.46, 13.1 before 13.1-59.19, and NetScaler ADC 13.1-FIPS and NDcPP before 13.1-37.236-FIPS and NDcPP.

OEM Citrix 
Severity Critical 
CVSS Score 9.2 
CVEs CVE-2025-6543 
POC Available No 
Actively Exploited Yes 
Exploited in Wild Yes 
Advisory Version 1.0 

Overview 

A critical memory overflow vulnerability, CVE-2025-6543, has been discovered in NetScaler ADC and NetScaler Gateway products, potentially leading to denial-of-service and unintended control flow. The issue affects deployments configured as Gateway services. Active exploitation in the wild has been reported. 

Vulnerability Name CVE ID Product Affected Severity Fixed Version 
​Memory overflow vulnerability  CVE-2025-6543 NetScaler ADC and NetScaler Gateway  Critical  14.1-47.46 / 13.1-59.19 / 13.1-37.236 

Technical Summary 

CVE-2025-6543 is a memory overflow vulnerability in NetScaler ADC and Gateway products that can result in denial-of-service (DoS) or arbitrary control flow, particularly when the system is configured as a Gateway or AAA virtual server.

The flaw stems from improper restriction of operations within memory buffer bounds (CWE-119). This vulnerability has been exploited in real-world attacks. 

CVE ID System Affected  Vulnerability Details Impact 
  CVE-2025-6543 NetScaler ADC & Gateway 14.1 before 14.1-47.46, 13.1 before 13.1-59.19 NetScaler ADC 13.1-FIPS and NDcPP before 13.1-37.236-FIPS and NDcPP Memory overflow due to improper memory boundary restrictions when configured as Gateway or AAA virtual servers  Denial-of-Service and Unintended control flow 

Remediation: 

  • Immediate Action: Affected customers are strongly advised to upgrade to the fixed versions: 
Product Version Recommended Fixed Build 
NetScaler ADC / Gateway 14.1 14.1-47.46 or later 
NetScaler ADC / Gateway 13.1 13.1-59.19 or later 
NetScaler ADC 13.1-FIPS / NDcPP 13.1-37.236 or later 

Note: Versions 12.1 and 13.0 are End-of-Life (EOL) and remain vulnerable. These should be replaced with supported, patched builds. 

Customers using FIPS or NDcPP variants should contact Citrix Support directly for access to the fixed builds. 

Conclusion: 
CVE-2025-6543 represents a highly critical risk to organizations utilizing NetScaler Gateway or ADC for secure access and application delivery.

Organizations still using outdated or end-of-life (EOL) versions are especially vulnerable and should prioritize upgrading to supported builds. 

This flaw follows a pattern of severe vulnerabilities affecting NetScaler products, including the recently disclosed CVE-2025-5777 (CVSS score: 9.3), which also posed a significant threat to enterprise infrastructure.

Together these issues highlight the urgent need for timely patching, continuous monitoring, and defense-in-depth strategies to safeguard critical network assets. 

With both flaws being critical bugs, administrators are advised to apply the latest patches from Citrix as soon as possible.

Companies should also monitor their NetScaler instances for unusual user sessions, abnormal behavior, and to review access controls.

References: 

Security Advisory

Veeam Backup Patched Critical Vulnerabilities Enabling RCE & Privilege Escalation 

Summary ; Security Advisory

Veeam disclosed three critical vulnerabilities affecting its widely deployed backup software. Veeam Backup & Replication is an enterprise-grade data protection solution used to back up, recover and replicate virtual machines, cloud workloads including physical servers.

OEM Veeam 
Severity Critical 
CVSS Score 9.9 
CVEs CVE-2025-23121, CVE-2025-24286, CVE-2025-24287 
Actively Exploited No 
Exploited in Wild No 
Advisory Version 1.0 

Overview 

Multiple high-impact vulnerabilities have been disclosed in Veeam Backup & Replication and Veeam Agent for Microsoft Windows, impacting versions prior to 12.3.2 and 6.3.2 respectively.

The most critical issue (CVE-2025-23121) may allow a remote code execution (RCE) on the backup server by an authenticated domain user, effectively granting complete control over backup infrastructure. 

