Cybersecurity News in Asia

RECENT STORIES:

SEGA moves faster with flow-based network monitoring
AI model o3 defies shutdown commands autonomously, with code tampering
ATxEnterprise 2025 Boosts Global Participation, Reinforces Singapore&#...
Will your organization’s defenses be breached due to your suppliers’ w...
Ransonware attack cripples computational software at the worst possibl...
CDNetworks’ State of WAAP Report Reveals 887.4 Billion Web App a...
LOGIN REGISTER
CybersecAsia
  • Conference 2025
  • Features
    • Featured

      Will your organization’s defenses be breached due to your suppliers’ weak cybersecurity?

      Will your organization’s defenses be breached due to your suppliers’ weak cybersecurity?

      Thursday, May 29, 2025, 5:04 PM Asia/Singapore | Features, Newsletter
    • Featured

      How the UAE proactively protects its digital economy

      How the UAE proactively protects its digital economy

      Monday, May 19, 2025, 2:16 PM Asia/Singapore | Features
    • Featured

      Navigating blockchain adoption amid rising security challenges

      Navigating blockchain adoption amid rising security challenges

      Wednesday, May 14, 2025, 12:32 PM Asia/Singapore | Features
  • Opinions
  • Tips
  • Whitepapers
  • Awards 2024
  • Directory
  • E-Learning

Select Page

LOGIN REGISTER
  • Conference 2025
  • Features
    • Featured

      Will your organization’s defenses be breached due to your suppliers’ weak cybersecurity?

      Will your organization’s defenses be breached due to your suppliers’ weak cybersecurity?

      Thursday, May 29, 2025, 5:04 PM Asia/Singapore | Features, Newsletter
    • Featured

      How the UAE proactively protects its digital economy

      How the UAE proactively protects its digital economy

      Monday, May 19, 2025, 2:16 PM Asia/Singapore | Features
    • Featured

      Navigating blockchain adoption amid rising security challenges

      Navigating blockchain adoption amid rising security challenges

      Wednesday, May 14, 2025, 12:32 PM Asia/Singapore | Features
  • Opinions
  • Tips
  • Whitepapers
  • Awards 2024
  • Directory
  • E-Learning
News

CISA issues warning on a CVSS 9.8 vulnerability, but no active exploits found

By CybersecAsia editors | Wednesday, August 21, 2024, 4:19 PM Asia/Singapore

CISA issues warning on a CVSS 9.8 vulnerability, but no active exploits found

Is this the start of a new trend in cyber warfare where Zero Day hackers can cover their tracks perfectly?

The US Cybersecurity and Infrastructure Security Agency (CISA) on 16 Aug (US time) issued a warning about a newly discovered critical vulnerability in the Web Help Desk of SolarWinds (affecting versions 12.4 through 12.8) that has been actively exploited without authentication.

The software in question is a web-based IT help desk solution that is used to centralize and automate ticketing management, curate a centralized knowledge base, and track and manage IT assets, among other functions. The vulnerability, identified as CVE-2024-28986 with a CVSS score of 9.8, involves a Java deserialization remote code execution flaw that could let attackers execute commands on the host system.

Two days earlier, the firm had actually released a hotfix to address this issue, specifying that exploitation of the vulnerability could only succeed if the hacker passed authentication. At that time, no instances of any active exploitation of the vulnerability had been found “under extensive testing”.

SolarWinds subsequently updated its advisory to indicate that the released hotfix should not be used if SAML Single Sign-On is utilized. Otherwise, the patch should, “out of an abundance of caution”, be applied as recommended, to Web Help Desk version 12.8.3.1813, and that users of earlier versions should upgrade promptly. Two satellite communications firms mentioned in the advisory (or their customers) as assisting in the preparation of the hotfix, have been speculated by security researchers to have been somehow affected. This speculation has yet to be verified.

