U.S. CISA adds Draytek VigorConnect and Kingsoft WPS Office bugs to its Known Exploited Vulnerabilities catalog
Pierluigi Paganini
September 07, 2024
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Draytek VigorConnect and Kingsoft WPS Office bugs to its Known Exploited Vulnerabilities catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) Draytek VigorConnect and Kingsoft WPS Office vulnerabilities to its .
Below are the descriptions for these vulnerabilities:
- Draytek VigorConnect Path Traversal Vulnerability: A local file inclusion issue in Draytek VigorConnect 1.6.0-B3 allows unauthenticated attackers to exploit the file download functionality of the DownloadFileServlet endpoint. This flaw enables attackers to download arbitrary files from the underlying operating system with root privileges, posing a significant security risk.
- Draytek VigorConnect Path Traversal Vulnerability: A local file inclusion vulnerability in Draytek VigorConnect 1.6.0-B3 affects the WebServlet endpoint’s file download functionality. This flaw allows unauthenticated attackers to download arbitrary files from the underlying operating system with root privileges, posing a serious security threat.
- Kingsoft WPS Office Path Traversal Vulnerability: An improper path validation vulnerability in Kingsoft WPS Office (versions 12.2.0.13110 to 12.2.0.16412) allows attackers to load arbitrary Windows libraries via the promecefpluginhost.exe. This flaw has been weaponized in a single-click exploit, delivered through a deceptive spreadsheet document.
At the end of August, Eset researchers reported that South Korea-linked group APT-C-60 exploited a zero-day, tracked as CVE-2024-7262, in the Windows version of WPS Office to deploy the SpyGlace backdoor in the systems on targets in East Asia.
WPS Office is a comprehensive office productivity suite developed by Chinese software company Kingsoft and is widely used in Asia. It provides users with a range of tools for creating, editing, and managing documents, spreadsheets, presentations, and PDFs.
According to the , WPS Office has over 500 million active users worldwide.
According to , FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend private organizations review the and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix this vulnerability by September 24, 2024.
Follow me on Twitter: and and Mastodon
(SecurityAffairs – hacking, CISA)
