بروزرسانی امنیتی Cisco
Cisco released its September 2024 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication to address vulnerabilities in IOS and IOS XE. A cyber threat actor could exploit some of these vulnerabilities to take control of an affected system. 
اطلاعات بیشتر:
September 2024 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication
@meshkatnet
✉️ ceo@meshkatnet.ir
🌍 www.meshkatnet.ir
🆔 @meshkatnet

آپدیت فوری و درجه با اهمیت ۹.۹ از ۱۰ برای veeam برای vspc
Veeam Issues Patch for Critical RCE Vulnerability in Service Provider Console
Dec 04, 2024

Veeam has released security updates to address a critical flaw impacting Service Provider Console (VSPaC) that could pave the way for remote code execution on susceptible instances.
The vulnerability, tracked as *CVE-2024-42448*, carries a CVSS score of 9.9 out of a maximum of 10.0. The company noted that the bug was identified during internal testing.
"From the VSPC management agent machine, under the condition that the management agent is authorized on the server, it is possible to perform Remote Code Execution (RCE) on the VSPC server machine," Veeam said in an advisory.

More Information:
https://www.veeam.com/kb4679
@meshkatnet
✉️ ceo@meshkatnet.ir
🌍 www.meshkatnet.ir
🆔 @meshkatnet

#Fortinet
OpenSSH regreSSHion Attack
Severity: High
Updated Date Dec 4, 2024
CVE-2024-6387

Summary:
A signal handler race condition was found in OpenSSH's server (sshd), where a client does not authenticate within LoginGraceTime seconds (120 by default, 600 in old OpenSSH versions), then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog(). This could lead to remote code execution with root privileges.

*This advisory is available at the following link:*
https://www.fortiguard.com/psirt/FG-IR-24-258
@meshkatnet
✉️ ceo@meshkatnet.ir
🌍 www.meshkatnet.ir
🆔 @meshkatnet

Microsoft Fixes 72 Flaws, Including Patch for Actively Exploited CLFS Vulnerability
Dec 11, 2024
Summary:
Microsoft closed out its Patch Tuesday updates for 2024 with fixes for a total of 72 security flaws spanning its software portfolio, including one that it said has been exploited in the wild.
Of the 72 flaws, 17 are rated Critical, 54 are rated Important, and one is rated Moderate in severity. Thirty-one of the vulnerabilities are remote code execution flaws, and 27 of them allow for the elevation of privileges.
This is in addition to 13 vulnerabilities the company has addressed in its Chromium-based Edge browser since the release of last month's security update. In total, Microsoft has resolved as many as 1,088 vulnerabilities in 2024 alone, per Fortra.
The vulnerability that Microsoft has acknowledged as having been actively exploited is CVE-2024-49138 (CVSS score: 7.8), a privilege escalation flaw in the Windows Common Log File System (CLFS) Driver.
"An attacker who successfully exploited this vulnerability could gain SYSTEM privileges," the company said in an advisory, crediting cybersecurity company CrowdStrike for discovering and reporting the flaw.
It's worth noting that CVE-2024-49138 is the fifth actively exploited CLFS privilege escalation flaw since 2022 after CVE-2022-24521, CVE-2022-37969, CVE-2023-23376, and CVE-2023-28252 (CVSS scores: 7.8). It's also the ninth vulnerability in the same component to be patched this year.

This advisory is available at the following link:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49138
@meshkatnet
✉️ ceo@meshkatnet.ir
🌍 www.meshkatnet.ir
🆔 @meshkatnet

سلام همراهان عزیز
یلداتون مبارک
✉️ ceo@meshkatnet.ir
🌍 www.meshkatnet.ir
🆔 @meshkatnet

بروزرسانی امنیتی شرکت Fortinet برای Fortimanager و برخی از مدلهای Fortianalyzer
Fortinet released a security update to address a vulnerability in FortiManager. A remote cyber threat actor could exploit this vulnerability to take control of an affected system.
اطلاعات بیشتر:
https://www.fortiguard.com/psirt/FG-IR-24-425
@meshkatnet
✉️ ceo@meshkatnet.ir
🌍 www.meshkatnet.ir
🆔 @meshkatnet

Resolved Multiple Vulnerabilities in Sophos Firewall (CVE-2024-12727, CVE-2024-12728, CVE-2024-12729)
19 Dec 2024
Sophos has resolved three independent security vulnerabilities in Sophos Firewall.

