The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical security alert regarding serious vulnerabilities in Veeder-Root’s TLS4B Automatic Tank Gauge System. Released on October 23, 2025, the alert warns that attackers could exploit these flaws to take control of industrial systems used worldwide, particularly in the energy sector. Two Critical Vulnerabilities Discovered Security […]
A new vulnerability in early versions of OpenVPN has been disclosed, potentially allowing malicious servers to execute arbitrary commands on client machines.
The flaw affects OpenVPN releases from 2.7_alpha1 to 2.7_beta1, enabling script-injection attacks on POSIX-based systems such as Linux, macOS, and BSD variants.
The issue stems from inadequate sanitization of the –dns and –dhcp-option arguments. When a client connects to an untrusted VPN service, these parameters are passed unsanitized to the –dns-updown script hook.
This oversight lets attackers embed malicious commands that run with elevated privileges on the client device, risking data theft, malware deployment, or full system compromise.
Security researchers warn that users relying on these beta builds for remote access or secure networking face immediate risks, especially in enterprise or personal setups involving third-party VPN providers.
OpenVPN – Script Injection Attack
Designated as CVE-2025-10680, the vulnerability has a CVSS score of 8.1 (high severity), highlighting its exploitability over the network without authentication.
It exploits the trust model where clients assume server-pushed DNS configurations are benign. On affected Unix-like systems, the –dns-updown script executes these inputs directly, opening the door to command injection.
Windows users are also impacted if using the built-in PowerShell integration, though the primary exposure remains on Linux and macOS.
Proof-of-concept exploits could involve crafting DNS strings with shell metacharacters, such as backticks or semicolons, to chain additional commands.
The OpenVPN project has confirmed no evidence of widespread exploitation yet, but urges immediate updates.
Patch Released With OpenVPN 2.7_beta2
Responding swiftly, the OpenVPN community released version 2.7_beta2 on October 27, 2025, incorporating critical fixes.
Key among them is enhanced input sanitation for DNS strings, blocking injection attempts from trusted-but-malicious servers.
The update also addresses Windows-specific issues, like improved event logging via a new openvpnservmsg.dll, and restores IPv4 broadcast configuration on Linux.
Additional bug fixes include better handling of multi-socket setups on Windows and repairs to DHCP options in TAP mode. Users should download the beta2 build from the official OpenVPN website and test in non-production environments.
For production use, sticking to stable 2.6.x releases remains advisable until 2.7 stabilizes. This incident underscores the importance of validating VPN software betas, particularly in diverse OS ecosystems.
Cybersecurity researchers have uncovered a sophisticated phishing campaign orchestrated by the notorious Gamaredon threat group, specifically targeting government entities through exploitation of a critical WinRAR vulnerability. The attack leverages CVE-2025-8088, a path traversal vulnerability in the popular file compression software, to deliver weaponized RAR archives that silently deploy malicious payloads without requiring user interaction beyond […]
The Apache Software Foundation has disclosed two security vulnerabilities affecting multiple versions of Apache Tomcat, with one flaw posing a serious risk of remote code execution on vulnerable servers. The flaws impact Apache Tomcat versions 9, 10, and 11, prompting urgent warnings for administrators to upgrade their installations immediately. CVE ID Vulnerability Severity CVSS Score […]
The competitive gaming landscape has become a breeding ground for cybercriminals who exploit players’ desire to gain an unfair advantage. While major esports tournaments like last year’s CS2 PGL Major in Copenhagen boast prize pools reaching $1.25 million, the temptation to cheat extends far beyond professional competition. The industry noted one of its most notorious […]
Cybersecurity firm LayerX has identified a critical vulnerability in OpenAI’s ChatGPT Atlas browser that allows malicious actors to inject harmful instructions into ChatGPT’s memory and execute remote code. This security flaw poses significant risks to users across all browsers but presents particularly severe dangers for those using the new ChatGPT Atlas browser. Cross-Site Request Forgery […]
A European embassy located in the Indian capital of New Delhi, as well as multiple organizations in Sri Lanka, Pakistan, and Bangladesh, have emerged as the target of a new campaign orchestrated by a threat actor known as SideWinder in September 2025.
The activity “reveals a notable evolution in SideWinder’s TTPs, particularly the adoption of a novel PDF and ClickOnce-based infection chain, in
The Apache Software Foundation has highlighted critical flaws in Apache Tomcat, a widely used open-source Java servlet container that powers numerous web applications.
On October 27, 2025, Apache disclosed two vulnerabilities, CVE-2025-55752 and CVE-2025-55754, affecting multiple versions of Tomcat.
While the first poses a risk of remote code execution (RCE) under specific configurations, the second enables potential console manipulation, underscoring the need for immediate patching in enterprise environments.
These issues stem from regressions and unescaped sequences, potentially exposing servers to unauthorized access and control.
Directory Traversal Flaw Enables RCE
The more severe vulnerability, CVE-2025-55752, involves a directory traversal bug introduced in the fix for an earlier issue (bug 60013).
In this regression, rewritten URLs are normalized before decoding, allowing attackers to manipulate query parameters and bypass protections for sensitive directories like /WEB-INF/ and /META-INF/.
If PUT requests are enabled, a configuration typically restricted to trusted users, malicious files can be uploaded, leading to RCE.
Discovered by Chumy Tsai of CyCraft Technology, this flaw is rated as Important severity, emphasizing its potential impact on unpatched systems running Tomcat in production.
