Daily Cybersecurity News - December 25, 2025
MongoDB Admins Urged to Patch Severe RCE Flaw
HighExecutive Summary
MongoDB has issued a warning to IT administrators to immediately apply a patch for a high-severity vulnerability, CVE-2025-14847, that could be exploited in remote code execution (RCE) attacks targeting vulnerable servers. The vulnerability is currently unpatched.
Vulnerability Details
- Affected Product: MongoDB versions 8.2.0 through 8.2.3, 8.0.0 through 8.0.16, 7.0.0 through 7.0.26, 6.0.0 through 6.0.26, 5.0.0 through 5.0.31, 4.4.0 through 4.4.29, all v4.2 versions, all v4.0 versions, and all v3.6 versions.
- Identifier: CVE-2025-14847.
- CVSS Score: 8.7 (High).
- Exploitation Status: While mass exploitation is unconfirmed by the vendor, trivial Proof-of-Concept (PoC) exploits are publicly available and circulating.
Risk & Impact
- Triage: Immediate patching is strongly recommended due to the high severity of the vulnerability.
- Attack Vector: An unauthenticated, remote attacker can exploit the issue to execute arbitrary code on vulnerable servers. The vulnerability involves a client-side exploit of the Server's zlib implementation that can return uninitialized heap memory without authentication.
- Ease of Exploit: Proof-of-concept reproduction is trivial using the mongo shell.
Action Plan
- Immediate Action: Upgrade to fixed versions 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, and 4.4.30 immediately.
- Workaround: If an immediate upgrade is not possible, disable zlib compression on the MongoDB Server by starting mongod or mongos with a networkMessageCompressors or a net.compression.compressors option that explicitly omits zlib. Example safe values include snappy,zstd or disabled.
- Detection: Monitor for unusual network activity and inspect MongoDB server logs for suspicious entries related to zlib compression.
Relevant professional terms
- Remote Code Execution (RCE)
- A type of cyberattack where an attacker can remotely execute commands on a victim's device, potentially leading to the installation of malware or data theft.
- IT Administrator
- A skilled professional responsible for overseeing and maintaining an organization's IT assets and infrastructure, including managing network security, hardware, and software.
Source: Bleeping Computer
Fortinet Warns of Active Exploitation of FortiOS SSL VPN 2FA Bypass Vulnerability
MediumExecutive Summary
Fortinet has observed active exploitation of a five-year-old security flaw, CVE-2020-12812, in FortiOS SSL VPN, which can bypass two-factor authentication (2FA) under specific configurations. This vulnerability is under active exploitation.
Vulnerability Details
- Affected Product: FortiOS SSL VPN 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below
- Identifier: CVE-2020-12812
- CVSS Score: 5.2 (Medium)
- Exploitation Status: Actively Exploited
Risk & Impact
- Triage: High urgency. Attackers utilizing credential stuffing lists (valid passwords) can use this flaw to bypass 2FA and breach the perimeter.
- Attack Vector: The vulnerability is triggered by entering a username with a different case than the one configured, which bypasses 2FA when local users are also members of LDAP groups.
- Ease of Exploit: Easy, provided the attacker already possesses valid user credentials (password). The exploit circumvents the 2FA step.
Action Plan
- Immediate Action: Upgrade to FortiOS 6.0.10+, 6.2.4+, or 6.4.1+.
- Workaround: Disable username case sensitivity using the command "set username-case-sensitivity disable" or "set username-sensitivity disable" on newer versions. Consider removing secondary LDAP groups if not required.
- Detection: Scrutinize logs for anomalies like failed local matches followed by LDAP successes. Use FortiAnalyzer to detect exploit attempts.
Relevant professional terms
- SSL VPN
- A virtual private network (VPN) that uses Secure Sockets Layer (SSL) protocol to provide secure remote access to a network.
- LDAP
- Lightweight Directory Access Protocol, an open, vendor-neutral, industry standard application protocol for accessing and maintaining distributed directory information services.
Source: The Hacker News
CISA Flags Actively Exploited Digiever NVR Vulnerability
HighExecutive Summary
CISA has added a vulnerability, CVE-2023-52163, affecting Digiever DS-2105 Pro network video recorders (NVRs) to its Known Exploited Vulnerabilities (KEV) catalog, indicating that it is under active exploitation. The vulnerability is a command injection flaw that allows for remote code execution.
Vulnerability Details
- Affected Product: Digiever DS-2105 Pro NVRs, firmware version 3.1.0.71-11
- Identifier: CVE-2023-52163
- CVSS Score: 8.8 (High)
- Exploitation Status: Actively Exploited
Risk & Impact
- Triage: Critical, due to active exploitation and potential for remote code execution.
- Attack Vector: Remote, via crafted HTTP requests to the time_tzsetup.cgi script.
- Ease of Exploit: High, requiring only that the attacker is logged into the device to perform a crafted request.