No action is required for Sophos Firewall customers with the "Allow automatic installation of hotfixes" feature enabled on remediated versions. Enabled is the default setting.
This advisory is available at the following link:
https://www.sophos.com/en-us/security-advisories/sophos-sa-20241219-sfos-rce
@meshkatnet
✉️ ceo@meshkatnet.ir
🌍 www.meshkatnet.ir
🆔 @meshkatnet

نحوه ایجاد اینترفیس iSCSI بر روی ذخیره ساز DELL EMC Unity
از استاد بیزمارک
✉️ ceo@meshkatnet.ir
🌍 www.meshkatnet.ir
🆔 @meshkatnet

تکنولوژی FAST VP بر روی ذخیره سازهای DELL EMC Unity
از استاد بیزمارک
✉️ ceo@meshkatnet.ir
🌍 www.meshkatnet.ir
🆔 @meshkatnet

سلام و ارادت
روز مهندس بر شما دوست و مهندس عزیز مبارک باشد.
برای مهندس خلاق بن بستی وجود ندارد یا راهی خواهند یافت و یا راهی خواهند ساخت.
ارادتمند شما حمیدی
✉️ ceo@meshkatnet.ir
🌍 www.meshkatnet.ir
🆔 @meshkatnet

همه هوش مصنوعیا در یک قاب :

@meshkatnet
✉️ ceo@meshkatnet.ir
🌍 www.meshkatnet.ir
🆔 @meshkatnet

🚨 Critical Fortinet 0-Day Exploited in Attacks!

Hackers are hitting FortiVoice systems in the wild—logging creds, wiping crash logs, scanning networks.

CVE-2025-32756 (CVSS 9.6) affects:
—FortiVoice, FortiMail, FortiNDR
—FortiRecorder, FortiCamera

Exploitable without login via crafted HTTP requests.

🔗 Details: https://thehackernews.com/2025/05/fortinet-patches-cve-2025-32756-zero.html
@meshkatnet
✉️ ceo@meshkatnet.ir
🌍 www.meshkatnet.ir
🆔 @meshkatnet

تمامی تولز‌هایی که برای EMC Unity نیاز دارید نسخه ۲۰۲۵
ارسالی از استاد عزیزم مهندس هاشمی
✉️ ceo@meshkatnet.ir
🌍 www.meshkatnet.ir
🆔 @meshkatnet

هشدار سایبری!!!
با توجه به اتفاقات و شرایط حال حاضر، مرکز مدیریت راهبردی افتا طی اعلامیه ای به تمامی دستگاه های اجرایی، سازمان ها و مراکز زیرساختی، نسبت به احتمال وقوع حملات سایبری اعلام هشدار نموده است.
از این رو مقتضی است مدیران شبکه ها نسبت به رعایت الزامات امنیتی نهایت توجه و دقت را داشته باشند.

با احترام
✉️ ceo@meshkatnet.ir
🌍 www.meshkatnet.ir
🆔 @meshkatnet

قابل توجه همکاران محترم
Security Update – QNAP VioStor
Vulnerability: Improper Authentication
CVE: CVE-2025-52856 (EUVD-2025-26252)
Severity: 9.3 (Critical)
Summary:
An improper authentication vulnerability affects QNAP VioStor. A remote attacker could exploit this flaw to compromise system security and potentially gain unauthorized access. The issue has been addressed in recent updates, and patched versions are now available.
Affected Versions:
VioStor 5.1.0 ᐸ 5.1.6 build 20250621
Mitigation / Recommendations:
Upgrade immediately to VioStor 5.1.6 build 20250621 or later.
Restrict remote access to administrative interfaces.
Monitor system logs for suspicious activity.
References:
🔗 QNAP Advisory QSA-25-29
#Critical #QNAP #VioStor #Security
@meshkatnet
✉️ ceo@meshkatnet.ir
🌍 www.meshkatnet.ir
🆔 @meshkatnet

