Pierluigi Paganini September 07, 2024

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Draytek VigorConnect and Kingsoft WPS Office bugs to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Draytek VigorConnect and Kingsoft WPS Office vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog.

Below are the descriptions for these vulnerabilities:

• CVE-2021-20123 Draytek VigorConnect Path Traversal Vulnerability: A local file inclusion issue in Draytek VigorConnect 1.6.0-B3 allows unauthenticated attackers to exploit the file download functionality of the DownloadFileServlet endpoint. This flaw enables attackers to download arbitrary files from the underlying operating system with root privileges, posing a significant security risk.
• CVE-2021-20124 Draytek VigorConnect Path Traversal Vulnerability: A local file inclusion vulnerability in Draytek VigorConnect 1.6.0-B3 affects the WebServlet endpoint’s file download functionality. This flaw allows unauthenticated attackers to download arbitrary files from the underlying operating system with root privileges, posing a serious security threat.
• CVE-2024-7262 Kingsoft WPS Office Path Traversal Vulnerability: An improper path validation vulnerability in Kingsoft WPS Office (versions 12.2.0.13110 to 12.2.0.16412) allows attackers to load arbitrary Windows libraries via the promecefpluginhost.exe. This flaw has been weaponized in a single-click exploit, delivered through a deceptive spreadsheet document.

At the end of August, Eset researchers reported that South Korea-linked group APT-C-60 exploited a zero-day, tracked as CVE⁠-⁠2024⁠-⁠7262, in the Windows version of WPS Office to deploy the SpyGlace backdoor in the systems on targets in East Asia.

WPS Office is a comprehensive office productivity suite developed by Chinese software company Kingsoft and is widely used in Asia. It provides users with a range of tools for creating, editing, and managing documents, spreadsheets, presentations, and PDFs.

According to the WPS website, WPS Office has over 500 million active users worldwide. 

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix this vulnerability by September 24, 2024.

Pierluigi Paganini

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

(SecurityAffairs – hacking, CISA)