The vulnerabilities also include risks of unauthorized modification of backup jobs (CVE-2025-24286) and privilege escalation via local directory manipulation (CVE-2025-24287). These flaws could enable attackers to execute arbitrary code or gain elevated permissions. 

These flaws pose significant risks to organizations relying on Veeam for data integrity and disaster recovery. The data protection system of an organization may get affected if compromised and threaten domain-joined backup servers.

Vulnerability Name CVE ID Product Affected Severity 
​ Remote Code Execution via Authenticated Domain User  CVE-2025-23121 Veeam Backup & Replication  Critical (9.9) 
Arbitrary Code Execution via Backup Operator Role Abuse  CVE-2025-24286 Veeam Backup & Replication  High (7.2) 
Privilege Escalation via Directory Manipulation  CVE-2025-24287 Veeam Agent for Microsoft Windows  Medium (6.1) 

Technical Summary 

CVE ID System Affected Vulnerability Details Impact 
  CVE-2025-23121  Veeam Backup & Replication 12.3.1.1139 and all earlier v12 builds A remote code execution vulnerability affecting domain-joined Veeam backup servers. An authenticated domain user may execute arbitrary commands with elevated privileges.   Remote Code Execution 
  CVE-2025-24286 Veeam Backup & Replication 12.3.1.1139 and earlier  Authenticated users with the Backup Operator role can modify backup job configurations to inject and execute code.   Arbitrary Code Execution 
  CVE-2025-24287  Veeam Agent for Microsoft Windows 6.3.1.1074 and earlier  Local users can manipulate directory contents leading to code execution with elevated privileges.  Local Privilege Escalation  

Remediation: 

Users are strongly advised to apply the following updates to mitigate the risks: 

  • Upgrade Veeam Backup & Replication to 12.3.2 (build 12.3.2.3617) or later 
  • Upgrade Veeam Agent for Microsoft Windows to 6.3.2 (build 6.3.2.1205) or later 

Here are some recommendations below 

  • Limit backup server access to trusted users only to reduce the risk of unauthorized control. 
  • Apply least privilege principles for backup roles so users have only the permissions they need. 
  • Regularly monitor backup job changes and system logs to detect suspicious activity early. 
  • Provide security awareness training to staff focusing on backup and recovery best practices. 

Conclusion:  For Security Best practices

Veeam has released patches to address all three vulnerabilities and urged organizations to update Veeam Backup & Replication 12.3.2 (build 12.3.2.3617) and Veeam Agent for Microsoft Windows 6.3.2 (build 6.3.2.1205) as soon as possible.

For security best practices maintaining up-to-date backup systems, prompt patching and adherence to security best practices are essential to prevent potential exploitation and data compromise.

The critical nature of vulnerabilities demands backup and disaster recovery along with strict access controls and ongoing monitoring as essential tips to safeguard infrastructure that have been backed up from potential attacks. 

References: 

Security Advisory

Apache Tomcat Vulnerabilities Expose Systems to DoS & Authentication Bypass  

Security Advisory; Summary

Multiple vulnerabilities have been identified in Apache Tomcat affecting various versions and critical security updates provided to address four newly discovered vulnerabilities in Apache Tomcat. The disclosed Apache Tomcat vulnerabilities pose serious threats, especially in high-availability or internet-exposed environments.

Apache Tomcat is one of the world’s most widely used open-source Java servlet containers.

OEM Apache 
Severity High 
CVSS Score 8.4 
CVEs CVE-2025-48976, CVE-2025-48988, CVE-2025-49125, CVE-2025-49124 
Actively Exploited No 
Exploited in Wild No 
Advisory Version 1.0 

Overview 

The affected versions 9.0.x, 10.1.x and 11.0.x, also include high-impact denial-of-service (DoS) vulnerabilities and a moderate authentication bypass flaw as well as a Windows installer issue that may allow privilege escalation via side-loading. 

Timely patching is essential to prevent potential service disruptions and unauthorized access. 