Security Update – Microsoft Monthly Security Update (Patch Tuesday)
Vulnerability: Multiple Critical & High Severity Vulnerabilities Across Microsoft Products
CVE: Multiple (see Microsoft Security Update Guide)
Severity: Critical / High
Summary:
Microsoft has released its monthly Patch Tuesday security updates, addressing multiple vulnerabilities across a wide range of products including Windows, Office, Azure, .NET, and Microsoft Defender. Some of these vulnerabilities are rated Critical, including remote code execution (RCE) and elevation of privilege (EoP) flaws. Exploitation could allow attackers to execute arbitrary code, escalate privileges, or bypass security controls in enterprise environments.
Affected Products:
Windows (all supported versions)
Microsoft Office Suite
Microsoft Edge (Chromium-based)
Azure services & components
.NET Framework / .NET Core
Microsoft Defender and other security products
Not Affected:
Products not listed in the Microsoft Security Update Guide for this release.
Indicators of Compromise:
Suspicious privilege escalations on Windows endpoints
Unexpected crashes or anomalous process executions
Exploitation attempts detected via Microsoft Defender or SIEM alerts
Workaround:
No universal workaround. Microsoft strongly advises applying official patches.
Mitigation / Recommendations:
Apply Microsoft’s latest security updates immediately via Windows Update or WSUS.
Review the Microsoft Security Update Guide for detailed CVE information.
Monitor SIEM and Defender logs for suspicious activity.
Prioritize patching Critical and actively exploited vulnerabilities.
References:
🔗 Microsoft Security Update Guide
#Microsoft #PatchTuesday #Windows #Office #Azure #SecurityUpdate
@meshkatnet
✉️ ceo@meshkatnet.ir
🌍 www.meshkatnet.ir
🆔 @meshkatnet

Security Update – Cisco IOS and IOS XE Software
Vulnerabilities: Multiple High-Severity Vulnerabilities in Cisco IOS and IOS XE
CVEs:
CVE-2025-20312 – SNMP Denial of Service (DoS)
CVE-2025-20352 – SNMP DoS and Remote Code Execution (RCE)
CVE-2025-20313 / CVE-2025-20314 – Secure Boot Bypass
CVE-2025-20315 – NBAR Denial of Service
CVE-2025-20334 – HTTP API Command Injection
CVE-2025-20160 – TACACS+ Authentication Bypass
CVE-2025-20327 – Industrial Ethernet Switch Device Manager DoS
CVE-2025-20311 – Catalyst 9000 Series Switches DoS
Severity: High (CVSS up to 9.x)
Summary:
Cisco has disclosed multiple critical and high-severity vulnerabilities affecting IOS and IOS XE software across a wide range of platforms, including Catalyst 9000 switches and Industrial Ethernet devices. Exploitation of these vulnerabilities could result in denial-of-service conditions, remote code execution, authentication bypass, secure boot bypass, and command injection, depending on the specific CVE. Attackers may exploit these flaws remotely through crafted SNMP, HTTP API, or TACACS+ requests, or via malicious traffic targeting NBAR. Successful exploitation could compromise availability, integrity, or control of affected Cisco infrastructure.
Affected Products:
Cisco devices running affected versions of IOS or IOS XE.
Catalyst 9000 Series switches (CVE-2025-20311).
Industrial Ethernet switches with Device Manager enabled (CVE-2025-20327).
Any deployments with SNMP, TACACS+, HTTP API, NBAR, or secure boot features enabled on vulnerable releases.
Not Affected:
Devices upgraded to Cisco’s fixed releases.
Devices with vulnerable features disabled (e.g., SNMP disabled, HTTP API disabled).
Indicators of Compromise:
Service crashes or repeated restarts (SNMP, NBAR, or HTTP services).
Unexpected authentication success via TACACS+.
Abnormal boot integrity failures or unsigned modules loading (secure boot bypass).
Catalyst 9000 instability, forwarding issues, or control-plane crashes.
Suspicious HTTP or SNMP request patterns in management logs.
Workaround:
No universal workaround. In some cases, disabling or restricting vulnerable services (e.g., SNMP, HTTP API, TACACS+, Device Manager) may reduce risk temporarily.
Mitigation / Recommendations:
Apply Cisco’s official fixed software releases immediately.
Use Cisco’s Software Checker tool to identify impacted devices and recommended fixes.
Restrict management plane access (SNMP, TACACS+, HTTP API) to trusted sources.
Monitor system logs and network traffic for abnormal patterns related to SNMP, HTTP API, TACACS+, or NBAR.
Enforce least privilege on administrative accounts and ensure physical security of devices.
References:
🔗 Cisco Security Advisories
#Cisco #IOS #IOSXE #Catalyst9000 #SNMP #TACACS #DoS #RCE #Security
@meshkatnet
✉️ ceo@meshkatnet.ir
🌍 www.meshkatnet.ir
🆔 @meshkatnet