CISA had included CVE-2024-28986 in its Known Exploited Vulnerabilities (KEV) catalog, suggesting that the vulnerability may have been exploited as a Zero Day vulnerability, with no specific details on the methodology or indicators of compromise. In line with Binding Operational Directive (BOD) 22-01, federal agencies in the USA are required to identify and patch affected SolarWinds Web Help Desk systems by 5 September.

Although this directive is specific to federal agencies, the CISA has recommended all organizations to review SolarWinds’ advisory and implement necessary fixes as soon as possible.

Share:

PreviousUnusual new phishing attack trend discovered
NextSquareX Exposes Failures of Secure Web Gateways at DEF CON 32, Releases Framework for Enterprise Testing

Related Posts

Patch your CRI-O version immediately if it is 1.19+

Patch your CRI-O version immediately if it is 1.19+

Thursday, March 17, 2022

5 tips for an effective AppSec testing strategy

5 tips for an effective AppSec testing strategy

Friday, March 27, 2020

Cafs: a guiding light for securing Australia’s charity sector

Cafs: a guiding light for securing Australia’s charity sector

Monday, December 4, 2023

Apple iOS developers, what have you done?

Apple iOS developers, what have you done?

Monday, January 10, 2022

Leave a reply Cancel reply

You must be logged in to post a comment.

Voters-draw/RCA-Sponsors

Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
previous arrow
next arrow

CybersecAsia Voting Placement

Gamification listing or Participate Now

PARTICIPATE NOW

Vote Now -Placement(Google Ads)

Top-Sidebar-banner

Whitepapers

  • 2024 Insider Threat Report: Trends, Challenges, and Solutions

    2024 Insider Threat Report: Trends, Challenges, and Solutions

    Insider threats continue to be a major cybersecurity risk in 2024. Explore more insights on …Download Whitepaper
  • AI-Powered Cyber Ops: Redefining Cloud Security for 2025

    AI-Powered Cyber Ops: Redefining Cloud Security for 2025

    The future of cybersecurity is a perfect storm: AI-driven attacks, cloud expansion, and the convergence …Download Whitepaper
  • Data Management in the Age of Cloud and AI

    Data Management in the Age of Cloud and AI

    In today’s Asia Pacific business environment, organizations are leaning on hybrid multi-cloud infrastructures and advanced …Download Whitepaper
  • Mitigating Ransomware Risks with GRC Automation

    Mitigating Ransomware Risks with GRC Automation

    In today’s landscape, ransomware attacks pose significant threats to organizations of all sizes, with increasing …Download Whitepaper

Middle-sidebar-banner

Case Studies

  • St Luke’s ElderCare enhances operations and capabilities through a centralized secure, scalable network

    St Luke’s ElderCare enhances operations and capabilities through a centralized secure, scalable network

    With only a small IT team, the digital transformation has united operations across 30 locations, …Read more
  • Automating border control and security with facial recognition technology

    Automating border control and security with facial recognition technology

    Indonesia Immigration & Seaport Authorities enhances security and speeds up border control queues at Batam …Read more
  • Securing wealth advisory services without unnecessary friction: Endowus

    Securing wealth advisory services without unnecessary friction: Endowus

    The wealth advisory platform demonstrates its non-negotiable commitment to a robust security posture through partnering …Read more
  • LifeTech group sets up next-gen security operations center in Malaysia

    LifeTech group sets up next-gen security operations center in Malaysia

    By partnering with a unified cybersecurity platform, the firm will be offering cost-effective advanced SOC …Read more

Bottom sidebar

  • Our Brands
  • DigiconAsia
  • MartechAsia
  • Home
  • About Us
  • Contact Us
  • Sitemap
  • Privacy & Cookies
  • Terms of Use
  • Advertising & Reprint Policy
  • Media Kit
  • Subscribe
  • Manage Subscriptions
  • Newsletter

Copyright © 2025 CybersecAsia All Rights Reserved.