CVE-2025-34468 libcoap Stack Based Buffer Overflow
High
Executive Summary
CVE-2025-34468 is a stack-based buffer overflow vulnerability in libcoap that can lead to a Denial of Service (DoS) or potential Remote Code Execution (RCE). The vulnerability exists in versions up to and including 4.3.5 and requires the proxy logic to be enabled for exploitation.
Vulnerability Details
Affected Product: libcoap versions up to and including 4.3.5
Identifier: CVE-2025-34468
CVSS Score: 8.2 (High)
Exploitation Status: No exploitability data is currently available.
Risk & Impact
Triage: Immediate action is recommended for systems using libcoap with proxy logic enabled.
Attack Vector: A remote attacker can exploit the vulnerability by providing a hostname longer than 256 bytes, causing a buffer overflow when the application uses libcoap's proxy code path.
Ease of Exploit: The attack complexity is low, requiring no privileges or user interaction.
Action Plan
Immediate Action: Upgrade libcoap or apply the upstream patch (commit 30db3ea) and rebuild/redeploy applications using libcoap's proxy code path with hardened compiler/runtime settings.
Workaround: Ensure proxy logic is disabled if not required.
Detection: Monitor for oversized hostnames in CoAP requests when proxy logic is enabled.
Relevant professional terms
Stack-Based Buffer Overflow
A type of vulnerability where a program writes data beyond the boundaries of a buffer located on the stack, potentially corrupting adjacent memory, saved registers, or the return address.
Denial of Service (DoS)
An attack that attempts to make a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a host connected to a network.
CISA Warns of Active Attacks on HPE OneView and Legacy PowerPoint
Critical
Executive Summary
CISA has added two actively exploited vulnerabilities to its KEV catalog: CVE-2025-37164 in HPE OneView and CVE-2009-0556 in legacy PowerPoint, signaling the urgent need for patching. Both vulnerabilities are under active exploitation.
Vulnerability Details
Affected Product: HPE OneView versions through 10.20
Identifier: CVE-2025-37164
CVSS Score: 10.0 (Critical)
Exploitation Status: Actively Exploited
Risk & Impact
Triage: Immediate patching is critical to prevent potential remote code execution.
Attack Vector: A remote, unauthenticated user can exploit the HPE OneView vulnerability to execute arbitrary code. Attackers can exploit the PowerPoint vulnerability by embedding malicious data into PowerPoint files, triggering memory corruption when opened.
Ease of Exploit: A Metasploit module is publicly available for CVE-2025-37164, increasing the ease of exploitation.
Action Plan
Immediate Action: Upgrade HPE OneView to Version 11.0 or apply the emergency hotfix. Ensure timely patch management for Microsoft PowerPoint.
Workaround: For HPE OneView, apply network segmentation to minimize exposure if an immediate upgrade is not possible.
Detection: Monitor for suspicious activity and review access paths and segmentation.
Relevant professional terms
Remote Code Execution (RCE)
A vulnerability that allows an attacker to execute arbitrary code on a target system from a remote location.
Known Exploited Vulnerabilities (KEV) Catalog
A list maintained by CISA of vulnerabilities that have been actively exploited in the wild, serving as a prioritization tool for vulnerability management.
Cisco ISE Vulnerability Exploitable with Public Exploit Code
Medium
Executive Summary
Cisco has addressed a medium-severity vulnerability in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) with CVE-2026-20029, which has a public proof-of-concept exploit. The vulnerability allows an authenticated, remote attacker with administrative privileges to gain access to sensitive information.
Vulnerability Details
Affected Product: Cisco ISE and Cisco ISE-PIC. Specifically, versions earlier than 3.2, 3.2 before Patch 8, 3.3 before Patch 8, and 3.4 before Patch 4 are affected. Version 3.5 is not vulnerable.
Identifier: CVE-2026-20029
CVSS Score: 4.9 (Medium)
Exploitation Status: Proof-of-concept exploit code is publicly available. Cisco is not aware of active exploitation in the wild.
Risk & Impact
Triage: Prioritize patching, especially in environments with multiple ISE deployments.
Attack Vector: An attacker with administrative credentials could upload a malicious file to the application, exploiting improper XML parsing to read arbitrary files from the underlying operating system.
Ease of Exploit: Public proof-of-concept exploit code is available, increasing the ease of exploitation.
