Week 4, 2018
22–28 January 2018
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 4.8%
- Critical 9.8 EPSS 3.6%
-
Critical 9.8
CVE-2018-4834 A vulnerability has been identified in Desigo PXC00-E.D V4.10 (All versions < V4.10.111), Desigo PXC00-E.D V5.00 (All versions < V5.0.171), Desigo PXC00-E.D V5…EPSS 3.3%
Siemens · Desigo PXC00/64/128-U V4.10 · Desigo PXC200-E.D V4.10 · Desigo PXC50-E.D V4.10
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- High 8.8 EPSS 89%
-
Unscored
CVE-2018-5999 An issue was discovered in AsusWRT before 3.0.0.4.384_10007. In the handle_request function in router/httpd/httpd.c, processing of POST requests continues even…EPSS 88%
-
Unscored
CVE-2018-6000 An issue was discovered in AsusWRT before 3.0.0.4.384_10007. The do_vpnupload_post function in router/httpd/web.c in vpnupload.cgi provides functionality for s…EPSS 85%
-
Unscored
CVE-2017-2741 A potential security vulnerability has been identified with HP PageWide Printers, HP OfficeJet Pro Printers, with firmware before 1708D. This vulnerability cou…EPSS 82%
-
Unscored
CVE-2017-13696 A buffer overflow vulnerability lies in the web server component of Dup Scout Enterprise 9.9.14, Disk Savvy Enterprise 9.9.14, Sync Breeze Enterprise 9.9.16, a…EPSS 79%
-
Unscored
CVE-2017-18048 Monstra CMS 3.0.4 allows users to upload arbitrary files, which leads to remote command execution on the server, for example because .php (lowercase) is blocke…EPSS 62%
-
Unscored
CVE-2017-16597 This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Auth…EPSS 57%
-
Unscored
CVE-2017-16603 This vulnerability allows remote attackers to execute code by creating arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.73…EPSS 54%
Advisories
- SUSE / openSUSE Security Updates 45
- Debian Security (DSA / DLA) 141 critical
- Ubuntu Security Notices (USN) 13
- Oracle Linux Security Advisories (ELSA) 71 critical
- CISA ICS & IT advisories 42 critical
- BSI CERT-Bund (WID) 3
- Siemens ProductCERT 11 critical
- ELSA-2018-0122 Critical: firefox security update (Oracle Linux 7) 11 CVEs
- ICSA-18-025-01 Nari PCS-9611 (Update A) 1 CVEs
- SSA-824231 SSA-824231: Unauthenticated Firmware Upload Vulnerability in Desigo PX Controllers 1 CVEs
- ICSA-18-025-02B Siemens Desigo PXC (Update C) 1 CVEs
- DSA-4094-1 smarty3 - security update 1 CVEs