Cybersecurity News in Asia

RECENT STORIES:

SEGA moves faster with flow-based network monitoring
Cohesity Launches New Partner Program to Accelerate Partner Success
Experts weight in on Singapore’s response to UNC3886
Urgent mitigation urged for on-premises users of an endpoint security ...
VIVOTEK’s VORTEX Cloud Solution Enhances Efficiency and Security...
Do corporations know the various AI risks that come with insufficient ...
LOGIN REGISTER
CybersecAsia
  • Features
    • Featured

      Experts weight in on Singapore’s response to UNC3886

      Experts weight in on Singapore’s response to UNC3886

      Friday, August 8, 2025, 10:45 PM Asia/Singapore | Features, Newsletter, Opinions
    • Featured

      When legitimate URLs lead to dangerous destinations

      When legitimate URLs lead to dangerous destinations

      Wednesday, August 6, 2025, 11:04 AM Asia/Singapore | Features
    • Featured

      Securing trust in a digitally ambitious Singapore

      Securing trust in a digitally ambitious Singapore

      Tuesday, August 5, 2025, 10:19 AM Asia/Singapore | Features, Newsletter, Tips
  • Opinions
  • Tips
  • Whitepapers
  • Awards 2025
  • Directory
  • E-Learning

Select Page

LOGIN REGISTER
  • Features
    • Featured

      Experts weight in on Singapore’s response to UNC3886

      Experts weight in on Singapore’s response to UNC3886

      Friday, August 8, 2025, 10:45 PM Asia/Singapore | Features, Newsletter, Opinions
    • Featured

      When legitimate URLs lead to dangerous destinations

      When legitimate URLs lead to dangerous destinations

      Wednesday, August 6, 2025, 11:04 AM Asia/Singapore | Features
    • Featured

      Securing trust in a digitally ambitious Singapore

      Securing trust in a digitally ambitious Singapore

      Tuesday, August 5, 2025, 10:19 AM Asia/Singapore | Features, Newsletter, Tips
  • Opinions
  • Tips
  • Whitepapers
  • Awards 2025
  • Directory
  • E-Learning
News

CISA issues warning on a CVSS 9.8 vulnerability, but no active exploits found

By CybersecAsia editors | Wednesday, August 21, 2024, 4:19 PM Asia/Singapore

CISA issues warning on a CVSS 9.8 vulnerability, but no active exploits found

Is this the start of a new trend in cyber warfare where Zero Day hackers can cover their tracks perfectly?

The US Cybersecurity and Infrastructure Security Agency (CISA) on 16 Aug (US time) issued a warning about a newly discovered critical vulnerability in the Web Help Desk of SolarWinds (affecting versions 12.4 through 12.8) that has been actively exploited without authentication.

The software in question is a web-based IT help desk solution that is used to centralize and automate ticketing management, curate a centralized knowledge base, and track and manage IT assets, among other functions. The vulnerability, identified as CVE-2024-28986 with a CVSS score of 9.8, involves a Java deserialization remote code execution flaw that could let attackers execute commands on the host system.

Two days earlier, the firm had actually released a hotfix to address this issue, specifying that exploitation of the vulnerability could only succeed if the hacker passed authentication. At that time, no instances of any active exploitation of the vulnerability had been found “under extensive testing”.

SolarWinds subsequently updated its advisory to indicate that the released hotfix should not be used if SAML Single Sign-On is utilized. Otherwise, the patch should, “out of an abundance of caution”, be applied as recommended, to Web Help Desk version 12.8.3.1813, and that users of earlier versions should upgrade promptly. Two satellite communications firms mentioned in the advisory (or their customers) as assisting in the preparation of the hotfix, have been speculated by security researchers to have been somehow affected. This speculation has yet to be verified.

