Top CVEs & Vulnerabilities of October 2024

October has brought some serious vulnerabilities to the forefront, capturing the attention of cybersecurity teams across industries. If you’re managing IT security or staying alert to cyber threats, knowing which vulnerabilities need immediate attention is essential. From remote code execution flaws to authentication bypasses, each of these vulnerabilities poses unique risks that could disrupt operations or expose sensitive data. In this blog, we’ll explore the top 5 CVEs of October 2024. What they mean, why they matter, and how to protect against them. Let’s take a closer look and ensure you’re prepared to handle these threats.

1. CVE-2024-47575: FortiManager Missing Authentication 

CVE-2024-47575 is a critical vulnerability that affects multiple versions of FortiManager network management solutions. This vulnerability arises from a missing authentication for a critical function (CWE-306) in the FortiManager fgfmd daemon.

Impact

Successful exploitation of this vulnerability could have severe consequences for organizations, including:

• Data Theft: Attackers could steal sensitive information such as network configurations, credentials, and customer data.
• System Compromise: Attackers could gain unauthorized access to other systems within the network.
• Service Disruption: Attackers could disrupt network operations by modifying configurations or launching attacks.

Details of the Vulnerability

• Severity: Critical
• CVSS Score: 9.8
• Affected Products:
  • FortiManager versions prior to 7.2.6 build1164
  • FortiManager versions prior to 7.3.2 build1003
• Vulnerability Type: Missing Authentication
• Exploitability: Functional; exploitation has been observed in the wild.
• Authentication: No authentication required for exploitation.

Mitigation

To mitigate this vulnerability, it is crucial to:

1. Update FortiManager:
   
   • Upgrade to FortiManager version 7.2.6 build1164 or later.
   • Upgrade to FortiManager version 7.3.2 build1003 or later.
2. Implement Strong Security Practices:
   
   • Regularly update FortiManager and other network devices.
   • Use strong, unique passwords for all administrative accounts.
   • Enable strong authentication methods, such as two-factor authentication (2FA).
   • Monitor network traffic for suspicious activity.
   • Keep network security devices up-to-date with the latest security patches.

2. CVE-2024-21260: Oracle WebLogic Server Vulnerability  

CVE-2024-21260 is a security vulnerability affecting specific versions of Oracle WebLogic Server. This vulnerability allows an unauthenticated attacker with network access to exploit the T3 or IIOP protocols to compromise the server.  

Impact

Successful exploitation of this vulnerability could lead to severe consequences, including:

• Denial of Service (DoS): The attacker could cause the server to crash or become unresponsive.  
• Unauthorized Access: The attacker could gain unauthorized access to the server and its underlying systems.
• Data Theft: The attacker could steal sensitive data stored on the server.

Details of the Vulnerability

• Severity: High
• CVSS Score: 7.5  
• Affected Products:
  • Oracle WebLogic Server 12.2.1.4.0  
  • Oracle WebLogic Server 14.1.1.0.0  
• Vulnerability Type: Remote Code Execution (RCE)
• Exploitability: Easily exploitable  
• Authentication: No authentication required

Mitigation

Oracle has released security patches to address this vulnerability. To protect your systems, it is strongly recommended to:  

1. Apply the Latest Patch: Install the latest security patch released by Oracle for the affected WebLogic Server versions.
2. Restrict Network Access: Limit network access to the WebLogic Server to trusted sources and block access from untrusted networks.
3. Implement Strong Access Controls: Enforce strong password policies and use multi-factor authentication (MFA) to protect administrative accounts.
4. Keep Software Up-to-Date: Regularly update all software components, including the operating system, middleware, and applications, to the latest security patches.  
5. Monitor Network Traffic: Monitor network traffic for signs of malicious activity, such as unusual network scans or attempted exploits.

3. CVE-2024-43573: Windows MSHTML Platform Spoofing Vulnerability

CVE-2024-43573 is a critical security vulnerability affecting the Microsoft HTML (MSHTML) platform. This vulnerability allows attackers to spoof the identity of websites or applications, potentially leading to phishing attacks, malware distribution, and other malicious activities.  

Impact

Successful exploitation of this vulnerability could have severe consequences, including:

• Phishing Attacks: Attackers could trick users into revealing sensitive information, such as login credentials or financial details.  
• Malware Distribution: Malicious code could be downloaded and executed on vulnerable systems, compromising their security.
• Data Theft: Attackers could steal confidential data stored on compromised systems.

Details of the Vulnerability

• Severity: Critical
• CVSS Score: 6.8
• Affected Products: Microsoft Windows operating systems
• Vulnerability Type: Spoofing
• Exploitability: Functional; exploitation has been observed in the wild.  
• Authentication: No authentication required for exploitation.