Vulnerability Name CVE ID Product Affected Severity 
​Memory Exhaustion via Multipart Header Exploitation  CVE-2025-48976 Apache Tomcat  High 
Multipart Upload Resource Exhaustion  CVE-2025-48988 Apache Tomcat  High 
Security Constraint Bypass (Pre/PostResources)  CVE-2025-49125 Apache Tomcat  High 
Windows Installer Side-Loading Risk  CVE-2025-49124 Apache Tomcat  High 

Technical Summary 

The vulnerabilities affect Tomcat’s handling of multipart HTTP requests, resource mounting and Windows installation process. Exploitation may result in denial-of-service (via memory exhaustion), privilege escalation (via installer abuse) and authentication bypass. 

CVE ID System Affected Vulnerability Details Impact 
  CVE-2025-48976 Apache Tomcat 9.0.0.M1–9.0.105, 10.1.0-M1–10.1.41, 11.0.0-M1–11.0.7 Fixed memory allocation limit in multipart header processing could be exploited to consume memory and cause DoS.  Denial-of-service attack. 
  CVE-2025-48988 Apache Tomcat 9.0.0.M1–9.0.105, 10.1.0-M1–10.1.41, 11.0.0-M1–11.0.7 Multipart request body with many parts can trigger high memory usage due to improper limit handling between parameters and parts.  Denial-of-service attack. 
  CVE-2025-49125  Tomcat with Pre/Post Resources enabled Lack of resource path normalization allows attackers to access resources outside root bypassing auth controls. Authentication and Authorization Bypass. 
  CVE-2025-49124  Tomcat Windows Installers Installer invoked icacls.exe without full path, making it vulnerable to side-loading attacks via PATH manipulation. Privilege Escalation. 

Remediation: 

Update Immediately: Users of the affected versions should apply one of the following mitigations. 

  • Upgrade to Apache Tomcat 11.0.8 or later 
  • Upgrade to Apache Tomcat 10.1.42 or later   
  • Upgrade to Apache Tomcat 9.0.106 or later 

Conclusion: 

Attackers could exploit these flaws to cause denial-of-service, escalate privileges or bypass authentication and authorization controls. 

The Apache Software Foundation credits the TERASOLUNA Framework Security Team of NTT DATA Group Corporation and T. Doğa Gelişli for identifying these issues.

Tomcat is widely used in enterprise and cloud environments, prompt patching is essential to prevent potential exploitation, service outages, or unauthorized access.

References: 

  • https://lists.apache.org/thread/0jwb3d3sjyfk5m6xnnj7h9m7ngxz23db 

Blogs Security Advisory

Cyber-Security News at a Glance: June1st -June15th, 2025

The current cybersecurity landscape continues to evolve, marked by persistent challenges and digital technologies transforming the cyber world. Across industries such as healthcare and financial services, in the month of June,2025, organizations navigated advanced threats, cyber attacks on retail sector including Security advisory’s etc.

Let’s explore the key trends and incidents from June1st -June15th, 2025

Microsoft June 2025 Patch Tuesday addresses a total of 67 vulnerabilities across its product ecosystem. Critical flaws in WebDAV, SMB, SharePoint and Remote Desktop Services highlight the urgency of installing this month’s updates.

Microsoft June 2025 Patch Tuesday – 67 Vulnerabilities Fixed Including 2 Zero-Days 

NCSC UK, released set of 6 principles to build Cyber Security culture & Boost Resilience for Orgs

The U.K. National Cyber Security Centre on Wednesday published six cybersecurity culture principles developed through extensive research with industry and government partners.

The principles define the cultural foundations essential for building a cyber-resilient organization and offer guidance on how to cultivate that environment.

NCSC UK, released set of 6 principles to build Cyber Security culture & Boost Resilience for Orgs

Critical 0-Day RCE Vulnerability in Fortinet Products (CVE-2025-32756) Actively Exploited 

A critical unauthenticated Remote Code Execution (RCE) vulnerability, tracked as CVE-2025-32756, has been identified in multiple Fortinet products.

The flaw is currently under active exploitation, allowing attackers to take full control of affected systems via a buffer overflow in the /remote/hostcheck_validate endpoint. A public PoC is available, significantly increasing the risk to unpatched devices. 

