Multiple Vulnerabilities in Internet-Facing Systems Targeting Hong Kong’s Education Sector

HKCERT has received threat intelligence indicating that threat actors are attempting to target Internet-facing systems of Hong Kong’s education sector by scanning for and exploiting their vulnerabilities. Successful exploitation could result in remote code execution, denial of service condition and security restriction bypass, allowing attackers to deploy web shells and backdoors, steal credentials, establish proxy tunnels and move laterally within affected networks.

Note:

CVE-2020-25223 is being exploited in the wild. A remote attacker could exploit this vulnerability to trigger remote code execution on Sophos SG UTM if the WebAdmin is configured to be accessible to the internet. Hence, the risk level is rated as High Risk.

CVE-2020-26919 is being exploited in the wild. NETGEAR JGS516PE devices are affected by missing function level access control vulnerability. Hence, the risk level is rated as High Risk.

CVE-2020-7796 is being exploited in the wild. A remote attacker could exploit this vulnerability to trigger Server-Side Request Forgery on Zimbra Collaboration Suite (ZCS) if WebEx zimlet is installed and zimlet JSP is enabled. Hence, the risk level is rated as High Risk.

CVE-2021-1497 is being exploited in the wild. A remote attacker could exploit this vulnerability to trigger remote code execution on Cisco HyperFlex HX if the web-based management interface is configured to be accessible to the internet. Hence, the risk level is rated as High Risk.

CVE-2021-31755 is being exploited in the wild. A remote attacker could exploit this vulnerability to trigger remote code execution on Tenda AC11 if remote administration is enabled. Hence, the risk level is rated as High Risk.

CVE-2021-36380 is being exploited in the wild. A remote attacker could exploit this vulnerability to trigger remote code execution on Sunhillo SureLine if the Web GUI is configured to be accessible to the internet. Hence, the risk level is rated as High Risk.

CVE-2022-26143 is being exploited in the wild. A remote attacker could exploit this vulnerability to trigger denial of service condition on MiCollab and MiVoice Business Express if firewall is disabled. Hence, the risk level is rated as High Risk.