Security Update – Microsoft Windows
Vulnerability: Heap-based Buffer Overflow – SPNEGO Extended Negotiation
CVE: CVE-2025-47981
Severity: 9.8 (Critical)
Summary:
A heap-based buffer overflow vulnerability exists in the SPNEGO Extended Negotiation component of Microsoft Windows.
An unauthenticated attacker can exploit this issue remotely over the network to execute arbitrary code. Successful exploitation could lead to full system compromise.
Affected Products:
Windows Server 2022 (ᐸ 10.0.20348.3932)
Windows Server 2022, 23H2 Edition (Server Core) (ᐸ 10.0.25398.1732)
Windows Server 2025 (ᐸ 10.0.26100.4652)
Windows Server 2025 (Server Core) (ᐸ 10.0.26100.4652)
Windows Server 2019 (ᐸ 10.0.17763.7558)
Windows Server 2019 (Server Core) (ᐸ 10.0.17763.7558)
Windows Server 2016 (ᐸ 10.0.14393.8246)
Windows Server 2016 (Server Core) (ᐸ 10.0.14393.8246)
Windows Server 2012 (ᐸ 6.2.9200.25573)
Windows Server 2012 (Server Core) (ᐸ 6.2.9200.25573)
Windows Server 2012 R2 (ᐸ 6.3.9600.22676)
Windows Server 2012 R2 (Server Core) (ᐸ 6.3.9600.22676)
Windows Server 2008 R2 SP1 (ᐸ 6.1.7601.27820)
Windows Server 2008 R2 SP1 (Server Core) (ᐸ 6.1.7601.27820)
Windows 11 24H2 (ᐸ 10.0.26100.4652)
Windows 11 23H2 (ᐸ 10.0.22631.5624)
Windows 11 22H3 (ᐸ 10.0.22631.5624)
Windows 11 22H2 (ᐸ 10.0.22621.5624)
Windows 10 22H2 (ᐸ 10.0.19045.6093)
Windows 10 21H2 (ᐸ 10.0.19044.6093)
Windows 10 1809 (ᐸ 10.0.17763.7558)
Windows 10 1607 (ᐸ 10.0.14393.8246)
Windows 10 1507 (ᐸ 10.0.10240.21073)
Not Affected:
None reported
Indicators of Compromise:
Exploitation may result in unexpected crashes of authentication-related services.
Potential anomalous Kerberos/SPNEGO negotiation failures observed in system logs.
Workaround:
No official workaround currently documented.
Mitigation / Recommendations:
Apply Microsoft’s security updates immediately.
Limit network exposure of vulnerable services to trusted systems until patched.
Monitor Windows Event Logs for abnormal authentication or negotiation errors.
References:
🔗 Microsoft Advisory – CVE-2025-47981
🔗 NVD Entry – CVE-2025-47981
🔗 Vicarius Detection Script
🔗 Vicarius Mitigation Script
#Microsoft #Windows #SPNEGO #BufferOverflow #Security
@meshkatnet
✉️ ceo@meshkatnet.ir
🌍 www.meshkatnet.ir
🆔 @meshkatnet

Security Update – Cisco Secure Firewall ASA & FTD VPN Web Server
Vulnerability: Remote Code Execution – VPN Web Server Input Validation Flaw
CVE: CVE-2025-20333
Severity: 9.9 (Critical)
Summary:
A critical remote code execution (RCE) vulnerability exists in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. The issue stems from improper validation of user-supplied input in HTTP(S) requests. An attacker with valid VPN user credentials could exploit this flaw to execute arbitrary code as root, potentially leading to complete device compromise.
Affected Products:
Cisco Secure Firewall ASA Software (with AnyConnect, MUS, or SSL VPN features enabled)
Cisco Secure Firewall FTD Software (with AnyConnect or SSL VPN features enabled)
Not Affected:
Cisco Secure FMC Software
Cisco ASA/FTD devices without vulnerable VPN configurations enabled
Indicators of Compromise:
Unexpected process crashes or instability in VPN services
Unusual activity or anomalies in VPN authentication and web service logs
Signs of arbitrary code execution on Cisco ASA/FTD devices
Workaround:
No known workaround is available.
Mitigation / Recommendations:
Immediately upgrade to Cisco’s fixed software releases as outlined in the advisory.
Review and harden VPN configurations (IKEv2, SSL VPN, MUS).
Monitor VPN service logs for suspicious login attempts or crafted HTTP(S) requests.
Enable Cisco Threat Detection for VPN Services to protect against brute force and service abuse attempts.
References:
🔗 Cisco Security Advisory – CVE-2025-20333
🔗 Cisco Event Response: Continued Attacks Against Cisco Firewall Platforms
#Cisco #Firewall #VPN #RCE #Security #Vulnerability
@meshkatnet
✉️ ceo@meshkatnet.ir
🌍 www.meshkatnet.ir
🆔 @meshkatnet

