{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1037 Boot or Logon Initialization Scripts","home_page_url":"https://patchfirst.co/technique/T1037/","feed_url":"https://patchfirst.co/feed/technique/T1037.json","description":"New and newly exploited CVEs that lead to ATT&CK T1037 Boot or Logon Initialization Scripts, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2024-20353#kev","url":"https://patchfirst.co/cve/CVE-2024-20353/","title":"[KEV] CVE-2024-20353: Cisco ASA and FTD Denial of Service Vulnerability","content_text":"Cisco · Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD). In CISA KEV since 2024-04-24. ENISA EUVD lists it as exploited. EPSS 69.8% (higher than 99.37% of CVEs). CVSS 8.6 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1653 Power Settings; T1037 Boot or Logon Initialization Scripts; T1608.001 Upload Malware. Named in 2 threat reports. Priority 85.0 of 100.","summary":"Cisco ASA and FTD Denial of Service Vulnerability","date_published":"2024-04-24T00:00:00.000Z","date_modified":"2026-08-11T19:33:44.000Z","tags":["kev","public-exploit","T1190","T1653","T1037","T1608.001"],"_patchfirst":{"reason":"kev","priority":85,"kev":{"dateAdded":"2024-04-24","ransomware":false},"epss":{"score":0.69824,"percentile":0.99368},"cvss":{"score":8.6,"severity":"HIGH","version":"3.1"},"vendor":"Cisco","product":"Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)","techniqueIds":["T1190","T1653","T1037","T1608.001"],"reportCount":2,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-20359#kev","url":"https://patchfirst.co/cve/CVE-2024-20359/","title":"[KEV] CVE-2024-20359: Cisco ASA and FTD Privilege Escalation Vulnerability","content_text":"Cisco · Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD). In CISA KEV since 2024-04-24. ENISA EUVD lists it as exploited. EPSS 18.8% (higher than 97.3% of CVEs). CVSS 6.0 MEDIUM. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1059 Command and Scripting Interpreter; T1037 Boot or Logon Initialization Scripts. Named in 2 threat reports. Priority 82.8 of 100.","summary":"Cisco ASA and FTD Privilege Escalation Vulnerability","date_published":"2024-04-24T00:00:00.000Z","date_modified":"2026-08-11T19:33:44.000Z","tags":["kev","public-exploit","T1078","T1059","T1037"],"_patchfirst":{"reason":"kev","priority":82.8,"kev":{"dateAdded":"2024-04-24","ransomware":false},"epss":{"score":0.18816,"percentile":0.97277},"cvss":{"score":6,"severity":"MEDIUM","version":"3.1"},"vendor":"Cisco","product":"Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)","techniqueIds":["T1078","T1059","T1037"],"reportCount":2,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2022-41328#kev","url":"https://patchfirst.co/cve/CVE-2022-41328/","title":"[KEV] CVE-2022-41328: Fortinet FortiOS Path Traversal Vulnerability","content_text":"Fortinet · FortiOS. In CISA KEV since 2023-03-14. ENISA EUVD lists it as exploited. EPSS 10.7% (higher than 95.8% of CVEs). CVSS 7.1 HIGH. ATT&CK: T1574 Hijack Execution Flow; T1037 Boot or Logon Initialization Scripts; T1049 System Network Connections Discovery; T1565.001 Stored Data Manipulation. Named in 1 threat report. Priority 66.0 of 100.","summary":"Fortinet FortiOS Path Traversal Vulnerability","date_published":"2023-03-14T00:00:00.000Z","date_modified":"2026-06-17T05:03:02.000Z","tags":["kev","T1574","T1037","T1049","T1565.001"],"_patchfirst":{"reason":"kev","priority":66,"kev":{"dateAdded":"2023-03-14","ransomware":false},"epss":{"score":0.10682,"percentile":0.95802},"cvss":{"score":7.1,"severity":"HIGH","version":"3.1"},"vendor":"Fortinet","product":"FortiOS","techniqueIds":["T1574","T1037","T1049","T1565.001"],"reportCount":1,"hasPublicExploit":false,"euvdExploited":true}}]}