CISA adds Zoho, Apache, Qualcomm, Mikrotik flaws to the list of actively exploited issues

U.S. CISA urges to address vulnerabilities Qualcomm, Mikrotik, Zoho and the Apache Software Foundation software.

U.S. Cybersecurity and Infrastructure Security Agency (CISA) has updated its catalog of actively exploited vulnerabilities recommending federal agencies to address the flaws in Qualcomm, Mikrotik, Zoho and the Apache Software Foundation software within specific timeframes and deadlines.

CISA also warns of risk to the federal enterprise for delaying to address these vulnerabilities.

The US Agency requests the Federal agencies to apply security patches for Zoho ManageEngine ServiceDesk flaws by December 15, 2021. The two flaws added to the catalog are the CVE-2021-37415 Zoho ManageEngine ServiceDesk authentication bypass vulnerability and the CVE-2021-44077 Zoho ManageEngine ServiceDesk Plus remote code execution.

Both issues have been actively exploited by nation-state actors over the last few months.

CISA also urges to address the CVE-2018-14847 MikroTik Router OS Directory Traversal Vulnerability within June 1th 2022.

Another flaw added to the catalog is the CVE-2021-40438 Apache HTTP Server-Side Request Forgery (SSRF) vulnerability that must be addressed by December 15, 2021. A few days ago, the German Cybersecurity Agency and Cisco warned of attacks exploiting the recently patched CVE-2021-40438 flaw in Apache HTTP servers.

The German BSI agency published an alert about this vulnerability, it is aware of at least one attack exploiting this flaw.

The fifth issue added to the list of actively exploited vulnerabilities is the CVE-2020-11261 Improper Input Validation flaw that impacts multiple Qualcomm chipsets. This vulnerability must be addressed by June 1th 2022.

Google warned that the Qualcomm vulnerability was exploited by threat actors in limited, targeted attacks.

“There are indications that CVE-2020-11261 may be under limited, targeted exploitation” reads a note added to the January security bulletin last week.

The CVE-2020-11261 flaw was reported to Qualcomm by Google’s Android Security team on August 20, 2020 and was addressed in January 2021.

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, Zoho)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.