Remote-access VPN systems allow off-site users to tunnel into protected networks, making these entry points vulnerable to exploitation by threat actors. From the Trinidad and Tobago perspective, the exploitation of outdated remote-access VPN systems is one of the most successful attack vectors executed against local organizations. This email serves as a critical reminder about the …
A command injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. The severity of the vulnerability is critical and it carries a CVSS4.0 score of 10. Fixes for PAN-OS …
Microsoft has released security updates to address vulnerabilities in multiple products; the most severe of which could allow for remote code execution. Additionally, two (2) zero day vulnerabilities related to Microsoft products have been identified that are CVE-2024-21351 – Windows SmartScreen Security Feature Bypass Vulnerability and CVE-2024-21412 – Internet Shortcut Files Security Feature Bypass Vulnerability.Affected …
Fortinet has released security updates to address two (2) critical vulnerabilities in FortiOS. TT-CSIRT encourages administrators to review the following releases and take the necessary actions immediately: CVE-2024-21762 – https://www.fortiguard.com/psirt/FG-IR-24-015 CVE-2024-23113 – https://www.fortiguard.com/psirt/FG-IR-24-029 Fortinet has noted that CVE-2024-21762 is potentially being exploited in the wild. If you have any queries, comments or require assistance, please …
Severity: Critical Overview: SonicWall Firewalls CVE-2022-22274 and CVE-2023-0656 have CVSS score of 9.4 and 7.5 respectively. A proof-of-concept has been published therefore the vulnerabilities are more susceptible to exploitation. Affected Systems: Various SonicWall devices, including TZ series, NSa models, NSsp series, and NSv models, are susceptible to the mentioned vulnerabilities. Description: Over 178,000 SonicWall firewalls …
It is with great sadness that we announce the passing of Mr. Angus Smith, a remarkable individual and the dedicated leader of the Trinidad and Tobago Cyber Security Incident Response Team (TT-CSIRT). Angus was not just a colleague but a beacon of strength, compassion, and expertise in the cybersecurity community. Angus exemplified unwavering commitment, …
Severity: Medium Overview: Terrapin (CVE-2023-48795, CVSS score: 5.9) allows remote attackers to bypass integrity checks such that some packets are omitted causing security features to be downgraded or disabled within a client and server connection (a Terrapin Attack). This allows attackers to exploit the SSH protocol, potentially gaining unauthorized access to sensitive information or compromising network …
The Trinidad and Tobago Cyber Security Incident Response Team (TT-CSIRT) of the Ministry of National Security hosted a webinar on Web Application Security during cyber security awareness month providing an insightful webinar on Application Security Strategies, the OWASP Top 10, Application Security Verification and Application Testing guidance. TLP:CLEAR
Cisco has released a security advisory concerning a critical Privilege Escalation Vulnerability in their IOS XE software. Cisco has identified active exploitation of a previously unknown vulnerability in the Web User Interface (Web UI) feature of Cisco IOS XE software (CVE-2023-20198) when exposed to the internet or untrusted networks. This affects both physical and virtual …
The Trinidad and Tobago Cyber Security Incident Response Team (TT-CSIRT) of the Ministry of National Security will be hosting a webinar entitled “Trinidad and Tobago Cyber Threat Landscape Update 2023” during cyber security awareness month. TT-CSIRT will provide updates on cyber threats impacting local organizations from the national perspective. The capabilities and capacity of the …