Affected versions include Apache Tomcat 11.0.0-M1 to 11.0.10, 10.1.0-M1 to 10.1.44, and 9.0.0-M11 to 9.0.108, with older end-of-life (EOL) releases also vulnerable.
The technical specifics revolve around URL rewriting rules that inadvertently allow path manipulation, exploiting the order of normalization and decoding processes to evade security constraints.
CVE ID
Severity
Affected Versions
CVSS Score
Technical Description
Credit
CVE-2025-55752
Important
11.0.0-M1 to 11.0.10 10.1.0-M1 to 10.1.44 9.0.0.M11 to 9.0.108
N/A (Important)
Directory traversal via rewritten URL normalization before decoding; enables file upload and RCE if PUT enabled. Bypasses /WEB-INF/ and /META-INF/ protections.
In addition to the traversal issue, CVE-2025-55754 addresses improper neutralization of ANSI escape sequences in Tomcat’s log messages.
On Windows systems with ANSI-supporting consoles, attackers could craft URLs to inject sequences that manipulate the console display, clipboard, or even trick administrators into executing commands.
Although no direct attack vector was identified for other OSes, the potential for social engineering remains a concern. Rated Low severity, this flaw affects Tomcat 11.0.0-M1 to 11.0.10, 10.1.0-M1 to 10.1.44, and 9.0.0.40 to 9.0.108, plus select EOL versions like 8.5.60 to 8.5.100.
Identified by Elysee Franchuk of MOBIA Technology Innovations, the issue arises from unescaped logs, allowing control sequences to influence terminal behavior without authentication.
CVE ID
Severity
Affected Versions
CVSS Score
Technical Description
Credit
CVE-2025-55754
Low
11.0.0-M1 to 11.0.10 10.1.0-M1 to 10.1.44 9.0.0.40 to 9.0.108
N/A (Low)
Unescaped ANSI sequences in logs enable console/clipboard manipulation on Windows; potential command trickery via crafted URLs.
Experts note that while less critical, combining this with other flaws could amplify threats in console-monitored setups.
Mitigations
Apache urges users to upgrade to mitigated versions: Tomcat 11.0.11, 10.1.45, or 9.0.109 and later, which address both vulnerabilities through enhanced URL handling and log escaping.
Organizations should audit configurations, particularly those enabling PUT requests alongside rewrites, to prevent RCE chains. Given Tomcat’s prevalence in Java-based applications, unpatched instances could face targeted attacks, echoing earlier exploits like CVE-2025-24813.
In late 2025, a staggering 81% of broadband users were found to have never changed their router’s default administrative password, opening the door to significant malware risk.
This widespread negligence was revealed in Broadband Genie’s fourth major router security survey, where 3,242 users were polled to gauge progress on consumer cybersecurity awareness.
Despite regulatory pushes and increased media attention, most users remain vulnerable, rendering their household networks and connected devices susceptible to compromise.
The roots of this problem trace back to an enduring blend of user unawareness and confusing router interfaces.
Many consumers equate router setup with minimal configuration: plug in, connect, and browse the web.
Yet, this leaves gateways open for attackers who can readily find manufacturer-default admin credentials on the open web.
Once these details are leveraged, malicious actors gain intimate access to the device, facilitating surveillance, DNS tampering, internal pivoting, or installation of persistent malware.
It is this architectural weakness that has empowered a new wave of malware to automate penetration campaigns against poorly-configured home routers across the globe.
Broadband researchers noted the malware’s swift adoption of credential brute-forcing and default-password attacks as a dominant vector.
Compromised routers become launchpads for botnets, phishing operations, and data exfiltration campaigns.
Case studies and reports highlight the ease with which threat actors automate exploitation: using known credential pairs and unauthenticated web interfaces, attackers deploy scripts that rapidly cycle through default logins across residential IP address blocks.
Attack Vector Deep Dive: Infection Mechanism
At the core of these attacks lies automated credential stuffing—the process of systematically attempting commonly-known router admin usernames and passwords until access is gained.
A typical payload delivered post-exploitation automates configuration theft and persistence. Below is a representative code snippet demonstrating how malware initiates a brute-force loop to hijack router admin panels using Python:-
import requests
def brute_force_admin(target_url, creds_list):
for username, password in creds_list:
response = requests.post(f"{target_url}/login", data={"user": username, "pass": password})
if "dashboard" in response.text:
print(f"Compromised: {username}:{password}")
return True
return False
# Example usage with common credentials
credentials = [("admin", "admin"), ("user", "1234"), ("root", "password")]
brute_force_admin("http://192.168.1.1", credentials)
Once successful, the malware may alter DNS settings, disable security updates, or establish remote backdoors, effectively enslaving the device. Real-world reports demonstrate that persistent router malware often abuses these unaltered credentials for repeated re-infection, even after device reboots.
81% have not changed the router administrator password (Source – Broadband)
This persistent threat landscape underscores the critical importance of changing default administrative credentials and highlights the ongoing role of broadband research in tracking and combating new strains of router malware.
Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.
New York, New York, USA, October 27th, 2025, CyberNewsWire nsKnox, a leader in payment security, today announced the launch of Adaptive Payment Security, a groundbreaking enhancement to its PaymentKnox platform designed to eliminate B2B payment fraud by providing the fastest possible bank account validation with the flexibility to achieve irrefutable certainty on demand. The platform […]
.webp)