CVE-2025-32756 is a critical unauthenticated Remote Code Execution (RCE) vulnerability affecting multiple Fortinet products. The vulnerability resides in the /remote/hostcheck_validate endpoint and is due to improper bounds checking when parsing the enc parameter of the AuthHash cookie.

POC Released for Critical RCE Vulnerability in AWS Amplify Codegen-UI 

 A critical security vulnerability has been disclosed in AWS Amplify Studio’s UI generation framework, with researchers releasing a proof-of-concept exploit demonstrating remote code execution capabilities.  AWS addressed the issue in version 2.20.3, replacing the unsafe eval() with a sandboxed expression evaluator. 

Vulnerable versions used eval() to interpret stringified JavaScript expressions in UI components. This allowed injection of malicious expressions such as shell commands, due to the absence of validation or blacklisting.  

Splunk Enterprise & Cloud platform found that  (XSS) vulnerability existed & affects their multiple versions

Splunk has disclosed a medium-severity cross-site scripting (XSS) vulnerability affecting multiple versions of its Enterprise and Cloud Platform products that could allow low-privileged attackers to execute malicious JavaScript code in users’ browsers.

A security vulnerability identified as CVE-2025-20297 has been found in older versions of Splunk Enterprise and Splunk Cloud Platform.

Reflected XSS Vulnerability in Splunk Enterprise & Cloud Platform 

(DoS) Vulnerability has been identified in ModSecurity, an open-source web application

The issue affects versions prior to 2.9.10 and related to the “sanitiseArg” action, which can be exploited by adding an excessive number of arguments, ultimately causing the system to fail or crash. The vulnerability has been fixed in version 2.9.10. 

This vulnerability is similar to this CVE-2025-47947 issue, presents a significant risk, especially for organizations relying on ModSecurity 2.x versions for web application protection. 

High Risk DoS Vulnerability in ModSecurity WAF 

Multiple vulnerabilities have been discovered in IBM QRadar Suite Software and Cloud Pak, affecting versions 1.10.0.0 through 1.11.2.0.

The company released patches on June 3, 2025, addressing five distinct Common Vulnerabilities and Exposures (CVEs) that affect enterprise security infrastructure used by organizations worldwide.

The most critical vulnerability (CVE-2025-25022) allows unauthenticated access to sensitive configuration files. IBM has released version 1.11.3.0 to address these issues. 

Critical Vulnerabilities Patched in IBM QRadar Suite & Cloud Pak for Security 

Google has released a critical out-of-band security update for its Chrome browser to address CVE-2025-5419.

Rated as high-severity zero-day vulnerability in the V8 JavaScript engine that is currently being actively exploited in the wild. Google has released a critical out-of-band security update for its Chrome browser to address CVE-2025-5419.

This vulnerability allows attackers to execute arbitrary code on users’ systems through specially crafted web content, making it a serious threat requiring immediate attention. 

Google Chrome Patches Actively Exploited Zero-Day Vulnerability 

Ways to combat Cyber Threats; Strengthen your SOC’s readiness involves 3 key strategies

Cyber threats are no longer limited to human attackers, with AI-driven “bad bot” attacks now accounting for 1/3 as per research. These attacks can be automated, allowing attackers to launch more extensive and efficient campaigns

Organizations are now exposed new risks, providing cybercriminals with more entry points and potential “surface areas” to exploit as they go digital and adopt to innovations and wider use of digital technologies.

Some of the types of bad bots are DDoS bots, which disrupt a website or online service by overwhelming it with traffic from multiple sources.

IntruceptLabs now offers Mirage Cloak and to summarise Mirage Cloak offers various deception methods to detect and stop threats before they cause damage.

These methods include adding decoys to the network, deploying breadcrumbs on current enterprise assets, using baits as tripwires on endpoints.

 This is executed by setting up lures with intentionally misconfigured or vulnerable services or applications.

The flexible framework also lets customers add new deception methods as needed.

Conclusion: Organizations can better protect their digital assets and ensure business continuity by understanding the key components and best practices for building a successful SOC.

At the end  we must accept that to defend against any sort of AI attack, SOC teams must evolve with right collaborations and effective communication between partners seamlessly to evaluate information to stay ahead of attackers.

