Security News > 2024 > August > APT group exploits WPS Office for Windows RCE vulnerability (CVE-2024-7262)
2024-08-28 09:00
ESET researchers discovered a remote code execution vulnerability in WPS Office for Windows (CVE-2024-7262). APT-C-60, a South Korea-aligned cyberespionage group, was exploiting it to target East Asian countries. When examining the root cause, ESET discovered another way to exploit the faulty code (CVE-2924-7263). Overview of the exploit’s control flow (Source: ESET) Following a coordinated disclosure process, both vulnerabilities are now patched. The final payload in the APT-C-60 attack is a custom backdoor with cyberespionage capabilities … More → The post APT group exploits WPS Office for Windows RCE vulnerability (CVE-2024-7262) appeared first on Help Net Security.
News URL
https://www.helpnetsecurity.com/2024/08/28/cve-2024-7262-cve-2024-7263/
Related news
- APT-C-60 Group Exploit WPS Office Flaw to Deploy SpyGlace Backdoor (source)
- New APT Group "CloudSorcerer" Targets Russian Government Entities (source)
- Critical Exim vulnerability facilitates malware delivery (CVE-2024-39929) (source)
- Void Banshee APT Exploits Microsoft MHTML Flaw to Spread Atlantida Stealer (source)
- Void Banshee APT exploited “lingering Windows relic” in zero-day attacks (source)
- Progress fixes critical RCE flaw in Telerik Report Server, upgrade ASAP! (CVE-2024-6327) (source)
- Critical Acronis Cyber Infrastructure vulnerability exploited in the wild (CVE-2023-45249) (source)
- New Windows Backdoor BITSLOTH Exploits BITS for Stealthy Communication (source)
- Critical Apache OFBiz pre-auth RCE flaw fixed, update ASAP! (CVE-2024-38856) (source)
- Microsoft Warns of Unpatched Office Vulnerability Leading to Data Exposure (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2024-08-15 | CVE-2024-7262 | Path Traversal vulnerability in Kingsoft WPS Office Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.16412 (exclusive) on Windows allows an attacker to load an arbitrary Windows library. The vulnerability was found weaponized as a single-click exploit in the form of a deceptive spreadsheet document | 7.8 |