MongoDB has issued a warning to IT administrators to immediately apply a patch for a high-severity vulnerability, CVE-2025-14847, that could be exploited in remote code execution (RCE) attacks targeting vulnerable servers. The vulnerability is currently unpatched.
Vulnerability Details
Affected Product: MongoDB versions 8.2.0 through 8.2.3, 8.0.0 through 8.0.16, 7.0.0 through 7.0.26, 6.0.0 through 6.0.26, 5.0.0 through 5.0.31, 4.4.0 through 4.4.29, all v4.2 versions, all v4.0 versions, and all v3.6 versions.
Identifier: CVE-2025-14847.
CVSS Score: 8.7 (High).
Exploitation Status: While mass exploitation is unconfirmed by the vendor, trivial Proof-of-Concept (PoC) exploits are publicly available and circulating.
Risk & Impact
Triage: Immediate patching is strongly recommended due to the high severity of the vulnerability.
Attack Vector: An unauthenticated, remote attacker can exploit the issue to execute arbitrary code on vulnerable servers. The vulnerability involves a client-side exploit of the Server's zlib implementation that can return uninitialized heap memory without authentication.
Ease of Exploit: Proof-of-concept reproduction is trivial using the mongo shell.
Action Plan
Immediate Action: Upgrade to fixed versions 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, and 4.4.30 immediately.
Workaround: If an immediate upgrade is not possible, disable zlib compression on the MongoDB Server by starting mongod or mongos with a networkMessageCompressors or a net.compression.compressors option that explicitly omits zlib. Example safe values include snappy,zstd or disabled.
Detection: Monitor for unusual network activity and inspect MongoDB server logs for suspicious entries related to zlib compression.
Relevant professional terms
Remote Code Execution (RCE)
A type of cyberattack where an attacker can remotely execute commands on a victim's device, potentially leading to the installation of malware or data theft.
IT Administrator
A skilled professional responsible for overseeing and maintaining an organization's IT assets and infrastructure, including managing network security, hardware, and software.
Fortinet Warns of Active Exploitation of FortiOS SSL VPN 2FA Bypass Vulnerability
Medium
Executive Summary
Fortinet has observed active exploitation of a five-year-old security flaw, CVE-2020-12812, in FortiOS SSL VPN, which can bypass two-factor authentication (2FA) under specific configurations. This vulnerability is under active exploitation.
Vulnerability Details
Affected Product: FortiOS SSL VPN 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below
Identifier: CVE-2020-12812
CVSS Score: 5.2 (Medium)
Exploitation Status: Actively Exploited
Risk & Impact
Triage: High urgency. Attackers utilizing credential stuffing lists (valid passwords) can use this flaw to bypass 2FA and breach the perimeter.
Attack Vector: The vulnerability is triggered by entering a username with a different case than the one configured, which bypasses 2FA when local users are also members of LDAP groups.
Ease of Exploit: Easy, provided the attacker already possesses valid user credentials (password). The exploit circumvents the 2FA step.
Action Plan
Immediate Action: Upgrade to FortiOS 6.0.10+, 6.2.4+, or 6.4.1+.
Workaround: Disable username case sensitivity using the command "set username-case-sensitivity disable" or "set username-sensitivity disable" on newer versions. Consider removing secondary LDAP groups if not required.
Detection: Scrutinize logs for anomalies like failed local matches followed by LDAP successes. Use FortiAnalyzer to detect exploit attempts.
Relevant professional terms
SSL VPN
A virtual private network (VPN) that uses Secure Sockets Layer (SSL) protocol to provide secure remote access to a network.
LDAP
Lightweight Directory Access Protocol, an open, vendor-neutral, industry standard application protocol for accessing and maintaining distributed directory information services.
CISA has added a vulnerability, CVE-2023-52163, affecting Digiever DS-2105 Pro network video recorders (NVRs) to its Known Exploited Vulnerabilities (KEV) catalog, indicating that it is under active exploitation. The vulnerability is a command injection flaw that allows for remote code execution.
