Cybersecurity News in Asia

RECENT STORIES:

SEGA moves faster with flow-based network monitoring
Will robocall fraud start to decline in 2026 with stronger regulations...
Zero-click vulnerability in the Apple ecosystem still a lingering conc...
‘Want to avoid Swiss Cheese cybersecurity? Heed Hammurabi’s Code!
EnGenius Networks Japan Wins Judges’ Special Award at Interop To...
Reolink Celebrates 16 Years with 10s Pre-Recording Altas Battery Camer...
LOGIN REGISTER
CybersecAsia
  • Features
    • Featured

      Will your organization’s defenses be breached due to your suppliers’ weak cybersecurity?

      Will your organization’s defenses be breached due to your suppliers’ weak cybersecurity?

      Thursday, May 29, 2025, 5:04 PM Asia/Singapore | Features
    • Featured

      How the UAE proactively protects its digital economy

      How the UAE proactively protects its digital economy

      Monday, May 19, 2025, 2:16 PM Asia/Singapore | Features
    • Featured

      Navigating blockchain adoption amid rising security challenges

      Navigating blockchain adoption amid rising security challenges

      Wednesday, May 14, 2025, 12:32 PM Asia/Singapore | Features
  • Opinions
  • Tips
  • Whitepapers
  • Awards 2025
  • Directory
  • E-Learning

Select Page

LOGIN REGISTER
  • Features
    • Featured

      Will your organization’s defenses be breached due to your suppliers’ weak cybersecurity?

      Will your organization’s defenses be breached due to your suppliers’ weak cybersecurity?

      Thursday, May 29, 2025, 5:04 PM Asia/Singapore | Features
    • Featured

      How the UAE proactively protects its digital economy

      How the UAE proactively protects its digital economy

      Monday, May 19, 2025, 2:16 PM Asia/Singapore | Features
    • Featured

      Navigating blockchain adoption amid rising security challenges

      Navigating blockchain adoption amid rising security challenges

      Wednesday, May 14, 2025, 12:32 PM Asia/Singapore | Features
  • Opinions
  • Tips
  • Whitepapers
  • Awards 2025
  • Directory
  • E-Learning
News

CISA issues warning on a CVSS 9.8 vulnerability, but no active exploits found

By CybersecAsia editors | Wednesday, August 21, 2024, 4:19 PM Asia/Singapore

CISA issues warning on a CVSS 9.8 vulnerability, but no active exploits found

Is this the start of a new trend in cyber warfare where Zero Day hackers can cover their tracks perfectly?

The US Cybersecurity and Infrastructure Security Agency (CISA) on 16 Aug (US time) issued a warning about a newly discovered critical vulnerability in the Web Help Desk of SolarWinds (affecting versions 12.4 through 12.8) that has been actively exploited without authentication.

The software in question is a web-based IT help desk solution that is used to centralize and automate ticketing management, curate a centralized knowledge base, and track and manage IT assets, among other functions. The vulnerability, identified as CVE-2024-28986 with a CVSS score of 9.8, involves a Java deserialization remote code execution flaw that could let attackers execute commands on the host system.

Two days earlier, the firm had actually released a hotfix to address this issue, specifying that exploitation of the vulnerability could only succeed if the hacker passed authentication. At that time, no instances of any active exploitation of the vulnerability had been found “under extensive testing”.

SolarWinds subsequently updated its advisory to indicate that the released hotfix should not be used if SAML Single Sign-On is utilized. Otherwise, the patch should, “out of an abundance of caution”, be applied as recommended, to Web Help Desk version 12.8.3.1813, and that users of earlier versions should upgrade promptly. Two satellite communications firms mentioned in the advisory (or their customers) as assisting in the preparation of the hotfix, have been speculated by security researchers to have been somehow affected. This speculation has yet to be verified.

