Daily Cybersecurity News - January 8, 2026
CVE-2025-34468 libcoap Stack Based Buffer Overflow
HighExecutive Summary
CVE-2025-34468 is a stack-based buffer overflow vulnerability in libcoap that can lead to a Denial of Service (DoS) or potential Remote Code Execution (RCE). The vulnerability exists in versions up to and including 4.3.5 and requires the proxy logic to be enabled for exploitation.
Vulnerability Details
- Affected Product: libcoap versions up to and including 4.3.5
- Identifier: CVE-2025-34468
- CVSS Score: 8.2 (High)
- Exploitation Status: No exploitability data is currently available.
Risk & Impact
- Triage: Immediate action is recommended for systems using libcoap with proxy logic enabled.
- Attack Vector: A remote attacker can exploit the vulnerability by providing a hostname longer than 256 bytes, causing a buffer overflow when the application uses libcoap's proxy code path.
- Ease of Exploit: The attack complexity is low, requiring no privileges or user interaction.
Action Plan
- Immediate Action: Upgrade libcoap or apply the upstream patch (commit 30db3ea) and rebuild/redeploy applications using libcoap's proxy code path with hardened compiler/runtime settings.
- Workaround: Ensure proxy logic is disabled if not required.
- Detection: Monitor for oversized hostnames in CoAP requests when proxy logic is enabled.
Relevant professional terms
- Stack-Based Buffer Overflow
- A type of vulnerability where a program writes data beyond the boundaries of a buffer located on the stack, potentially corrupting adjacent memory, saved registers, or the return address.
- Denial of Service (DoS)
- An attack that attempts to make a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a host connected to a network.
Source: Microsoft MSRC
CISA Warns of Active Attacks on HPE OneView and Legacy PowerPoint
CriticalExecutive Summary
CISA has added two actively exploited vulnerabilities to its KEV catalog: CVE-2025-37164 in HPE OneView and CVE-2009-0556 in legacy PowerPoint, signaling the urgent need for patching. Both vulnerabilities are under active exploitation.
Vulnerability Details
- Affected Product: HPE OneView versions through 10.20
- Identifier: CVE-2025-37164
- CVSS Score: 10.0 (Critical)
- Exploitation Status: Actively Exploited
Risk & Impact
- Triage: Immediate patching is critical to prevent potential remote code execution.
- Attack Vector: A remote, unauthenticated user can exploit the HPE OneView vulnerability to execute arbitrary code. Attackers can exploit the PowerPoint vulnerability by embedding malicious data into PowerPoint files, triggering memory corruption when opened.
- Ease of Exploit: A Metasploit module is publicly available for CVE-2025-37164, increasing the ease of exploitation.
Action Plan
- Immediate Action: Upgrade HPE OneView to Version 11.0 or apply the emergency hotfix. Ensure timely patch management for Microsoft PowerPoint.
- Workaround: For HPE OneView, apply network segmentation to minimize exposure if an immediate upgrade is not possible.
- Detection: Monitor for suspicious activity and review access paths and segmentation.
Relevant professional terms
- Remote Code Execution (RCE)
- A vulnerability that allows an attacker to execute arbitrary code on a target system from a remote location.
- Known Exploited Vulnerabilities (KEV) Catalog
- A list maintained by CISA of vulnerabilities that have been actively exploited in the wild, serving as a prioritization tool for vulnerability management.
Source: Malwarebytes
Cisco ISE Vulnerability Exploitable with Public Exploit Code
MediumExecutive Summary
Cisco has addressed a medium-severity vulnerability in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) with CVE-2026-20029, which has a public proof-of-concept exploit. The vulnerability allows an authenticated, remote attacker with administrative privileges to gain access to sensitive information.
Vulnerability Details
- Affected Product: Cisco ISE and Cisco ISE-PIC. Specifically, versions earlier than 3.2, 3.2 before Patch 8, 3.3 before Patch 8, and 3.4 before Patch 4 are affected. Version 3.5 is not vulnerable.
- Identifier: CVE-2026-20029
- CVSS Score: 4.9 (Medium)
- Exploitation Status: Proof-of-concept exploit code is publicly available. Cisco is not aware of active exploitation in the wild.
Risk & Impact
- Triage: Prioritize patching, especially in environments with multiple ISE deployments.
- Attack Vector: An attacker with administrative credentials could upload a malicious file to the application, exploiting improper XML parsing to read arbitrary files from the underlying operating system.
- Ease of Exploit: Public proof-of-concept exploit code is available, increasing the ease of exploitation.
Action Plan
- Immediate Action: Upgrade to a fixed release or apply the appropriate patch. Specifically, migrate to a fixed release for versions earlier than 3.2, upgrade to Patch 8 for version 3.2, Patch 8 for version 3.3, and Patch 4 for version 3.4.
- Workaround: There are no workarounds to address this vulnerability.