Security Advisory

POC Released for Critical RCE Vulnerability in AWS Amplify Codegen-UI  

Summary: A critical security vulnerability has been disclosed in AWS Amplify Studio’s UI generation framework, with researchers releasing a proof-of-concept exploit demonstrating remote code execution capabilities.

OEM AWS 
Severity Critical 
CVSS Score 9.5 
CVEs CVE-2025-4318 
POC Available Yes 
Actively Exploited No 
Exploited in Wild No 
Advisory Version 1.0 

Overview 

A critical vulnerability has been discovered in AWS Amplify Studio’s UI generation tool, @aws-amplify/codegen-ui, which allows Remote Code Execution (RCE) during build or render time.

Tracked as CVE-2025-4318, this flaw originates from unsafe evaluation of user-defined JavaScript expressions without proper input validation or sandboxing.

It has been assigned a CVSS score of 9.5. Exploitation could lead to unauthorized command execution, leakage of AWS secrets, or full compromise of CI/CD environments. AWS addressed the issue in version 2.20.3, replacing the unsafe eval() with a sandboxed expression evaluator. 

Vulnerability Name CVE ID Product Affected Severity Fixed Version 
​Unsafe Expression Evaluation in Codegen-UI  CVE-2025-4318 @aws-amplify/codegen-ui  Critical  2.20.3 

Technical Summary 

The vulnerability stems from how AWS Amplify Studio processed dynamic expressions defined in component fields (eg: label, placeholder).

In affected versions, these expressions were directly evaluated using eval() without any filtering or validation, assuming they were safe.

This behavior enabled attackers to inject malicious code into UI schemas that would execute during the build or runtime process particularly dangerous in CI/CD pipelines where secrets and environment variables are accessible. 

A working Proof-of-Concept (PoC) has been developed and shared by researchers, which simulates the exploit using a crafted JSON component, a Node.js script and a Python server. The PoC demonstrates successful RCE via malicious input evaluated by the vulnerable tool. 

CVE ID System Affected  Vulnerability Details Impact 
  CVE-2025-4318  AWS Amplify Studio (<=2.20.2) Vulnerable versions used eval() to interpret stringified JavaScript expressions in UI components. This allowed injection of malicious expressions such as shell commands, due to the absence of validation or blacklisting.    RCE, exposure of secrets, CI/CD compromise, unauthorized system control 

Remediation: 

Upgrade Immediately: Update @aws-amplify/codegen-ui to version 2.20.3 or later, which replaces unsafe evaluation logic with a sandboxed function (safeEval) and a keyword blacklist. 

Conclusion: 
CVE-2025-4318 is a severe RCE vulnerability in AWS Amplify Studio caused by unsafe evaluation of JavaScript expressions during UI component rendering or generation.

A fully functional PoC exploit has been published, which clearly demonstrates the risk of using eval() in dynamic application code without input validation. 

The fixed version mitigates this risk by introducing a sandboxed evaluation mechanism and filtering dangerous keywords. Organizations using Amplify Studio should upgrade immediately and audit all inputs and build processes for safety. 

AWS security teams have advised developers to immediately upgrade to version 2.20.3 or later and audit all existing component schemas for potentially unsafe expressions.

The incident highlights the critical importance of implementing secure coding practices in low-code development platforms where user input directly influences code generation and execution processes.

References: 

Security Advisory

Critical Credential Reuse Vulnerability in Cisco ISE Cloud Deployments 

Summary 

OEM Cisco 
Severity Critical 
CVSS Score 9.9 
CVEs CVE-2025-20286 
Actively Exploited No 
Exploited in Wild No 
Advisory Version 1.0 

Overview 

Cisco has disclosed a critical vulnerability in Identity Services Engine (ISE) cloud deployments that allows unauthenticated remote attackers to gain administrative access across multiple instances due to improperly generated static credentials.

Tracked as CVE-2025-20286, with a CVSS score of 9.9, this flaw affects ISE deployments on AWS, Microsoft Azure, and Oracle Cloud Infrastructure (OCI). Cisco has released hotfixes and announced permanent fixes for impacted versions. 

