Alert Prioritization and Guided Remediation: The future of EDR

Sleepless nights, missed threats, a deluge of notifications--the common symptoms of the bane of IT teams everywhere: Alert fatigue. Out of the litany of problems IT teams face every day, alert fatigue might be among the most pressing--especially considering that 30 percent of EDR alerts are ignor...

PCMag ranks Malwarebytes #1 cybersecurity vendor

PCMag, one of the most trusted publications by IT professionals, named Malwarebytes the 1 most-recommended security software vendor on its list of Best Tech Brands for 2023. The ranking is based on a Net Promoter Score NPS, a composite rating based on customer reviews from PCMag's Readers Choice...

Chimera - Automated DLL Sideloading Tool With EDR Evasion Capabilities

While DLL sideloading can be used for legitimate purposes, such as loading necessary libraries for a program to function, it can also be used for malicious purposes. Attackers can use DLL sideloading to execute arbitrary code on a target system, often by exploiting vulnerabilities in legitimate...

New Attack Alert: Freeze[.]rs Injector Weaponized for XWorm Malware Attacks

Malicious actors are using a legitimate Rust-based injector called Freeze.rs to deploy a commodity malware called XWorm in victim environments. The novel attack chain, detected by Fortinet FortiGuard Labs on July 13, 2023, is initiated via a phishing email containing a booby-trapped PDF file. It...

CVE-2023-39341

"FFRI yarai", "FFRI yarai Home and Business Edition" and their OEM products handle exceptional conditions improperly, which may lead to denial-of-service DoS condition. Affected products and versions are as follows: FFRI yarai versions 3.4.0 to 3.4.6 and 3.5.0, FFRI yarai Home and Business Editio...

CVE-2023-39341

The CVE-2023-39341 issue affects FFRI yarai and related OEM products, where improper handling of exceptional conditions can cause a Denial-of-Service (DoS). Affected software families and versions include FFRI yarai (3.4.0–3.4.6, 3.5.0) and FFRI yarai Home and Business Edition (1.4.0), plus relat...

CVE-2023-39341

"FFRI yarai", "FFRI yarai Home and Business Edition" and their OEM products handle exceptional conditions improperly, which may lead to denial-of-service DoS condition. Affected products and versions are as follows: FFRI yarai versions 3.4.0 to 3.4.6 and 3.5.0, FFRI yarai Home and Business Editio...

MDR: Empowering Organizations with Enhanced Security

Managed Detection and Response MDR has emerged as a crucial solution for organizations looking to bolster their security measures. MDR allows businesses to outsource the management of Endpoint Detection and Response EDR products deployed across their network domain. With real-time threat-hunting...

Hey, are you REALLY ready to go on vacation? (No, you aren't)

Are you ready for a challenge? A real challenge? Do you laugh in the face of shark cages, scoff at the Marathon des Sables, and waft a dismissive finger in the direction of the Everest ascent? Are you ready to conquer the impossible? If so, then you might be ready for the ultimate challenge--taki...

Moxa EDR-810 Server Agent Information Disclosure (CVE-2017-12128)

An exploitable information disclosure vulnerability exists in the Server Agent functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted TCP packet can cause information disclosure. An attacker can send a crafted TCP packet to trigger this vulnerability. This plugin only works with...

Moxa EDR-G903 Secure Router Denial of Service (CVE-2016-0878)

Moxa Secure Router EDR-G903 devices before 3.4.12 allow remote attackers to cause a denial of service cold start by sending two crafted ping requests. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C...

Moxa EDR-810 Unauthenticated Remote Code Execution with Root Privileges (CVE-2018-16282)

A command injection vulnerability in the web server functionality of Moxa EDR-810 V4.2 build 18041013 allows remote attackers to execute arbitrary OS commands with root privilege via the caname parameter to the /xml/netWebCADELETEGetValue URI. This plugin only works with Tenable.ot. Please visit...

Moxa EDR-810 Industrial Secure Router Privilege Escalation (CVE-2016-8346)

An issue was discovered in Moxa EDR-810 Industrial Secure Router. By accessing a specific uniform resource locator URL on the web server, a malicious user is able to access configuration and log files PRIVILEGE ESCALATION. This plugin only works with Tenable.ot. Please visit...

Moxa EDR-G902 and EDR-G903 Series Routers Stack-Based Buffer Overflow (CVE-2020-14511)

Malicious operation of the crafted web browser cookie may cause a stack-based buffer overflow in the system web server on the EDR-G902 and EDR-G903 Series Routers versions prior to 5.4. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...

Moxa EDR-G903 series Hard-coded Credentials (CVE-2012-4712)

Moxa EDR-G903 series routers with firmware before 2.11 have a hardcoded account, which allows remote attackers to obtain unspecified device access via unknown vectors. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...

Moxa EDR-810 Web RSA Key Generation Command Injection (CVE-2017-12121)

An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can cause a privilege escalation resulting in root shell. An attacker can inject OS commands into the rsakey\name= parm in the...

Moxa EDR-810 Web Server ping Command Injection (CVE-2017-12120)

An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can cause a privilege escalation, resulting in a root shell. An attacker can inject OS commands into the ip= parm in the...

Moxa EDR-G903 Secure Router Plaintext Storage of a Password (CVE-2016-0876)

Moxa Secure Router EDR-G903 devices before 3.4.12 allow remote attackers to discover cleartext passwords by reading a configuration file. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc...

Moxa EDR 810 Series Improper Input Validation (CVE-2019-10969)

Moxa EDR 810, all versions 5.1 and prior, allows an authenticated attacker to abuse the ping feature to execute unauthorized commands on the router, which may allow an attacker to perform remote code execution. This plugin only works with Tenable.ot. Please visit...

Moxa EDR-810 Plaintext Password Storage (CVE-2017-12127)

A password storage vulnerability exists in the operating system functionality of Moxa EDR-810 V4.1 build 17030317. An attacker with shell access could extract passwords in clear text from the device. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot...