Cybersecurity News in Asia

RECENT STORIES:

SEGA moves faster with flow-based network monitoring
Cohesity Catalyst 1 to Bring Together Cyber Resilience Experts, Celebr...
US$125k critical Windows zero-day RCE exploit for sale: targets fully ...
MoneyMe strengthens fraud prevention and credit decisioning
Adtech firms identified as key enablers in global cybercrime and large...
Gogolook Releases the World’s First Global Anti-Scam Impact Repo...
LOGIN REGISTER
CybersecAsia
  • Features
    • Featured

      Deepfake a crisis of trust, not just technology

      Deepfake a crisis of trust, not just technology

      Tuesday, August 19, 2025, 10:06 AM Asia/Singapore | Features
    • Featured

      When talking sense into AI power mongers fails, talk $$$: A message from AI

      When talking sense into AI power mongers fails, talk $$$: A message from AI

      Thursday, August 14, 2025, 12:26 PM Asia/Singapore | Features
    • Featured

      From insight to action: Securing APAC’s future with AI-driven cybersecurity

      From insight to action: Securing APAC's future with AI-driven cybersecurity

      Wednesday, August 13, 2025, 10:07 AM Asia/Singapore | Features
  • Opinions
  • Tips
  • Whitepapers
  • Awards 2025
  • Directory
  • E-Learning

Select Page

LOGIN REGISTER
  • Features
    • Featured

      Deepfake a crisis of trust, not just technology

      Deepfake a crisis of trust, not just technology

      Tuesday, August 19, 2025, 10:06 AM Asia/Singapore | Features
    • Featured

      When talking sense into AI power mongers fails, talk $$$: A message from AI

      When talking sense into AI power mongers fails, talk $$$: A message from AI

      Thursday, August 14, 2025, 12:26 PM Asia/Singapore | Features
    • Featured

      From insight to action: Securing APAC’s future with AI-driven cybersecurity

      From insight to action: Securing APAC's future with AI-driven cybersecurity

      Wednesday, August 13, 2025, 10:07 AM Asia/Singapore | Features
  • Opinions
  • Tips
  • Whitepapers
  • Awards 2025
  • Directory
  • E-Learning
News

CISA issues warning on a CVSS 9.8 vulnerability, but no active exploits found

By CybersecAsia editors | Wednesday, August 21, 2024, 4:19 PM Asia/Singapore

CISA issues warning on a CVSS 9.8 vulnerability, but no active exploits found

Is this the start of a new trend in cyber warfare where Zero Day hackers can cover their tracks perfectly?

The US Cybersecurity and Infrastructure Security Agency (CISA) on 16 Aug (US time) issued a warning about a newly discovered critical vulnerability in the Web Help Desk of SolarWinds (affecting versions 12.4 through 12.8) that has been actively exploited without authentication.

The software in question is a web-based IT help desk solution that is used to centralize and automate ticketing management, curate a centralized knowledge base, and track and manage IT assets, among other functions. The vulnerability, identified as CVE-2024-28986 with a CVSS score of 9.8, involves a Java deserialization remote code execution flaw that could let attackers execute commands on the host system.

Two days earlier, the firm had actually released a hotfix to address this issue, specifying that exploitation of the vulnerability could only succeed if the hacker passed authentication. At that time, no instances of any active exploitation of the vulnerability had been found “under extensive testing”.

SolarWinds subsequently updated its advisory to indicate that the released hotfix should not be used if SAML Single Sign-On is utilized. Otherwise, the patch should, “out of an abundance of caution”, be applied as recommended, to Web Help Desk version 12.8.3.1813, and that users of earlier versions should upgrade promptly. Two satellite communications firms mentioned in the advisory (or their customers) as assisting in the preparation of the hotfix, have been speculated by security researchers to have been somehow affected. This speculation has yet to be verified.

