CISA unveils list of most targeted vulnerabilities in 2020

Substantial-profile vulnerabilities in Citrix, Pulse Safe and Fortinet program ended up the most well-liked targets for attackers in 2020.

In accordance to a report introduced by the U.S. Cybersecurity and Infrastructure Safety Agency (CISA), a remote code execution flaw in Citrix’s Application Supply Controller and Gateway merchandise, CVE-2019-19781, was the top target for exploits in 2020, in spite of getting absolutely patched much more than a yr back. The examine provided figures collected by CISA, the FBI, the Australian Cyber Safety Centre and the U.K. Nationwide Cyber Safety Centre.

The Citrix flaw, publicized at the switch of the 2020 yr, permits burglars to get remote code execution on susceptible servers by using a listing traversal flaw. CISA explained that according to the figures it collected, the bug was the one most prevalent target for attackers. The report explained acknowledged flaws keep on being the finest resource of open up doorways for criminals even as patches are rolled out.

A single large variable in the 2020 development appears to be remote get the job done, as cybercriminals seized on flaws that ended up exposed by the will need to accommodate staff members dialing into the organization community from property.

“Cyber actor exploitation of much more a short while ago disclosed program flaws in 2020 possibly stems, in element, from the enlargement of remote get the job done selections amid the COVID-19 pandemic,” the CISA report explained.

“The fast change and greater use of remote get the job done selections, these kinds of as digital non-public networks (VPNs) and cloud-based mostly environments, very likely put supplemental load on cyber defenders having difficulties to preserve and continue to keep rate with plan program patching,” the report noted.

Next to the Citrix bug in terms of assaults was CVE-2019-11510, a file read through vulnerability in Pulse Safe merchandise, adopted by CVE-2018-13379, a route traversal bug in Fortinet’s FortiGate VPN, and CVE-2020-5902, a remote code execution flaw in F5 Network’s Major-IP gadgets.

All 4 vulnerabilities ended up exploited in substantial assaults and ended up provided in many protection advisories from distributors and federal government businesses. For case in point, a Fortinet bug became a cash cow for criminals in 2020 as the Cring ransomware team preyed on it in order to just take servers hostage.

For at the time, Microsoft did not discover alone the key target for assaults, as it only put sixth (CVE-2017-11882, remote code execution) on the CISA listing of top targets. Microsoft normally finds alone atop these rankings due to the ubiquity of Home windows OSes and recognition with vulnerability scientists.

Field pundits never hope this development of Microsoft ranking outdoors the top a few assault targets to last, nonetheless. Jon Oltsik, principal analyst at Enterprise Strategy Team, a division of TechTarget, explained this was much more a situation of Citrix and Pulse getting in the wrong area at the wrong time, snatching up doubtful titles normally claimed in Redmond due to Microsoft’s huge company footprint.

“I would characterize this as a 1-off circumstance,” Oltsik instructed SearchSecurity. “Supplied Microsoft’s sector presence, it will make all top lists much more frequently than not and I never believe clients are accomplishing anything far better with Microsoft vulnerabilities as opposed to other folks.”

CISA noted that Microsoft flaws are very likely to go on to be the preferred targets of attackers, many thanks to the sloppy patching routines of businesses that neglect to tackle many years-previous vulnerabilities.

“Destructive cyber actors will most very likely go on to use older acknowledged vulnerabilities, these kinds of as CVE-2017-11882 affecting Microsoft Workplace, as long as they keep on being powerful and devices keep on being unpatched,” CISA explained.

“Adversaries’ use of acknowledged vulnerabilities complicates attribution, lessens expenses, and minimizes risk due to the fact they are not investing in developing a zero-day exploit for their special use, which they risk shedding if it results in being acknowledged,” CISA reported.

CISA’s report also shown the most specific vulnerabilities in 2021 so significantly, which include things like the Microsoft Trade zero-day vulnerabilities unveiled before this yr and a flaw in Accellion’s File Transfer Appliance, generally acknowledged as FTA.