INTERNET STORM CENTER SPOTLIGHT
ISC provides a free analysis and warning service to thousands of Internet users and organizations, and is actively working with Internet Service Providers to fight back against the most malicious attackers. https://isc.sans.edu/about.html
Microsoft Patch Tuesday: May 2025
Published: 2025-05-13
Last Updated: 2025-05-13 17:57:17 UTC
by Johannes Ullrich (Version: 1)
Today, Microsoft released its expected update for the May patch on Tuesday. This update fixes 78 vulnerabilities. 11 are rated as critical, and 66 as important. Five of the vulnerabilities have already been exploited and two were publicly known but not yet exploited. 70 of the vulnerabilities were patched today, 8 had patches delivered earlier this month.
Notable Vulnerabilities:
CVE-2025-30397: This vulnerability is already exploited. It could lead to remote code execution if a user visits a malicious web page, but only if Edge is running in Internet Explorer mode.
https://nvd.nist.gov/vuln/detail/CVE-2025-30397
The other four already exploited vulnerabilities are all privilege escalation vulnerabilities. The two already known vulnerabilities include a remote code execution vulnerability in Visual Studio and a spoofing vulnerability in Microsoft Defender.
Most of the critical vulnerabilities affect Microsoft Office and the Remote Desktop Client.
CVE-2025-29831 could be interesting: It is only rated "important", but it is described as a remote code execution issue in Windows Remote Desktop. No authorization is required to exploit the vulnerability. Exploitation relies on a race collation which is often not reliably exploitable (but exploitable). The attack has to be triggered while the server is being restarted. This may be exploitable if a denial of service vulnerability can be used to restart the system ...
https://nvd.nist.gov/vuln/detail/CVE-2025-29831
Read the full entry:
https://isc.sans.edu/diary/Microsoft+Patch+Tuesday+May+2025/31946/
Apple Updates Everything: May 2025 Edition
Published: 2025-05-12
Last Updated: 2025-05-12 20:30:06 UTC
by Johannes Ullrich (Version: 1)
Apple released its expected update for all its operating systems. The update, in addition to providing new features, patches 65 different vulnerabilities. Many of these vulnerabilities affect multiple operating systems within the Apple ecosystem.
Of note is CVE-2025-31200. This vulnerability is already exploited in "targeted attacks". Apple released patches for this vulnerability in mid-April for its current operating Systems (iOS 18, macOS 15, tvOS 18, and visionOS 2). This update includes patches for older versions of macOS and iPadOS/iOS ...
https://nvd.nist.gov/vuln/detail/CVE-2025-31200
Read the full entry:
https://isc.sans.edu/diary/Apple+Updates+Everything+May+2025+Edition/31942/
It Is 2025, And We Are Still Dealing With Default IoT Passwords And Stupid 2013 Router Vulnerabilities
Published: 2025-05-12
Last Updated: 2025-05-12 13:49:21 UTC
by Johannes Ullrich (Version: 1)
Unipi Technologies is a company developing programmable logic controllers for a number of different applications like home automation, building management, and industrial controls. The modules produced by Unipi are likely to appeal to a more professional audience. All modules are based on the "Marvis" platform, a customized Linux distribution maintained by Unipi.
In the last couple of days, we did observe scans for the unipi default username and password ("unipi" and "unipi.technology") in our honeypot logs. The scans originate from ... an IP address that is well-known to our database.
In addition to SSH, the IP address also scans for an ancient Netgear vulnerability from 2013, which only got a CVE number last year (CVE-2024-12847).
https://nvd.nist.gov/vuln/detail/CVE-2024-12847
Both, the SSH as well as the "Netgear" exploit attempts are executing the same commands ...
Read the full entry: