Based on evidence of active exploitation, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a set of eight vulnerabilities to the Known Exploited Vulnerabilities (KEV) list.
This contains two vulnerabilities for D-Link products and six flaws affecting Samsung cellphones. By 2021, every issue has been fixed.
- CVE-2021-25394 (CVSS score: 6.4) – Samsung mobile devices race condition vulnerability
- CVE-2021-25395 (CVSS score: 6.4) – Samsung mobile devices race condition vulnerability
- CVE-2021-25371 (CVSS score: 6.7) – An unspecified vulnerability in the DSP driver used in Samsung mobile devices that allows loading of arbitrary ELF libraries
- CVE-2021-25372 (CVSS score: 6.7) – Samsung mobile devices improper boundary check within the DSP driver in Samsung mobile devices
- CVE-2021-25487 (CVSS score: 7.8) – Samsung mobile devices out-of-bounds read vulnerability leading to arbitrary code execution
- CVE-2021-25489 (CVSS score: 5.5) – Samsung Mobile devices improper input validation vulnerability resulting in kernel panic
- CVE-2019-17621 (CVSS score: 9.8) – An unauthenticated remote code execution vulnerability in D-Link DIR-859 Router
- CVE-2019-20500 (CVSS score: 7.8) – An authenticated OS command injection vulnerability in D-Link DWL-2600AP
The two D-Link vulnerabilities were included in response to a Palo Alto Networks Unit 42 report published last month concerning threat actors linked to a Mirai botnet version that used vulnerabilities in a number of IoT devices to spread the malware in a series of assaults starting in March 2023.
It’s not immediately obvious, though, how Samsung device faults are being used in the field. But given the nature of the targeting, it’s conceivable that a commercial spyware vendor may have used them in extremely focused operations.
It’s important to remember that in November 2022, Google Project Zero released a collection of defects that it claimed were weaponized as part of an attack chain targeted at Samsung mobile devices.
Federal Civilian Executive Branch (FCEB) organizations must implement the necessary patches by July 20, 2023 in order to safeguard their networks against possible risks in light of active exploitation.