Weekly Exploit Roundup

Generated 2025-10-24T15:43:05.589279+00:00 (UTC)

1. TP-Link Patches Four Omada Gateway Flaws, Two Allow Remote Code Execution
   Source: The Hacker News | Published: 2025-10-22T04:38:00+00:00 | Score: 21.842
   TP-Link has released security updates to address four security flaws impacting Omada gateway devices, including two critical bugs that could result in arbitrary code execution.
   The vulnerabilities in question are listed below –

   CVE-2025-6541 (CVSS score: 8.6) – An operating system command injection vulnerability that could be exploited by an attacker who can log in to the web management

2. Critical Lanscope Endpoint Manager Bug Exploited in Ongoing Cyberattacks, CISA Confirms
   Source: The Hacker News | Published: 2025-10-23T05:37:00+00:00 | Score: 20.585
   The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a critical security flaw impacting Motex Lanscope Endpoint Manager to its Known Exploited Vulnerabilities (KEV) catalog, stating it has been actively exploited in the wild.
   The vulnerability, CVE-2025-61932 (CVSS v4 score: 9.3), impacts on-premises versions of Lanscope Endpoint Manager, specifically Client
3. Over 250 Magento Stores Hit Overnight as Hackers Exploit New Adobe Commerce Flaw
   Source: The Hacker News | Published: 2025-10-23T05:47:00+00:00 | Score: 19.59
   E-commerce security company Sansec has warned that threat actors have begun to exploit a recently disclosed security vulnerability in Adobe Commerce and Magento Open Source platforms, with more than 250 attack attempts recorded against multiple stores over the past 24 hours.
   The vulnerability in question is CVE-2025-54236 (CVSS score: 9.1), a critical improper input validation flaw that could be
4. Critical Windows Server WSUS Vulnerability Exploited in the Wild
   Source: SecurityWeek | Published: 2025-10-24T14:42:19+00:00 | Score: 16.97
   CVE-2025-59287 allows a remote, unauthenticated attacker to execute arbitrary code and a PoC exploit is available. The post Critical Windows Server WSUS Vulnerability Exploited in the Wild appeared first on SecurityWeek .
5. CISA Adds One Known Exploited Vulnerability to Catalog
   Source: Alerts | Published: 2025-10-22T12:00:00+00:00 | Score: 16.461
   CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2025-61932 Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information. Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberat
6. Help Wanted: Vietnamese Actors Using Fake Job Posting Campaigns to Deliver Malware and Steal Credentials
   Source: Threat Intelligence | Published: 2025-10-23T14:00:00+00:00 | Score: 15.535
   Google Threat Intelligence Group (GTIG) is tracking a cluster of financially motivated threat actors operating from Vietnam that leverages fake job postings on legitimate platforms to target individuals in the digital advertising and marketing sectors. The actor effectively uses social engineering to deliver malware and phishing kits, ultimately aiming to compromise high-value corporate accounts, in order to hijack digital advertising accounts. GTIG tracks parts of this activity as UNC6229. The activity targets remote digital advertising workers who have contract or part-time positions and may actively look for work while they currently have a job. The attack starts when a target downloads and executes malware or enters credentials into a phishing site. If the target falls victim while logged into a work computer with a personal account, or while using a personal device with access to company ads accounts, threat actors can gain access to those company accounts. Successful compromise o
7. Five New Exploited Bugs Land in CISA's Catalog — Oracle and Microsoft Among Targets
   Source: The Hacker News | Published: 2025-10-20T19:00:00+00:00 | Score: 14.641
   The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added five security flaws to its Known Exploited Vulnerabilities (KEV) Catalog, officially confirming a recently disclosed vulnerability impacting Oracle E-Business Suite (EBS) has been weaponized in real-world attacks.
   The security defect in question is CVE-2025-61884 (CVSS score: 7.5), which has been described as a
8. TARmageddon Flaw in Async-Tar Rust Library Could Enable Remote Code Execution
   Source: The Hacker News | Published: 2025-10-22T07:05:00+00:00 | Score: 14.414
   Cybersecurity researchers have disclosed details of a high-severity flaw impacting the popular async-tar Rust library and its forks, including tokio-tar, that could result in remote code execution under certain conditions.
   The vulnerability, tracked as CVE-2025-62518 (CVSS score: 8.1), has been codenamed TARmageddon by Edera, which discovered the issue in late August 2025. It impacts several
9. CISA Adds Five Known Exploited Vulnerabilities to Catalog
   Source: Alerts | Published: 2025-10-20T12:00:00+00:00 | Score: 13.832
   CISA has added five new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2022-48503 Apple Multiple Products Unspecified Vulnerability CVE-2025-2746 Kentico Xperience Staging Sync Server Digest Password Authentication Bypass Vulnerability CVE-2025-2747 Kentico Xperience Staging Sync Server None Password Type Authentication Bypass Vulnerability CVE-2025-33073 Microsoft Windows SMB Client Improper Access Control Vulnerability CVE-2025-61884 Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requir
10. Windows Server emergency patches fix WSUS bug with PoC exploit
    Source: BleepingComputer | Published: 2025-10-24T07:27:56+00:00 | Score: 12.954
    Microsoft has released out-of-band (OOB) security updates to patch a critical-severity Windows Server Update Service (WSUS) vulnerability with publicly available proof-of-concept exploit code. […]

End of report.