Security Update – Microsoft October 2025 Patch Tuesday
Vulnerabilities: Multiple Critical and Zero-Day Vulnerabilities Across Microsoft Products
CVEs:
CVE-2025-0033 – AMD Restricted Memory Page Corruption (Zero-Day / Critical)
CVE-2025-24052 – Agere Modem Driver Elevation of Privilege (Zero-Day)
CVE-2025-24990 – Agere Modem Driver Elevation of Privilege (Zero-Day)
CVE-2025-2884 – TPM 2.0 Out-of-Bounds Read (Zero-Day)
CVE-2025-47827 – IGEL OS Secure Boot Bypass (Zero-Day)
CVE-2025-59230 – Windows Remote Access Connection Manager Elevation of Privilege (Zero-Day)
CVE-2025-59218 – Azure Entra ID Elevation of Privilege (Critical)
CVE-2025-59246 – Azure Entra ID Elevation of Privilege (Critical)
CVE-2025-55321 – Azure Monitor Log Analytics Spoofing (Critical)
CVE-2025-59247 – Azure PlayFab Elevation of Privilege (Critical)
CVE-2025-59291 – Confidential Azure Container Instances Elevation of Privilege (Critical)
CVE-2025-59292 – Azure Compute Gallery Elevation of Privilege (Critical)
CVE-2025-59236 – Microsoft Office Excel Remote Code Execution (Critical)
Severity: Critical / Actively Exploited (CVSS up to 9.x)
Summary:
Microsoft has released its October 2025 Patch Tuesday updates, addressing 172 vulnerabilities, including 6 actively exploited zero-days and 8 critical issues. Exploitation of these vulnerabilities could result in elevation of privilege, remote code execution, spoofing, information disclosure, or secure boot bypass. Affected components include Windows OS, Azure services (Entra ID, PlayFab, Monitor, Container Instances, Compute Gallery), Microsoft Office, TPM 2.0, and AMD firmware. Attackers may exploit these flaws locally or remotely to gain administrative privileges, execute arbitrary code, or bypass platform security controls.
Affected Products:
Windows 10 / 11, Windows Server 2016–2025.
Microsoft Office (Excel).
Azure Entra ID, PlayFab, Monitor (Log Analytics), Compute Gallery, Container Instances.
AMD SEV-SNP firmware and TPM 2.0 components.
IGEL OS Secure Boot configurations.
Not Affected:
Systems fully updated with October 2025 patches.
Azure instances running latest image versions.
Devices with Secure Boot and TPM firmware already updated.
Indicators of Compromise:
Privilege escalation or unexpected admin logins.
Unsigned modules loaded during Secure Boot.
Abnormal TPM log entries or integrity check failures.
Excel crash or execution anomalies from untrusted files.
Suspicious Azure authentication events or spoofed identities.
Workaround:
No universal workaround. Disable or restrict vulnerable services (e.g., external RDP, legacy modem drivers, or untrusted Excel macros) until patches are applied.
Mitigation / Recommendations:
Apply Microsoft’s October 2025 security updates immediately.
Prioritize zero-day and critical CVEs listed above.
Use Microsoft Endpoint Manager, WSUS, or Windows Update to deploy patches.
Restrict administrative and remote access to trusted users and networks.
Monitor event logs for suspicious activity related to Secure Boot, TPM, or privilege escalation.
References:
🔗 Microsoft Security Update Guide: https://msrc.microsoft.com/update-guide
#Microsoft #PatchTuesday #ZeroDay #Windows #Azure #TPM #SecurityUpdate #CyberSecurity
@meshkatnet
✉️ ceo@meshkatnet.ir
🌍 www.meshkatnet.ir
🆔 @meshkatnet