Pierluigi Paganini December 02, 2021

U.S. CISA urges to address vulnerabilities Qualcomm, Mikrotik, Zoho and the Apache Software Foundation software.

U.S. Cybersecurity and Infrastructure Security Agency (CISA) has updated its catalog of actively exploited vulnerabilities recommending federal agencies to address the flaws in Qualcomm, Mikrotik, Zoho and the Apache Software Foundation software within specific timeframes and deadlines.

CISA also warns of risk to the federal enterprise for delaying to address these vulnerabilities.

The US Agency requests the Federal agencies to apply security patches for Zoho ManageEngine ServiceDesk flaws by December 15, 2021. The two flaws added to the catalog are the CVE-2021-37415 Zoho ManageEngine ServiceDesk authentication bypass vulnerability and the CVE-2021-44077 Zoho ManageEngine ServiceDesk Plus remote code execution.

Both issues have been actively exploited by nation-state actors over the last few months.

CISA also urges to address the CVE-2018-14847 MikroTik Router OS Directory Traversal Vulnerability within June 1th 2022.

Another flaw added to the catalog is the CVE-2021-40438 Apache HTTP Server-Side Request Forgery (SSRF) vulnerability that must be addressed by December 15, 2021. A few days ago, the German Cybersecurity Agency and Cisco warned of attacks exploiting the recently patched CVE-2021-40438 flaw in Apache HTTP servers.

The German BSI agency published an alert about this vulnerability, it is aware of at least one attack exploiting this flaw.

The fifth issue added to the list of actively exploited vulnerabilities is the CVE-2020-11261 Improper Input Validation flaw that impacts multiple Qualcomm chipsets. This vulnerability must be addressed by June 1th 2022.

Google warned that the Qualcomm vulnerability was exploited by threat actors in limited, targeted attacks.

“There are indications that CVE-2020-11261 may be under limited, targeted exploitation” reads a note added to the January security bulletin last week.

The CVE-2020-11261 flaw was reported to Qualcomm by Google’s Android Security team on August 20, 2020 and was addressed in January 2021.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Zoho)

[adrotate banner=”5″]

[adrotate banner=”13″]