CISA adds Cacti, Office, Windows and iOS bugs to its Known Exploited Vulnerabilities Catalog

US CISA added actively exploited flaws in Cacti framework, Microsoft Office, Windows, and iOS to its Known Exploited Vulnerabilities Catalog.

US CISA added the following actively exploited flaws to its Known Exploited Vulnerabilities Catalog:

CVE-2022-46169 – Cacti is an open-source platform that provides a robust and extensible operational monitoring and fault management framework for users. The flaw is a command injection vulnerability that can be exploited by an unauthenticated user to execute arbitrary code on a server running Cacti, if a specific data source was selected for any monitored device. The flaw resides in the `remote_agent.php` file that can be accessed by any unauthenticated user. The vulnerability affects versions 1.2.22 and below.

CISA orders federal agencies to fix this vulnerability by March 9, 2023.

CVE-2023-21715 – The flaw is a Microsoft Office Publisher security feature bypass vulnerability.

“Microsoft Office Publisher contains a security feature bypass vulnerability which allows for a local, authenticated attack on a targeted system” state the description published by CISA.

CVE-2023-23376 – The flaw is a Windows common log file system driver elevation of privilege vulnerability. An attacker can exploit this vulnerability to gain SYSTEM privileges.

CVE-2023-21823 – The vulnerability is a Windows Graphics Component remote code execution issue.

“An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.” reads the advisory published by Microsoft.

The above flaws in Microsoft products have been addressed with the release of Patch Tuesday security updates for February 2023 and CISA orders federal agencies to fix them by March 7, 2023.

CVE-2023-23529 – The vulnerability is a type confusion issue in WebKit that was addressed by the IT giant with improved checks. The flaw impacts iOS, iPadOS, and macOS.

An attacker can achieve arbitrary code execution by tricking the victims into visiting maliciously crafted web content. This is the first zero-day vulnerability addressed by Apple in 2023. CISA orders federal agencies to fix this flaw by March 7, 2023

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts recommend also private organizations review the Catalog and address the vulnerabilities in their infrastructure.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Known Exploited Vulnerabilities Catalog)