CISA had included CVE-2024-28986 in its Known Exploited Vulnerabilities (KEV) catalog, suggesting that the vulnerability may have been exploited as a Zero Day vulnerability, with no specific details on the methodology or indicators of compromise. In line with Binding Operational Directive (BOD) 22-01, federal agencies in the USA are required to identify and patch affected SolarWinds Web Help Desk systems by 5 September.

Although this directive is specific to federal agencies, the CISA has recommended all organizations to review SolarWinds’ advisory and implement necessary fixes as soon as possible.

Share:

PreviousUnusual new phishing attack trend discovered
NextSquareX Exposes Failures of Secure Web Gateways at DEF CON 32, Releases Framework for Enterprise Testing

Related Posts

Ransomware groups are spawning into multiple smaller actors to evade identification

Ransomware groups are spawning into multiple smaller actors to evade identification

Wednesday, October 12, 2022

Hybrid cloud infrastructure: when low network visibility increases cybersecurity risks

Hybrid cloud infrastructure: when low network visibility increases cybersecurity risks

Monday, October 21, 2024

New vishing techniques surfacing in South Korea

New vishing techniques surfacing in South Korea

Friday, March 17, 2023

The 2020 global surge in cloud adoption missed out a vital ingredient: study

The 2020 global surge in cloud adoption missed out a vital ingredient: study

Thursday, April 8, 2021

Leave a reply Cancel reply

You must be logged in to post a comment.

Voters-draw/RCA-Sponsors

Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
previous arrow
next arrow

CybersecAsia Voting Placement

Gamification listing or Participate Now

PARTICIPATE NOW

Vote Now -Placement(Google Ads)

Top-Sidebar-banner

Whitepapers

  • 2024 Insider Threat Report: Trends, Challenges, and Solutions

    2024 Insider Threat Report: Trends, Challenges, and Solutions

    Insider threats continue to be a major cybersecurity risk in 2024. Explore more insights on …Download Whitepaper
  • AI-Powered Cyber Ops: Redefining Cloud Security for 2025

    AI-Powered Cyber Ops: Redefining Cloud Security for 2025

    The future of cybersecurity is a perfect storm: AI-driven attacks, cloud expansion, and the convergence …Download Whitepaper
  • Data Management in the Age of Cloud and AI

    Data Management in the Age of Cloud and AI

    In today’s Asia Pacific business environment, organizations are leaning on hybrid multi-cloud infrastructures and advanced …Download Whitepaper
  • Mitigating Ransomware Risks with GRC Automation

    Mitigating Ransomware Risks with GRC Automation

    In today’s landscape, ransomware attacks pose significant threats to organizations of all sizes, with increasing …Download Whitepaper

Middle-sidebar-banner

Case Studies

  • PT Kereta Api Indonesia announces nationwide email and communication overhaul

    PT Kereta Api Indonesia announces nationwide email and communication overhaul

    The state railway operator’s upgraded email system improves privacy, operational reliability, and regulatory alignment for …Read more
  • Operationalizing sustainability in cybersecurity: Group-IB’s approach

    Operationalizing sustainability in cybersecurity: Group-IB’s approach

    See how the firm turned malware-group takedowns into measurements of sustainability and resilience gains: by …Read more
  • Thai government expands secure email management to close cybersecurity gaps

    Thai government expands secure email management to close cybersecurity gaps

    New measures address cybersecurity gaps in public sector communications, deploying advanced protections and operational support …Read more
  • How Iress optimized global DevSecOps

    How Iress optimized global DevSecOps

    Scaling compliance, security & efficiency – while seamlessly migrating to the cloud – with JFrog.Read more

Bottom sidebar

  • Our Brands
  • DigiconAsia
  • MartechAsia
  • Home
  • About Us
  • Contact Us
  • Sitemap
  • Privacy & Cookies
  • Terms of Use
  • Advertising & Reprint Policy
  • Media Kit
  • Subscribe
  • Manage Subscriptions
  • Newsletter

Copyright © 2025 CybersecAsia All Rights Reserved.