Sensor Intel Series: Top CVEs in January 2023

Welcome to the Sensor Intel Series installment for January 2023. The purpose of this recurring monthly brief is to provide security practitioners with vulnerability targeting intelligence so that they can make better-informed decisions about patching and vulnerability remediation. The source of this intelligence is log data from a globally distributed network of passive sensors. While these sensors collect logs on all ports, we primarily focus on HTTP/S traffic on ports 80 and 443. Furthermore, this brief is largely limited to published vulnerabilities with CVE numbers, although there are a handful of non-CVE vulnerabilities that we track as well because they are particularly interesting, easy to spot, or both.

January attack traffic was particularly notable for the continuing growth of interest in CVE-2020-8958. This is an OS command injection vulnerability in several optical routers from Guangzhou VSOL. While attacker interest in this vuln has remained consistently high for most of the past year, the January traffic blew away the previous record (set last month, also by CVE-2020-8958) by nearly 50%. All other vulnerabilities experienced volumes that are more consistent with the baselines we’ve observed in the last year, leaving us to speculate about the reason behind this enormous growth.

January Vulnerabilities by the Numbers

Figure 1 shows the top ten vulnerabilities and their attack traffic in January. This really illustrates the difference between the volume of traffic attempting to exploit CVE-2020-8958 and, well, everything else. However, CVE-2020-8958 shouldn’t obscure the rapid growth of another vulnerability, the CVE-less and roughly-named “2018 JAWS Web Server Vuln.” This is an authentication bypass vulnerability in the JAWS/1.0 web server installed on several digital video recorders (DVRs).¹

Table 1 shows traffic volumes for all vulnerabilities that we track. This month we identified seven new vulnerabilities in our logs, bringing the total number of tracked CVEs to 62.
 

Targeting Trends

To better understand how January contrasts with previous months, Figure 2 shows how the most prominent vulnerabilities have ebbed and flowed in terms of volume over the last year. (To avoid overplotting, Figure 2 shows the top five vulnerabilities per month, grouped and plotted across all months.) The continuing growth of CVE-2020-8958 and the resurgence of the JAWS vulnerability are visible here, as is a precipitous decline in traffic targeting CVE-2018-13379, which dropped 89% from December to January (more on this vulnerability in a moment).

Long Term Trends and Sibling Vulnerabilities

Figure 3 shows traffic volume over time for all of the CVEs we track. This provides a little bit more context around the decline in CVE-2018-13379 (fourth column, top row). This is a critical credential disclosure vulnerability in various Fortinet products, and we expected this vulnerability to be superseded by the October 2022 release of CVE-2022-40684, a critical authentication bypass vulnerability affecting the same Fortinet products. However, both CVE-2018-13379 and CVE-2022-40684 (which is plotted in the third column, sixth row of Figure 3) declined in prevalence in January. One potential explanation for this parallel drop is that the release of a new critical vulnerability drove more customers to patch, and so the attack surface for both vulnerabilities declined.

Conclusions

With the same IoT vulnerability that the top of the heap for four months straight (and six of the last seven months), our conclusions are rather predictable: be alert for DDoS attacks, as compromised IoT devices are the modern gold standard for DDoS infrastructure. Furthermore, F5 Labs recently published our 2023 DDoS Attack Trends, which identified a growing trend towards application layer and multi-vector DDoS attacks. Application layer attacks can be significantly more complex to identify and mitigate than simpler volumetric attacks, so paired with these leading indicators about attackers developing attack infrastructure, it appears that both the likelihood and the impact of DDoS are increasing at present. Our recommendation is to prepare ahead of time and be vigilant, particularly with respect to logging and monitoring—the trend toward application DDoS means that the attacks won’t always be as loud and obvious as they used to be.