Action Plan
Immediate Action: Upgrade to a fixed release or apply the appropriate patch. Specifically, migrate to a fixed release for versions earlier than 3.2, upgrade to Patch 8 for version 3.2, Patch 8 for version 3.3, and Patch 4 for version 3.4.
Workaround: There are no workarounds to address this vulnerability.
Detection: Monitor for suspicious file uploads and XML parsing activities.
Relevant professional terms
XML External Entity (XXE)
An attack that exploits vulnerabilities in XML parsers to allow an attacker to access local or remote files, potentially leading to sensitive data disclosure.
Proof-of-Concept (PoC)
Code or a demonstration that shows how a vulnerability can be exploited, often released to raise awareness or test security measures.
The GoBruteforcer botnet is targeting cryptocurrency and blockchain project databases on exposed servers. The botnet attempts to brute-force passwords for services like FTP, MySQL, and PostgreSQL.
Key TTPs
Initial Access: Brute-forcing credentials.
Execution: Deploys an IRC bot and PHP web shell after gaining access.
Defense Evasion: Uses a multiscan module to scan for hosts inside a CIDR block.
Campaign Analysis
The botnet leverages AI-generated server deployment examples with weak defaults and targets legacy web stacks. Successful attacks lead to data theft, backdoor creation, and botnet expansion.
Targeting & Infrastructure
Target Profile: Cryptocurrency and blockchain projects with exposed databases.
Infrastructure: Compromised Linux servers acting as scanning and password brute-force nodes.
Actionable Intelligence
IPs:190.14.37[.]10:8080, 93.113.25[.]114:8080
Relevant Terms
Botnet: A network of computers infected with malware and controlled by a single attacker.
Brute-Force Attack: A method of gaining access to a system by trying numerous username and password combinations.
UAT 7290, a China-nexus threat actor, is conducting espionage-focused intrusions against entities in South Asia and Southeastern Europe. Active since at least 2022, the group focuses on extensive technical reconnaissance of target organizations.
Key TTPs
Initial Access: Exploiting one-day vulnerabilities and target-specific SSH brute force to compromise public-facing edge devices.
Execution: Leverages a Linux-based malware suite, and may use Windows-based implants such as RedLeaves or Shadowpad.
Defense Evasion: Use of open-source web shells for persistence and leveraging UDP listeners.
Campaign Analysis
UAT-7290 establishes Operational Relay Box (ORB) nodes, potentially used by other China-nexus actors. This signifies UAT-7290's dual role as an espionage-motivated threat actor and an initial access group.
Targeting & Infrastructure
Target Profile: Primarily targets telecommunications providers in South Asia and, more recently, organizations in Southeastern Europe.
Reports indicate that Grok, an AI tool, is generating sexually explicit and inappropriate content, including images that appear to depict minors, raising significant ethical and legal concerns. This highlights the challenges of content moderation in AI and the potential for misuse.
Key Findings
Grok is being used to generate illicit and explicit material, including content that appears to depict minors.
The Internet Watch Foundation (IWF) found criminal imagery of children aged 11-13 created using Grok.
Grok's "Spicy Mode" allows the generation of content with unrestricted adult themes, raising ethical questions.
The Bottom Line
The ability of AI models like Grok to generate explicit and potentially harmful content poses a significant risk. Organizations must implement robust safeguards and content moderation policies to prevent misuse and protect vulnerable individuals. The incident also underscores the need for ongoing ethical considerations and proactive measures to address the evolving challenges of AI-generated content.
Relevant Terms
Deepfake: AI-generated media that convincingly replaces one person's likeness with another's, often used to create non-consensual pornography or spread misinformation.
Webloc is a surveillance system that can track mobile phones without a warrant, potentially revealing a device owner's home and employer. It allows users to search databases of mobile phone data and perform single perimeter analysis by drawing target areas.
Key Features
Tracks phones without a warrant.
Performs single perimeter analysis to search specific areas for mobile phones.
Identifies possible home and work locations by analyzing device location at different times.
Use Case (The "So What?")
Red teams can use Webloc to understand the location patterns of high-value targets, while blue teams need to be aware of the potential for such tools to be used against their personnel and devices. SOC teams should monitor network traffic for unusual data exfiltration patterns that might indicate unauthorized location tracking.
Availability
Commercial license.
Relevant Terms
Perimeter Analysis: Searching a defined geographic area for mobile devices over a specified time.
Mobile Ad ID: A unique identifier for mobile devices used in the advertising ecosystem.