Vulnerability Name CVE ID Product Affected Severity 
​Cisco ISE Shared Credential Vulnerability  CVE-2025-20286 Cisco ISE   Critical 

Technical Summary 

The vulnerability stems from improper generation of credentials during the setup of Cisco ISE on cloud platforms. Each deployment of the same ISE version on a given platform (eg – AWS 3.1) shares identical static credentials. This oversight enables an attacker to extract credentials from one deployment and reuse them to access others, if network access is available. 

This issue is only to cloud-hosted Primary Administration nodes. Traditional on-premises deployments or hybrid setups with local admin nodes are not affected. 

CVE ID System Affected  Vulnerability Details Impact 
  CVE-2025-20286  Cisco ISE 3.1 – 3.4 Static credentials reused across same-version cloud deployments. Credentials can be extracted from one instance and reused across others on the same cloud platform   Access sensitive data 

Remediation: 

Apply Hotfix Immediately: Install the universal hotfix ise-apply-CSCwn63400_3.1.x_patchall-SPA.tar.gz on ISE versions 3.1 to 3.4. 

Cisco ISE Release Hot Fix First Fixed Release 
3.0 and earlier Not applicable. Not affected. 
3.1 ise-apply-CSCwn63400_3.1.x_patchall-SPA.tar.gz Migrate to a fixed release. 
This hot fix applies to Releases 3.1 through 3.4. 
3.2 ise-apply-CSCwn63400_3.1.x_patchall-SPA.tar.gz Migrate to a fixed release. 
This hot fix applies to Releases 3.1 through 3.4. 
3.3 ise-apply-CSCwn63400_3.1.x_patchall-SPA.tar.gz 3.3P8 (November 2025) 
This hot fix applies to Releases 3.1 through 3.4. 
3.4 ise-apply-CSCwn63400_3.1.x_patchall-SPA.tar.gz 3.4P3 (October 2025) 
This hot fix applies to Releases 3.1 through 3.4. 
3.5 Not applicable. Planned release (Aug 2025) 

Conclusion: 
CVE-2025-20286 presents a severe security risk to organizations using Cisco ISE on public cloud platforms. By exploiting shared static credentials, attackers can potentially move laterally between cloud deployments.

Although no active exploitation has been reported, a proof-of-concept (PoC) exploit is available, heightening the urgency for remediation. 

Organizations should apply hotfixes immediately, upgrade to secured versions, and tighten cloud network access policies to mitigate the risk. On-premises and hybrid deployments remain unaffected, offering a safer architectural alternative. 

References: 

Security Advisory

Reflected XSS Vulnerability in Splunk Enterprise & Cloud Platform 

Summary 

Splunk has disclosed a medium-severity cross-site scripting (XSS) vulnerability affecting multiple versions of its Enterprise and Cloud Platform products that could allow low-privileged attackers to execute malicious JavaScript code in users’ browsers.

OEM Cisco 
Severity MEDIUM 
CVSS Score 4.3 
CVEs CVE-2025-20297 
CWEs CWE-79 
Exploited in Wild No 
Advisory Version 1.0 

Overview 

A security vulnerability identified as CVE-2025-20297 has been found in older versions of Splunk Enterprise and Splunk Cloud Platform.

This issue allows low privileged users to execute unauthorized JavaScript code in a victim’s browser using a specific Splunk feature that generates Pdf from dashboards.

Although the vulnerability is rated as Medium (CVSS 4.3) but it could be a significant risk in environments where Splunk Web is widely accessed by users. 

The vulnerability specifically targets instances with Splunk Web enabled, which represents the majority of production deployments given the component’s central role in dashboard management and user interface functionality.

Vulnerability Name CVE ID Product Affected Severity Fixed Version 
​Reflected Cross Site Scripting  CVE-2025-20297 Splunk Enterprise & Cloud  Medium  Check the remediation section. 

Technical Summary 

The vulnerability lies in the pdfgen/render REST endpoint used to create dashboard PDFs. In vulnerable versions, a low \privileged user (not an admin or power user) can inject a malicious script via this endpoint.

