InfoSecBulletin Cybersecurity for mankind
CISA warned U.S. government agencies on Thursday to protect their systems from a critical Microsoft Configuration Manager vulnerability that was fixed in October 2024 and is currently being exploited. Microsoft Configuration Manager is a tool for IT management of many Windows servers and workstations.
CVE-2024-43468 is an SQL injection vulnerability discovered by Synacktiv that lets remote attackers execute arbitrary commands on the server and Microsoft Configuration Manager database without any privileges.
After BDJobs, Directorate of Secondary and Higher Education 390k data surfaced online
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
“An unauthenticated attacker could exploit this vulnerability by sending specially crafted requests to the target environment which are processed in an unsafe manner enabling the attacker to execute commands on the server and/or underlying database,” Microsoft explained when it patched the flaw in October 2024.
At the time, Microsoft tagged it as “Exploitation Less Likely,” saying that “an attacker would likely have difficulty creating the code, requiring expertise and/or sophisticated timing, and/or varied results when targeting the affected product.”
CISA has now identified CVE-2024-43468 as being actively exploited and has instructed Federal Civilian Executive Branch (FCEB) agencies to update their systems by March 5th, as required by the Binding Operational Directive (BOD) 22-01.
“These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise,” the U.S. cybersecurity agency warned.
“Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.”
BOD 22-01 is aimed at federal agencies, but CISA urged all network defenders, including private sector ones, to quickly secure their devices against CVE-2024-43468 attacks.
| Action | Details |
|---|---|
| Immediate Actions | Scan with Defender or SSMS for suspicious queries. |
| Patch Fast | Install updates; test before production rollout. |
| Mitigate | Block untrusted IPs, enable IIS protection, use least privilege. |
| Cloud Twist | Enable MFA, logging, and zero-trust for Azure setups. |
Immediate Actions: Scan environments with tools like Microsoft Defender or SQL Server Management Studio for anomalous queries.
Patch Fast: Download updates from Microsoft Update Catalog. Test in staging first to avoid disrupting console access.
