🔴 Critical: Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies
-
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added five security flaws to its Known Exploited Vulnerabilities (KEV) catalog after they were abused by a China-linked threat actor tracked as Flax Typhoon.
Among the entries is CVE-2015-3306, a critical improper access control vulnerability in ProFTPD carrying a CVSS score of 10.0. The flaw could allow attackers to compromise affected systems, and its presence in the KEV catalog confirms it has been exploited in the wild.
Federal agencies are required to remediate the listed vulnerabilities by October 11, per the binding operational directive tied to the KEV catalog.
Affected organizations should review their exposure to the following:
- ProFTPD — CVE-2015-3306 (CVSS 10.0), improper access control
Given that Flax Typhoon is actively exploiting these flaws, defenders are urged to prioritize patching and to check for signs of compromise on any internet-facing services running the affected software.
Source: The Hacker News
Has your organization reviewed its KEV catalog obligations ahead of the October 11 deadline, and are any of your internet-facing services running the affected software?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login