Sensor Intel Series: Top CVEs in October 2023

The Sensor Intel Series is created in partnership with Efflux, who maintains a globally distributed network of sensors from which we derive attack telemetry.

------------------------------------------------------------------------------------------

Welcome back to the Sensor Intelligence Series, our recurring monthly summary of vulnerability intelligence based on distributed passive sensor data. This time, we added a section discussing the overall level of scan traffic month to month, to give a better sense of how the ups and downs of the various CVEs we track compare to overall variations in traffic volume.

So, without any further ado, let’s dig into the changes we saw in October for the CVEs we track, so the people in the USA at least can get back to eating their Thanksgiving leftovers.

October Vulnerabilities by the Numbers

Figure 1 shows the traffic for the top 10 CVEs in October. CVE-2020-8958, a Guangzhou router command injection vulnerability, has been our top seen CVE for much of the past year, returning to the top in August and September 2023, and just this month being displaced from the premier spot by CVE 2017-9841, an RCE vulnerability PHPUnit. CVE-2017-9841 has been a top contender in the past but has been falling in the last several months. In third is CVE-2022-24847, an RCE in the open-source GeoServer software which we’ve seen towards the top position before. Overall traffic in the CVEs we track dropped again as it did in September, with the notable exception of CVE 2017-9841, which rebounded significantly from its general downward trend after it previously peaked in July.

Table 1 shows traffic for October, change in traffic from September, CVSS v3.x score, and EPSS scores for 70 CVEs. Our list of CVEs with confirmed attack or scanning traffic currently stands at 82, but 11 vulnerabilities saw no traffic in either September or October and so don’t make this table.

Table 1. October traffic, change from September, CVSS and EPSS scores for 70 CVEs.

Targeting Trends

To better assess rapid changes in attack traffic, Figure 2 shows a bump plot, which plots both traffic volume and changes in rank. The 12 CVEs shown here represent the top five for each of the twelve months. Notable in this month’s plot, as previously mentioned, is the rise of CVE 2017-9841. While not anywhere near its former peak in July, it did see a sharp reversal from the general downward trend previously observed.

Figure 2. Evolution of vulnerability targeting trends over previous twelve months. Note the sharp rise in traffic for CVE-2017-9841.

Overall Scanning Traffic Changes

Lest the downward trend shown in Figure 2 makes it seem like overall scanning traffic may be abating, it’s important to note that the volume of scanning we observed has remained relatively constant, at least over the last three months, increasing by approximately 5.1% from August to September, then falling approximately 5.8% from September to October.

The full details of the changes in scanning traffic over the last 12 months are shown in the following table.

Table 2: Percentage change of overall scanning traffic from November 2022 to October 2023

Long Term Trends

Because Figure 2 only shows high-traffic CVEs, Figure 3 shows traffic for all 82 CVEs we have tracked. In this view, most of our tracked CVEs can be seen to be holding at a relatively steady rate, with a few showing marked declines from relatively high rates seen in previous months, such as CVE-2013-6397, a directory traversal vulnerability in Apache Solr before version 4.6, and CVE-2021-26084, a critical Remote Code Execution vulnerability in Confluence Server and Data Center in several versions before 7.4.11, 7.11.6, and 7.12.5.

Figure 3. Traffic volume for the last twelve months for 82 tracked CVEs.

Conclusions

We must once again reiterate that our sensors are passive, and they do not respond to requests, nor do they pretend to be any specific platform or software stack. They are simply an open socket on port 80 and 443, with just enough of a webserver to be able to record the requests made to them and negotiate any required TLS connection. They do not have DNS names, although it’s certainly possible they may once have had them. Sometimes IP blocks are reassigned, and old DNS records remain that continue to point to them.

For those new to the Sensor Intelligence Series, we will conclude by repeating some old but valid observations. We see a continuing focus on IoT and router vulnerabilities, as well as easy, essentially one-request remote code execution vulnerabilities. These typically result in the installation of malware, crypto miners, and DDoS bots. See you in December!