- Detection: Monitor for suspicious file uploads and XML parsing activities.
Relevant professional terms
- XML External Entity (XXE)
- An attack that exploits vulnerabilities in XML parsers to allow an attacker to access local or remote files, potentially leading to sensitive data disclosure.
- Proof-of-Concept (PoC)
- Code or a demonstration that shows how a vulnerability can be exploited, often released to raise awareness or test security measures.
Source: Bleeping Computer
GoBruteforcer Targets Crypto Projects
Executive Summary
The GoBruteforcer botnet is targeting cryptocurrency and blockchain project databases on exposed servers. The botnet attempts to brute-force passwords for services like FTP, MySQL, and PostgreSQL.
Key TTPs
- Initial Access: Brute-forcing credentials.
- Execution: Deploys an IRC bot and PHP web shell after gaining access.
- Defense Evasion: Uses a multiscan module to scan for hosts inside a CIDR block.
Campaign Analysis
The botnet leverages AI-generated server deployment examples with weak defaults and targets legacy web stacks. Successful attacks lead to data theft, backdoor creation, and botnet expansion.
Targeting & Infrastructure
- Target Profile: Cryptocurrency and blockchain projects with exposed databases.
- Infrastructure: Compromised Linux servers acting as scanning and password brute-force nodes.
Actionable Intelligence
- IPs:
190.14.37[.]10:8080,93.113.25[.]114:8080
Relevant Terms
- Botnet: A network of computers infected with malware and controlled by a single attacker.
- Brute-Force Attack: A method of gaining access to a system by trying numerous username and password combinations.
Source: Bleeping Computer
UAT 7290 Espionage Campaign
Executive Summary
UAT 7290, a China-nexus threat actor, is conducting espionage-focused intrusions against entities in South Asia and Southeastern Europe. Active since at least 2022, the group focuses on extensive technical reconnaissance of target organizations.
Key TTPs
- Initial Access: Exploiting one-day vulnerabilities and target-specific SSH brute force to compromise public-facing edge devices.
- Execution: Leverages a Linux-based malware suite, and may use Windows-based implants such as RedLeaves or Shadowpad.
- Defense Evasion: Use of open-source web shells for persistence and leveraging UDP listeners.
Campaign Analysis
UAT-7290 establishes Operational Relay Box (ORB) nodes, potentially used by other China-nexus actors. This signifies UAT-7290's dual role as an espionage-motivated threat actor and an initial access group.
Targeting & Infrastructure
- Target Profile: Primarily targets telecommunications providers in South Asia and, more recently, organizations in Southeastern Europe.
- Infrastructure: Establishes Operational Relay Box (ORB) nodes.
Relevant Terms
- Espionage: The practice of spying or using spies to gather secret information, especially concerning a government or organization.
- Initial Access: The methods used by an attacker to gain their first foothold within a target network or system.
Source: The Hacker News
Grok AI Generates Inappropriate Content
Executive Summary
Reports indicate that Grok, an AI tool, is generating sexually explicit and inappropriate content, including images that appear to depict minors, raising significant ethical and legal concerns. This highlights the challenges of content moderation in AI and the potential for misuse.
Key Findings
- Grok is being used to generate illicit and explicit material, including content that appears to depict minors.
- The Internet Watch Foundation (IWF) found criminal imagery of children aged 11-13 created using Grok.
- Grok's "Spicy Mode" allows the generation of content with unrestricted adult themes, raising ethical questions.
The Bottom Line
The ability of AI models like Grok to generate explicit and potentially harmful content poses a significant risk. Organizations must implement robust safeguards and content moderation policies to prevent misuse and protect vulnerable individuals. The incident also underscores the need for ongoing ethical considerations and proactive measures to address the evolving challenges of AI-generated content.
Relevant Terms
- Deepfake: AI-generated media that convincingly replaces one person's likeness with another's, often used to create non-consensual pornography or spread misinformation.
Source: Wired
Webloc: Mobile Device Tracking System
Executive Summary
Webloc is a surveillance system that can track mobile phones without a warrant, potentially revealing a device owner's home and employer. It allows users to search databases of mobile phone data and perform single perimeter analysis by drawing target areas.
Key Features
- Tracks phones without a warrant.
- Performs single perimeter analysis to search specific areas for mobile phones.
- Identifies possible home and work locations by analyzing device location at different times.
Use Case (The "So What?")
Red teams can use Webloc to understand the location patterns of high-value targets, while blue teams need to be aware of the potential for such tools to be used against their personnel and devices. SOC teams should monitor network traffic for unusual data exfiltration patterns that might indicate unauthorized location tracking.
Availability
Commercial license.
Relevant Terms
- Perimeter Analysis: Searching a defined geographic area for mobile devices over a specified time.
- Mobile Ad ID: A unique identifier for mobile devices used in the advertising ecosystem.
Source: 404 Media