The US Cybersecurity and Infrastructure Security Agency (CISA) has added 66 new CVEs to its catalog of known vulnerabilities actively exploited in hacker attacks and has ordered federal agencies to install fixes for them by April 15, 2022.
66 newly added vulnerabilities in hardware and software received fixes between 2005 and 2022. The most interesting of them are the vulnerabilities disclosed last month in Mitel (CVE-2022-26143) and Windows (CVE-2022-21999).
Microsoft fixed CVE-2022-21999 in the Windows print service during the February scheduled security updates. With its help, an attacker can execute arbitrary code with system privileges.
Vulnerability CVE-2022-26143 in Mitel affects devices with a vulnerable driver (TP-240), including MiVoice Business Express and MiCollab. The vulnerability allows DDoS attacks to be carried out with a record gain (4.3 billion to 1) using the internal reflection method.
Among the 66 vulnerabilities introduced by CISA, there is also a vulnerability of remote code execution in Hewlett Packard OpenView fixed in 2005, a buffer overflow vulnerability in Adobe Reader and Acrobat fixed in 2009, a vulnerability of remote code execution in phpMyAdmin fixed in the same year, and another 23 bugs dated 2010-2016.
Cybercriminals begin to use new vulnerabilities in their attacks almost immediately after the manufacturer of the vulnerable product releases a fix. For example, CVE-2022-21999 in the Windows print service, CVE-2022-26143 in Mitel and CVE-2022-26318 in WatchGuard were disclosed in February of this year and immediately began to be exploited by hackers. In this regard, it is very important to install fixes as soon as possible, especially on systems connected to the Internet.
Due to the large number of newly added vulnerabilities, CISA did not provide a regular pivot table, so system administrators will have to view new entries in the directory, which now has 570 vulnerabilities. After opening the catalog, you need to click on the column heading “Date of addition” to sort vulnerabilities by the last added ones.