Mitigation

To mitigate this vulnerability, Microsoft has released security updates for affected Windows versions. It is highly recommended to install these updates as soon as possible:  

1. Install the Latest Windows Updates:
   
   • Keep your Windows operating system up-to-date with the latest security patches.
   • Use Windows Update to automatically download and install updates, or manually check for updates through the Windows Settings.  

2. Exercise Caution with Email Attachments and Links:
   
   • Be wary of suspicious emails, especially those with unexpected attachments or links.  
   • Avoid clicking on links or opening attachments from unknown or untrusted sources.  

3. Use a Reputable Antivirus Solution:
   
   • Install and maintain a reliable antivirus program to protect your system from malware.  
   • Keep your antivirus software up-to-date with the latest virus definitions.

4. Enable Browser Security Features:
   
   • Configure your web browser to block pop-ups, scripts, and other potentially harmful content.
   • Use a strong, unique password for your browser and other online accounts.

4. CVE-2024-43572: Microsoft Management Console Remote Code Execution Vulnerability  

CVE-2024-43572 is a critical vulnerability discovered in Microsoft Management Console (MMC). This vulnerability allows attackers to execute malicious code on affected systems remotely, without user interaction. Successful exploitation could compromise the security of the system, leading to data theft, system damage, or unauthorized access.  

Impact

A successful attack could have severe consequences, including:

• Remote Code Execution: Attackers could gain control over the affected system, allowing them to execute arbitrary code.  
• Data Theft: Sensitive data could be stolen or compromised.
• System Compromise: The system could be used as a launching point for further attacks.
• Denial of Service: Attackers could disrupt system operations.

Details of the Vulnerability

• Severity: Critical
• CVSS Score: 7.8  
• Affected Products:
  • Windows 10, versions 1809, 21H2, and 22H2
  • Windows Server 2019 and 2022  
• Vulnerability Type: Remote Code Execution (RCE)  
• Exploitability: Functional; exploitation is possible.  
• Authentication: No authentication is required for exploitation.

Mitigation

Microsoft has released security updates to address this vulnerability. To protect your systems, it is strongly recommended to:

1. Install the Latest Updates:
   • Apply the latest security updates from Microsoft as soon as they are available. These updates will patch the vulnerability and prevent successful exploitation.
2. Keep Software Up-to-Date:
   • Regularly update all software, including operating systems, applications, and drivers, to the latest versions. This helps to mitigate a wide range of vulnerabilities.
3. Exercise Caution with Malicious Attachments and Links:
   • Avoid opening suspicious emails or clicking on unknown links, as they may contain malicious payloads that could exploit vulnerabilities.  
4. Use Strong Passwords:
   • Create strong, unique passwords for all accounts and enable multi-factor authentication (MFA) whenever possible.
5. Implement Network Security Measures:
   • Use firewalls, intrusion detection systems, and other security tools to protect your network and systems from attacks.

5. CVE-2024-43582: Remote Desktop Protocol Server Remote Code Execution Vulnerability  

CVE-2024-43582 is a critical security vulnerability affecting Microsoft Windows systems that utilize the Remote Desktop Protocol (RDP) server. This vulnerability could potentially allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.  

Impact

Successful exploitation of this vulnerability could lead to severe consequences, including:

• System compromise: Attackers could gain full control over the affected system.
• Data theft: Sensitive information stored on the system could be stolen.
• Network disruption: Attackers could disrupt network operations by launching further attacks.
• Ransomware attacks: The compromised system could be infected with ransomware.

Details of the Vulnerability

• Severity: Critical
• CVSS Score: 9.8
• Affected Products:
  • Windows 10 versions 1809, 1909, 20H2, 21H2, 22H2
  • Windows Server 2019 and 2022  
• Vulnerability Type: Remote Code Execution (RCE)  
• Exploitability: Functional
• Authentication: None required

Mitigation

Microsoft has released security updates to address this vulnerability. To protect your systems, it is crucial to install these updates as soon as possible. You can apply the updates through Windows Update or by downloading them directly from the Microsoft Update Catalog.

Here are some additional security best practices to consider:

• Keep systems up-to-date: Regularly install security updates and patches for all software, including operating systems and applications.  
• Strong passwords: Use strong, unique passwords for all accounts.
• Two-factor authentication (2FA): Enable 2FA for all accounts to add an extra layer of security.
• Network segmentation: Segment your network to limit the impact of a potential breach.  
• Firewall rules: Configure firewall rules to restrict RDP access to only necessary IP addresses.  
• Monitor network traffic: Use network monitoring tools to detect and respond to suspicious activity.  
• Security awareness training: Educate users about security best practices to reduce the risk of human error.
    

Final Words

Cyber threats are hitting harder than ever, and the vulnerabilities this October prove just how fast risks evolve. Staying on top of these threats is critical to keeping your systems and data secure. Quick action and the right tools make all the difference. For a closer look at these CVEs and smart strategies for managing them, see how Strobes VI platform