CISA had included CVE-2024-28986 in its Known Exploited Vulnerabilities (KEV) catalog, suggesting that the vulnerability may have been exploited as a Zero Day vulnerability, with no specific details on the methodology or indicators of compromise. In line with Binding Operational Directive (BOD) 22-01, federal agencies in the USA are required to identify and patch affected SolarWinds Web Help Desk systems by 5 September.

Although this directive is specific to federal agencies, the CISA has recommended all organizations to review SolarWinds’ advisory and implement necessary fixes as soon as possible.

Share:

PreviousUnusual new phishing attack trend discovered
NextSquareX Exposes Failures of Secure Web Gateways at DEF CON 32, Releases Framework for Enterprise Testing

Related Posts

When cyberattackers apologize for unintended damage to critical infrastructure …

When cyberattackers apologize for unintended damage to critical infrastructure …

Tuesday, July 13, 2021

More crypto wallet risks ‘in store’ for all mobile platforms

More crypto wallet risks ‘in store’ for all mobile platforms

Tuesday, April 12, 2022

Security is about access, not control: ZTN

Security is about access, not control: ZTN

Friday, April 17, 2020

Are cybercriminals aiming for large multinationals or the smaller enterprises?

Are cybercriminals aiming for large multinationals or the smaller enterprises?

Friday, February 23, 2024

Leave a reply Cancel reply

You must be logged in to post a comment.

Voters-draw/RCA-Sponsors

Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
previous arrow
next arrow

CybersecAsia Voting Placement

Gamification listing or Participate Now

PARTICIPATE NOW

Vote Now -Placement(Google Ads)

Top-Sidebar-banner

Whitepapers

  • 2024 Insider Threat Report: Trends, Challenges, and Solutions

    2024 Insider Threat Report: Trends, Challenges, and Solutions

    Insider threats continue to be a major cybersecurity risk in 2024. Explore more insights on …Download Whitepaper
  • AI-Powered Cyber Ops: Redefining Cloud Security for 2025

    AI-Powered Cyber Ops: Redefining Cloud Security for 2025

    The future of cybersecurity is a perfect storm: AI-driven attacks, cloud expansion, and the convergence …Download Whitepaper
  • Data Management in the Age of Cloud and AI

    Data Management in the Age of Cloud and AI

    In today’s Asia Pacific business environment, organizations are leaning on hybrid multi-cloud infrastructures and advanced …Download Whitepaper
  • Mitigating Ransomware Risks with GRC Automation

    Mitigating Ransomware Risks with GRC Automation

    In today’s landscape, ransomware attacks pose significant threats to organizations of all sizes, with increasing …Download Whitepaper

Middle-sidebar-banner

Case Studies

  • MoneyMe strengthens fraud prevention and credit decisioning

    MoneyMe strengthens fraud prevention and credit decisioning

    Australian fintech strengthens risk management with SEON to scale lending operations securely and efficiently.Read more
  • PT Kereta Api Indonesia announces nationwide email and communication overhaul

    PT Kereta Api Indonesia announces nationwide email and communication overhaul

    The state railway operator’s upgraded email system improves privacy, operational reliability, and regulatory alignment for …Read more
  • Operationalizing sustainability in cybersecurity: Group-IB’s approach

    Operationalizing sustainability in cybersecurity: Group-IB’s approach

    See how the firm turned malware-group takedowns into measurements of sustainability and resilience gains: by …Read more
  • Thai government expands secure email management to close cybersecurity gaps

    Thai government expands secure email management to close cybersecurity gaps

    New measures address cybersecurity gaps in public sector communications, deploying advanced protections and operational support …Read more

Bottom sidebar

  • Our Brands
  • DigiconAsia
  • MartechAsia
  • Home
  • About Us
  • Contact Us
  • Sitemap
  • Privacy & Cookies
  • Terms of Use
  • Advertising & Reprint Policy
  • Media Kit
  • Subscribe
  • Manage Subscriptions
  • Newsletter

Copyright © 2025 CybersecAsia All Rights Reserved.