Security News > 2023 > February > CISA Warns of Active Attacks Exploiting Fortra MFT, TerraMaster NAS, and Intel Driver Flaws

The U.S. Cybersecurity and Infrastructure Security Agency on Friday added three flaws to its Known Exploited Vulnerabilities catalog, citing evidence of active abuse in the wild.

Details about the flaw were disclosed by Ethiopian cyber security research firm Octagon Networks in March 2022.

The second shortcoming to be added to KEV catalog is CVE-2015-2291, an unspecified flaw in the Intel ethernet diagnostics driver for Windows that could throw an affected device into a denial-of-service state.

Lastly, CISA has also added a remote code injection discovered in Fortra's GoAnywhere MFT managed file transfer application to the KEV catalog.

While patches for the flaw were released recently, the exploitation has been linked to a cybercrime group affiliated with a ransomware operation.

Security blog Bleeping Computer reported that the Clop ransomware crew reached out to the publication and claimed to have exploited the flaw to steal data stored in the compromised servers from over 130 companies.

News URL

https://thehackernews.com/2023/02/cisa-warns-of-active-attacks-exploiting.html