CISA urged to add 8 severe ransomware bugs to vulnerability catalog
February 17, 2023 – Published on SC Magazine
Researchers found that eight of the 131 vulnerabilities associated with ransomware not yet listed in a federal catalog meant to help the cybersecurity community are considered “most dangerous” because they could be easily exploited from initial access to exfiltration.
According to the report, researchers identified 57 extremely dangerous ransomware-associated vulnerabilities with complete kill chains, eight of which are excluded in the KEV. These eight bugs are found in over 30 products, including products by Microsoft, Oracle, Zyxel, and QNAP.
Tony Cook, senior director of DFIR and Threat Intel at GuidePoint Security, highlighted that organizations should have a more transparent vulnerability disclosure process to help secure the large ecosystem.
“One of the biggest issues now is that companies do not want to disclose security incidents or vulnerability information to CISA for fear of legal obligation. It would be much easier for CISA to have a comprehensive database if organizations could openly report things happening around,” Cook said.
Read More HERE.