CISA alerts: Three new crucial vulnerabilities

TLDR:

• CISA has identified three critical exploited vulnerabilities in ServiceNow and Acronis products.
• The vulnerabilities allow for unauthenticated remote code execution and have been patched by the respective companies.

The American cyber defence agency, CISA, has warned of three critical vulnerabilities that have been exploited in workplace and cybersecurity products offered by ServiceNow and Acronis. The vulnerabilities, CVE-2024-4879, CVE-2024-5217, and CVE-2023-45249, have been identified as input validation and insecure password vulnerabilities that allow for unauthenticated remote code execution.

The first vulnerability, with a CVSS rating of 9.3, was found in ServiceNow software and has since been patched. The second vulnerability, also in ServiceNow software, was given a CVSS score of 9.2 and patched as well. These vulnerabilities have been exploited in the wild, potentially exposing over 42,000 ServiceNow instances.

The third vulnerability, with a CVSS score of 9.8, was identified in Acronis Cyber Infrastructure products due to the use of default passwords. Acronis has released patches for this vulnerability and advised clients to apply them immediately.

Both ServiceNow and Acronis have taken action to patch the vulnerabilities and have encouraged their customers to apply the necessary updates. It is important for organizations using these products to follow the guidance provided by the companies to ensure the security of their systems.