Action Plan
- Immediate Action: Since the product is EoL, apply compensating controls such as avoiding exposing the device to the internet and changing the default username and password.
- Workaround: Implement network segmentation to isolate the NVR and restrict access.
- Detection: Monitor network traffic for suspicious HTTP requests to the time_tzsetup.cgi script.
Relevant professional terms
- Network Video Recorder (NVR)
- A specialized computer system that records video to a storage device, connecting to cameras through a network, typically in an IP video surveillance system.
- Vulnerability
- A weakness in an information system, system security procedures, internal controls, or implementation that could be exploited by a threat source.
Source: The Hacker News
LastPass Breach: Cryptocurrency Theft
Executive Summary
The 2022 LastPass data breach led to the theft of cryptocurrency assets from users with weak master passwords, with incidents reported as recently as late 2025. Russian cybercriminal actors are suspected to be involved, laundering stolen funds through high-risk Russian exchanges.
Attack Overview
- Attack Path: Exploitation of weak master passwords to decrypt stolen vault backups.
- Attacker: Russian cybercriminal actors (suspected).
Impact Assessment
- Data Stolen: Encrypted vault backups containing cryptocurrency private keys and seed phrases.
Strategic Takeaway
The breach highlights the long-term risks associated with weak passwords and the importance of proactive password rotation and vault security.
Relevant professional terms
- Brute-force
- A method of gaining access to a system by trying numerous passwords or passphrases.
- Keylogger
- A type of malware that records the keys struck on a keyboard, often used to steal passwords and other sensitive information.
Source: The Hacker News
Typosquatting Attack Spreads Cosmali Loader
Executive Summary
A typosquatted domain impersonating Microsoft Activation Scripts (MAS) is spreading malicious PowerShell scripts. These scripts infect Windows systems with the Cosmali Loader malware.
Key TTPs
- Initial Access: Typosquatting
- Execution: Malicious PowerShell scripts
- Defense Evasion: Obfuscation techniques
Campaign Analysis
The typosquatted domain tricks users who mistype the legitimate domain. The Cosmali Loader has been observed delivering cryptomining utilities and the XWorm RAT.
Targeting & Infrastructure
- Target Profile: Windows users seeking to activate Microsoft products
- Infrastructure: Typosquatted domain (
get.activate[.]win) impersonatingget.activated.win
Actionable Intelligence
- Domains:
get.activate[.]win
Relevant Terms
- Typosquatting: Registering domains with misspellings of popular websites to lure unsuspecting visitors.
- Malware Loader: Specialized malware designed to deliver additional malicious payloads.
Source: Bleeping Computer
La Poste Hit by DDoS Attack
Executive Summary
Pro-Russian hacking group Noname057 claimed responsibility for a DDoS attack against La Poste, the French postal service, disrupting package deliveries and online banking services. The attack impacted various platforms, including Colissimo and La Banque Postale, causing widespread service disruptions.
Key TTPs
- Initial Access: DDoS attack
- Execution: Overwhelming servers with simultaneous requests
- Defense Evasion: Not applicable
Campaign Analysis
The DDoS attack against La Poste caused significant disruptions during the peak Christmas season, affecting millions of customers and disrupting critical postal and banking services. The incident is part of a surge in cyberattacks targeting French entities, raising concerns about national security.
Targeting & Infrastructure
- Target Profile: French national postal service and its banking services
- Infrastructure: La Poste's central computer systems, websites, mobile applications, and banking platforms
Actionable Intelligence
- Domains:
laposte[.]fr
Relevant Terms
- DDoS: A distributed denial-of-service attack floods a server with traffic, making it unavailable.
- TTPs: Tactics, Techniques, and Procedures are patterns of activities and methods associated with specific threat actors.
Source: SecurityWeek
MacSync Stealer Leverages Signed Swift App
Executive Summary
A new MacSync Stealer variant is delivered via a digitally signed and notarized Swift application, masquerading as a messaging app installer, to bypass Apple's Gatekeeper. This allows the malware to steal sensitive information from macOS systems.
Key TTPs
- Initial Access: Delivered as a code-signed and notarized Swift application within a disk image.
- Execution: Executes an encoded script through a helper component after initial checks.
- Defense Evasion: Bypasses Apple's Gatekeeper checks using a signed application.
Campaign Analysis
The malware uses a more deceptive, hands-off approach compared to earlier variants, which relied on techniques like drag-to-terminal or ClickFix. This shift reflects a broader trend of macOS malware leveraging notarization to appear legitimate.
Targeting & Infrastructure
- Target Profile: macOS users, specifically targeting credentials, API keys, and crypto wallet data.
- Infrastructure: Distributed via disk image "zk-call-messenger-installer-3.9.2-lts.dmg" hosted on "zkcall[.]net/download".
Relevant Terms
- Gatekeeper: A macOS security feature that ensures only trusted software runs on a Mac.
- Notarization: Apple's process of verifying that an app is free of malware and safe to install.
Source: The Hacker News