Cisco Patches Critical ISE Vulnerabilities Enabling Root CmdExec and PrivEsc - Related to wrapper, pages, rdp, use, microsoft

Cisco Patches Critical ISE Vulnerabilities Enabling Root CmdExec and PrivEsc

Cisco has released updates to address two critical security flaws Identity Services Engine (ISE) that could allow remote attackers to execute arbitrary commands and elevate privileges on susceptible devices.

CVE-2025-20124 (CVSS score: [website] - An insecure Java deserialization vulnerability in an API of Cisco ISE that could permit an authenticated, remote attacker to execute arbitrary commands as the root user on an affected device.

(CVSS score: [website] - An insecure Java deserialization vulnerability in an API of Cisco ISE that could permit an authenticated, remote attacker to execute arbitrary commands as the root user on an affected device. CVE-2025-20125 (CVSS score: [website] - An authorization bypass vulnerability in an API of Cisco ISE could could permit an authenticated, remote attacker with valid read-only credentials to obtain sensitive information, change node configurations, and restart the node.

An attacker could weaponize either of the flaws by sending a crafted serialized Java object or an HTTP request to an unspecified API endpoint, leading to privilege escalation and code execution.

Cisco expressed the two vulnerabilities are not dependent on one another and that there are no workarounds to mitigate them. They have been addressed in the below versions -.

Cisco ISE software release [website] (Migrate to a fixed release).

Cisco ISE software release [website] (Fixed in [website].

Cisco ISE software release [website] (Fixed in [website].

Cisco ISE software release [website] (Fixed in [website].

Cisco ISE software release [website] (Not vulnerable).

Deloitte security researchers Dan Marin and Sebastian Radulea have been credited with discovering and reporting the vulnerabilities.

While the networking equipment major expressed it's not aware of any malicious exploitation of the flaws, customers are advised to keep their systems up-to-date for optimal protection.

British-based engineering firm IMI plc has disclosed a security breach after unknown attackers hacked into the firm's systems.

A previously undocumented threat actor known as Silent Lynx has been linked to cyber attacks targeting various entities in Kyrgyzstan and Turkmenistan......

A critical security flaw has been disclosed in the Cacti open-source network monitoring and fault management framework that could allow an authenticat......

Hackers spoof Microsoft ADFS login pages to steal credentials

A help desk phishing campaign targets an organization's Microsoft Active Directory Federation Services (ADFS) using spoofed login pages to steal credentials and bypass multi-factor authentication (MFA) protections.

The targets of this campaign, , are primarily education, healthcare, and government organizations, with the attack targeting at least 150 targets.

These attacks aim to gain access to corporate email accounts to send emails to additional victims within the organization or perform financially motivated attacks like business email compromise (BEC), where payments are diverted to the threat actors' accounts.

Spoofing Microsoft Active Directory Federation Services.

Microsoft Active Directory Federation Services (ADFS) is an authentication system that allows individuals to log in once and access multiple applications and services without having to enter their credentials repeatedly.

It is typically used in large organizations to provide single sign-on (SSO) across internal and cloud-based applications.

The attackers send emails to targets impersonating their firm's IT team, asking them to log in to improvement their security settings or accept new policies.

Sample of a phishing email used in the attacks.

The phishing page asks the victim to enter their username, password, and the MFA code or tricks them into approving the push notification.

"The phishing templates also include forms designed to capture the specific second factor required to authenticate the targets account, based on the organizations configured MFA settings," reads Abnormal Security's investigation.

"Abnormal observed templates targeting multiple commonly used MFA mechanisms, including Microsoft Authenticator, Duo Security, and SMS verification."

Two of the many available MFA bypass screens.

Once the victim provides all the details, they are redirected to the legitimate sign-in page to reduce suspicion and make it appear as if the process has been successfully completed.

Meanwhile, the attackers immediately leverage the stolen information to log into the victim's account, steal any valuable data, create new email filter rules, and attempt lateral phishing.

Abnormal says the attackers in this campaign used Private Internet Access VPN to obscure their location and assign an IP address with advanced proximity to the organization.

Even though these phishing attacks do not breach ADFS directly, and rather rely on social engineering to work, the tactic is still notable for its potential effectiveness given the inherent trust many clients have on familiar login workflows.

Abnormal indicates that organizations migrate to modern and more secure solutions like Microsoft Entra and introduce additional email filters and anomalous activity detection mechanisms to stop phishing attacks early.

Microsoft has released a PowerShell script to help Windows customers and admins enhancement bootable media so it utilizes the new.

Ransomware attacks netted cybercrime groups a total of $[website] million in 2024, a decline from $[website] billion in 2023.

The North Korean hacking group known as Kimsuky was observed in recent attacks using a custom-built RDP Wrapper and proxy tools to directly access inf......

Kimsuky hackers use new custom RDP Wrapper for remote access

The North Korean hacking group known as Kimsuky was observed in recent attacks using a custom-built RDP Wrapper and proxy tools to directly access infected machines.

This is a sign of shifting tactics for Kimsuky, (ASEC), who discovered the campaign.

ASEC says the North Korean hackers now use a diverse set of customized remote access tools instead of relying solely on noisy backdoors like PebbleDash, which is still used.

The latest infection chain starts with a spear-phishing email containing a malicious shortcut (.LNK) file attachment disguised as a PDF or Word document.

The emails contain the recipient's name and correct business names, suggesting that Kimsuky performed reconnaissance before the attack.

Opening the .LNK file triggers PowerShell or Mshta to retrieve additional payloads from an external server, including:

PebbleDash, a known Kimsuky backdoor providing initial system control.

A modified version of the open-source RDP Wrapper tool, enabling persistent RDP access and security measures bypass.

Proxy tools for bypassing private network restrictions, allowing attackers to access the system even when direct RDP connections are blocked.

RDP Wrapper is a legitimate open-source tool designed to enable Remote Desktop Protocol (RDP) functionality on Windows versions that do not natively support it, like Windows Home.

It acts as a middle layer, allowing people to enable remote desktop connections without modifying system files.

Kimsuky's version altered export functions to bypass antivirus detection and likely differentiates its behavior enough to evade signature-based detection.

The main advantage of using a custom RDP Wrapper is detection evasion, as RDP connections are often treated as legitimate, allowing Kimsuky to stay under the radar for longer.

Moreover, it provides a more comfortable GUI-based remote control, compared to shell access via malware, and can bypass firewalls or NAT restrictions via relays, allowing RDP access from outside.

once Kimsuky secures their foothold on the network, they drop secondary payloads.

These include a keylogger that captures keystrokes and stores them in text files in system directories, an infostealer (forceCopy) that extracts credentials saved on web browsers, and a PowerShell-based ReflectiveLoader that enables in-memory payload execution.

Overall, Kimsuky is a persistent and evolving threat and one of North Korea's most prolific cyber-espionage threat groups devoted to collecting intelligence.

ASEC's latest findings indicate that the threat actors switch to stealthier remote access methods for prolonged dwell times in compromised networks.

Bogus websites advertising Google Chrome have been used to distribute malicious installers for a remote access trojan called ValleyRAT.

Curious about the buzz around AI in cybersecurity? Wonder if it's just a shiny new toy in the tech world or a serious game changer? Let's unpack this ......

The North Korean threat actor known as the Lazarus Group has been observed leveraging a.