Vulnerability Details
Affected Product: Digiever DS-2105 Pro NVRs, firmware version 3.1.0.71-11
Identifier: CVE-2023-52163
CVSS Score: 8.8 (High)
Exploitation Status: Actively Exploited
Risk & Impact
Triage: Critical, due to active exploitation and potential for remote code execution.
Attack Vector: Remote, via crafted HTTP requests to the time_tzsetup.cgi script.
Ease of Exploit: High, requiring only that the attacker is logged into the device to perform a crafted request.
Action Plan
Immediate Action: Since the product is EoL, apply compensating controls such as avoiding exposing the device to the internet and changing the default username and password.
Workaround: Implement network segmentation to isolate the NVR and restrict access.
Detection: Monitor network traffic for suspicious HTTP requests to the time_tzsetup.cgi script.
Relevant professional terms
Network Video Recorder (NVR)
A specialized computer system that records video to a storage device, connecting to cameras through a network, typically in an IP video surveillance system.
Vulnerability
A weakness in an information system, system security procedures, internal controls, or implementation that could be exploited by a threat source.
The 2022 LastPass data breach led to the theft of cryptocurrency assets from users with weak master passwords, with incidents reported as recently as late 2025. Russian cybercriminal actors are suspected to be involved, laundering stolen funds through high-risk Russian exchanges.
Attack Overview
Attack Path: Exploitation of weak master passwords to decrypt stolen vault backups.
A typosquatted domain impersonating Microsoft Activation Scripts (MAS) is spreading malicious PowerShell scripts. These scripts infect Windows systems with the Cosmali Loader malware.
Key TTPs
Initial Access: Typosquatting
Execution: Malicious PowerShell scripts
Defense Evasion: Obfuscation techniques
Campaign Analysis
The typosquatted domain tricks users who mistype the legitimate domain. The Cosmali Loader has been observed delivering cryptomining utilities and the XWorm RAT.
Targeting & Infrastructure
Target Profile: Windows users seeking to activate Microsoft products
Pro-Russian hacking group Noname057 claimed responsibility for a DDoS attack against La Poste, the French postal service, disrupting package deliveries and online banking services. The attack impacted various platforms, including Colissimo and La Banque Postale, causing widespread service disruptions.
Key TTPs
Initial Access: DDoS attack
Execution: Overwhelming servers with simultaneous requests
Defense Evasion: Not applicable
Campaign Analysis
The DDoS attack against La Poste caused significant disruptions during the peak Christmas season, affecting millions of customers and disrupting critical postal and banking services. The incident is part of a surge in cyberattacks targeting French entities, raising concerns about national security.
Targeting & Infrastructure
Target Profile: French national postal service and its banking services
Infrastructure: La Poste's central computer systems, websites, mobile applications, and banking platforms
Actionable Intelligence
Domains: laposte[.]fr
Relevant Terms
DDoS: A distributed denial-of-service attack floods a server with traffic, making it unavailable.
TTPs: Tactics, Techniques, and Procedures are patterns of activities and methods associated with specific threat actors.
A new MacSync Stealer variant is delivered via a digitally signed and notarized Swift application, masquerading as a messaging app installer, to bypass Apple's Gatekeeper. This allows the malware to steal sensitive information from macOS systems.
Key TTPs
Initial Access: Delivered as a code-signed and notarized Swift application within a disk image.
Execution: Executes an encoded script through a helper component after initial checks.
Defense Evasion: Bypasses Apple's Gatekeeper checks using a signed application.
Campaign Analysis
The malware uses a more deceptive, hands-off approach compared to earlier variants, which relied on techniques like drag-to-terminal or ClickFix. This shift reflects a broader trend of macOS malware leveraging notarization to appear legitimate.
Targeting & Infrastructure
Target Profile: macOS users, specifically targeting credentials, API keys, and crypto wallet data.
Infrastructure: Distributed via disk image "zk-call-messenger-installer-3.9.2-lts.dmg" hosted on "zkcall[.]net/download".
Relevant Terms
Gatekeeper: A macOS security feature that ensures only trusted software runs on a Mac.
Notarization: Apple's process of verifying that an app is free of malware and safe to install.