CISA had included CVE-2024-28986 in its Known Exploited Vulnerabilities (KEV) catalog, suggesting that the vulnerability may have been exploited as a Zero Day vulnerability, with no specific details on the methodology or indicators of compromise. In line with Binding Operational Directive (BOD) 22-01, federal agencies in the USA are required to identify and patch affected SolarWinds Web Help Desk systems by 5 September.

Although this directive is specific to federal agencies, the CISA has recommended all organizations to review SolarWinds’ advisory and implement necessary fixes as soon as possible.

Share:

PreviousUnusual new phishing attack trend discovered
NextSquareX Exposes Failures of Secure Web Gateways at DEF CON 32, Releases Framework for Enterprise Testing

Related Posts

Is the gap between personal- and workplace cyber hygiene narrowing?

Is the gap between personal- and workplace cyber hygiene narrowing?

Monday, September 30, 2024

Attention eTailers: ‘Tis the season to be wary

Attention eTailers: ‘Tis the season to be wary

Monday, December 16, 2019

Using tech to build business trust in the payments revolution

Using tech to build business trust in the payments revolution

Thursday, June 4, 2020

Cybercriminals spoof AI services to steal credentials, spread RATs

Cybercriminals spoof AI services to steal credentials, spread RATs

Friday, May 23, 2025

Leave a reply Cancel reply

You must be logged in to post a comment.

Voters-draw/RCA-Sponsors

Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
previous arrow
next arrow

CybersecAsia Voting Placement

Gamification listing or Participate Now

PARTICIPATE NOW

Vote Now -Placement(Google Ads)

Top-Sidebar-banner

Whitepapers

  • 2024 Insider Threat Report: Trends, Challenges, and Solutions

    2024 Insider Threat Report: Trends, Challenges, and Solutions

    Insider threats continue to be a major cybersecurity risk in 2024. Explore more insights on …Download Whitepaper
  • AI-Powered Cyber Ops: Redefining Cloud Security for 2025

    AI-Powered Cyber Ops: Redefining Cloud Security for 2025

    The future of cybersecurity is a perfect storm: AI-driven attacks, cloud expansion, and the convergence …Download Whitepaper
  • Data Management in the Age of Cloud and AI

    Data Management in the Age of Cloud and AI

    In today’s Asia Pacific business environment, organizations are leaning on hybrid multi-cloud infrastructures and advanced …Download Whitepaper
  • Mitigating Ransomware Risks with GRC Automation

    Mitigating Ransomware Risks with GRC Automation

    In today’s landscape, ransomware attacks pose significant threats to organizations of all sizes, with increasing …Download Whitepaper

Middle-sidebar-banner

Case Studies

  • St Luke’s ElderCare enhances operations and capabilities through a centralized secure, scalable network

    St Luke’s ElderCare enhances operations and capabilities through a centralized secure, scalable network

    With only a small IT team, the digital transformation has united operations across 30 locations, …Read more
  • Automating border control and security with facial recognition technology

    Automating border control and security with facial recognition technology

    Indonesia Immigration & Seaport Authorities enhances security and speeds up border control queues at Batam …Read more
  • Securing wealth advisory services without unnecessary friction: Endowus

    Securing wealth advisory services without unnecessary friction: Endowus

    The wealth advisory platform demonstrates its non-negotiable commitment to a robust security posture through partnering …Read more
  • LifeTech group sets up next-gen security operations center in Malaysia

    LifeTech group sets up next-gen security operations center in Malaysia

    By partnering with a unified cybersecurity platform, the firm will be offering cost-effective advanced SOC …Read more

Bottom sidebar

  • Our Brands
  • DigiconAsia
  • MartechAsia
  • Home
  • About Us
  • Contact Us
  • Sitemap
  • Privacy & Cookies
  • Terms of Use
  • Advertising & Reprint Policy
  • Media Kit
  • Subscribe
  • Manage Subscriptions
  • Newsletter

Copyright © 2025 CybersecAsia All Rights Reserved.