Sensor Intel Series: Top CVEs in July 2023

It seems like threat actors everywhere could detect my impatience last month when I wrote that not much had changed among the 70-odd CVEs that we track for attack trends, because last month they did something. Actually, to be more precise, they stopped doing some things. This is the first month since September 2022 that CVE-2020-8958, the GPON router OS command injection flaw, was not the top-targeted CVE. Let’s see what CVE took its spot, and which other CVEs changed in July.

July Vulnerabilities by the Numbers

Figure 1 shows the volume of attack traffic for the top ten vulnerabilities in July. In place of CVE-2020-8958, CVE-2017-9841, a remote code execution vulnerability in PHPUnit, took the top spot. We also added a new CVE to our signatures in July, which promptly landed in the fifth spot for the month: CVE-2022-42475, a buffer overflow vulnerability in various versions of Fortigate’s FortiOS and FortiProxy SSL VPNs.

Table 1 shows traffic for all of the vulnerabilities that featured in June or July, along with their CVSS and EPSS scores. Here we can see the dramatic dip in traffic targeting CVE-2020-8958, which dropped more than 60% from the previous month. It is also worth noting that CVE-2022-42475, the new SSL VPN buffer overflow vulnerability, has a fairly low EPSS score of 46% chance of being malicious exploitation. This might seem low for a critical vulnerability in security infrastructure, but this EPSS score still puts it in the 97% percentile of all vulnerabilities. We will be curious to see if the score changes over time.

Table 1. Traffic volumes, change from the previous month, CVSS and EPSS scores for all vulnerabilities that were targeted in either June or July 2023.

Targeting Trends

Figure 2 shows the change over the past twelve months in attack volume and rank for 13 of the top vulnerabilities. These 13 collectively constitute the top five from each of the twelve months. In this plot, several things stand out: the light yellow color here is the new SSL VPN vulnerability, and you can see how it spiked in May, only to subside in June before growing again to near its May level in July. CVE-2022-42475 was allocated in 2022 but was published in early January 2023, so it has been public knowledge for seven months by now.

Figure 2. Evolution of vulnerability targeting trends over previous twelve months. This plot shows fourteen vulnerabilities which collectively represent the monthly top five for all twelve months.

Long Term Trends

Figure 3 shows the traffic volume over the last 12 months for 72 CVEs that we track. In this view the recent growth of CVE-2022-42475 is apparent, since it grew roughly a thousandfold between April and May 2023. This plot also shows the continuing decline of another Fortinet vulnerability, CVE-2018-13379.

Figure 3. Traffic volume for the last twelve months for 72 tracked CVEs.

Since recent traffic has shown change in several Fortinet CVEs, we decided to compare them in more detail. Figure 4 shows the traffic over time for three Fortinet vulnerabilities, CVE-2018-13379, CVE-2022-40684, and the most recent, CVE-2022-42475. 13379 is a directory traversal vulnerability that can result in the disclosure of administrator credentials for the VPN, 40684 is an authentication bypass vulnerability affecting many of the same versions, and this latest one, 42475, is a buffer overflow leading to RCE.

Figure 4. Attack traffic targeting recent Fortinet CVEs. Attacker interest in the two older vulnerabilities (CVE-2018-13379 and CVE-2022-40684) had already subsided before attack traffic against CVE-2022-42475 picked up.

Figure 4 shows that attacker interest in the other two Fortinet vulnerabilities dropped months before CVE-2022-42475 was released, probably because most affected versions were patched. Nevertheless it is interesting to see this continued interest in remote access infrastructure. We will be on the lookout for other exploit attempts against Fortinet vulnerabilities in the future.

Conclusions

One thing that is consistently apparent in the SIS data is the mutability of attacker interest. This is not the first time CVE-2020-8958 has dropped dramatically, and in the past it has always rebounded, which was partly why we have assessed this traffic to indicate interest in building DDoS infrastructure. (The other reason is that gigabit-capable fiberoptic routers such as the one that CVE-2020-8958 applies to are perfect for DDoS because of their prodigious throughput capability.) We will be curious to see how this evolves over the next few months. In the meantime, we have some demonstrated interest in Fortinet products after some quiet time on that front—we will dig into this and see if we can unearth any more interesting intelligence about SSL VPNs or remote infrastructure targeting. See you next month!