If a legitimate user interacts with the resulting PDF or link, their browser may execute the injected script without their consent, this is working as reflected XSS. 

CVE ID System Affected Vulnerability Details Impact 
CVE-2025-20297  Splunk Enterprise & Cloud multiple versions Low-privileged users can exploit the pdfgen/render endpoint to inject unauthorized JavaScript code into a victim’s browser. Code Execution/Reflected xss. 

Remediation: 

Splunk has released updates, that addressed the vulnerability:  

  • Splunk Enterprise: Upgrade to version 9.4.2, 9.3.4, 9.2.6, 9.1.9 or latest. 
  • Splunk Cloud Platform: Upgrade to version 9.3.2411.102, 9.3.2408.111, 9.2.2406.118 or latest. 

If you cannot upgrade immediately, you can disable Splunk Web to prevent exploitation. For this you can review the web.conf configuration file and follow the Splunk guidance on disabling unnecessary components. 

Disabling Splunk Web may impact users who rely on the web interface so consider access controls or network-based restrictions as temporary mitigations. 

Conclusion: 
While CVE-2025-20297 is rated as a medium severity vulnerability, it should not be ignored in the environments where many users interact with Splunk dashboards. Attackers with limited permissions could potentially target higher privileged users by modifying malicious links or payloads. 

Organizations should prioritize upgrading Splunk to the fixed versions or implementing the workarounds immediately.

Even though this vulnerability requires some user interaction, the risks include unauthorized access to sensitive data through potential session hijacking. 

While Splunk has not provided specific detection methods for this vulnerability, organizations should monitor access patterns to the pdfgen/render endpoint and review user privilege assignments to minimize potential exposure

This vulnerability poses a significant risk to organizations relying on Splunk’s data analytics platform for security monitoring and business intelligence operations.

References: 

Security Advisory

High Risk DoS Vulnerability in ModSecurity WAF 

Summary 

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.

OEM ModSecurity 
Severity HIGH 
CVSS Score 7.5 
CVEs CVE-2025-48866 
CWEs CWE-1050 
Exploited in Wild No 
Advisory Version 1.0 

Overview 

A Denial of Service (DoS) vulnerability has been identified in ModSecurity, an open-source web application firewall (WAF) used with Apache, Nginx and IIS.

The issue affects versions prior to 2.9.10 and related to the “sanitiseArg” action, which can be exploited by adding an excessive number of arguments, ultimately causing the system to fail or crash. The vulnerability has been fixed in version 2.9.10. 

There is no user interaction required to trigger, exploiting it can lead to significant resource consumption, resulting in service disruption. 

Vulnerability Name CVE ID Product Affected Severity Fixed Version 
​Denial of Service (DoS) vulnerability  CVE-2025-48866 Modsecurity WAF  High  v2.9.10 

Technical Summary 

The vulnerability arises from the behavior of the “sanitiseArg” (also referred to as “sanitizeArg”) action in ModSecurity. This action sanitizes a specific argument passed to a rule (e.g.- password), masking it in the logs by replacing its value with asterisks (*). 

CVE ID System Affected Vulnerability Details Impact 
  CVE-2025-48866  ModSecurity (mod_security2.x) prior to v2.9.10 When a rule uses the sanitiseArg action, it processes each argument that matches the specified name (e.g – password).  If a large number of matching arguments (e.g.- 500 or more) are passed, ModSecurity repeatedly adds them to memory, which can lead to excessive memory consumption and potentially crash the system. System crashes due to resource exhaustion (DoS)   

Remediation: 

Apply Patches Promptly: Upgrade to ModSecurity version 2.9.10 or the latest one. 

Avoid using the “sanitizeArg” or “sanitizeArg” actions in your rules. If these actions are not used, the engine will not be affected by the vulnerability.  

Conclusion: 
This vulnerability is similar to this CVE-2025-47947 issue, presents a significant risk, especially for organizations relying on ModSecurity 2.x versions for web application protection. 

Although the vulnerability is rated as high, it requires a specific set of conditions to be exploited. But to ensure the continued stability and security of web applications, the fix needs to be applied as soon as possible. 

References: 

Scroll to top