erroneo.us
Search all guides⌘K

Digest · Friday

Security digest: December 27, 2024

2 editorial briefs.

All digests · RSS · Markdown

Take stock

  • Check exposure: DrayTek Vigor2960/300B CVE-2024-12987: Exploited Web UI RCE. Owners of DrayTek Vigor2960, Vigor300B or Vigor3900 routers on firmware below 1.5.1.5, most urgently where the web management interface faces the internet.
  • Check exposure: PAN-OS CVE-2024-3393: DNS Security Packet Reboots Firewalls. Teams with PAN-OS firewalls licensed for DNS Security or Advanced DNS Security, with DNS Security logging enabled, still running an affected 10.1.14+, 10.2.8+, 11.0, 11.1 or 11.2 build.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Vulnerability · CVE-2024-12987

DrayTek Vigor2960/300B CVE-2024-12987: Exploited Web UI RCE

Vigor2960, Vigor300B and Vigor3900 routers on firmware 1.5.1.5 or later are fixed; any unit still on 1.5.1.4 or older with its web management reachable from the internet should be upgraded today and checked for tampering.

Must act: Owners of DrayTek Vigor2960, Vigor300B or Vigor3900 routers on firmware below 1.5.1.5, most urgently where the web management interface faces the internet.

Can relax: Owners of other DrayTek models, which this CVE does not name, and of these three models already on 1.5.1.5 or newer with management limited to the LAN or a VPN.

  1. Find every Vigor2960, Vigor300B and Vigor3900 and note its firmware version.
  2. Before upgrading, change any admin password that contains a % character, as DrayTek's release notes warn.
  3. Upgrade to 1.5.1.8, or at least 1.5.1.5, and verify the image against the FIRMWARE.DIGESTS file.

Read the brief →

Check exposure

· Vulnerability · CVE-2024-3393

PAN-OS CVE-2024-3393: DNS Security Packet Reboots Firewalls

Fixed since early 2025 and a denial of service only; confirm no firewall with a DNS Security license and logging is still on an affected build, including end-of-life PAN-OS 11.0.

Must act: Teams with PAN-OS firewalls licensed for DNS Security or Advanced DNS Security, with DNS Security logging enabled, still running an affected 10.1.14+, 10.2.8+, 11.0, 11.1 or 11.2 build.

Can relax: Firewalls on any later fixed release, devices without a DNS Security license or with DNS Security log severity set to none, PAN-OS 10.2 before 10.2.8, 10.0 and 9.1, and Panorama and Cloud NGFW.

  1. List every firewall and its PAN-OS version with show system info.
  2. Run show config merged | match log-level to see whether DNS Security logging is on.
  3. Upgrade anything on an affected build to the fixed release for its train, or to a current supported release.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.