{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1091 Replication Through Removable Media","home_page_url":"https://patchfirst.co/technique/T1091/","feed_url":"https://patchfirst.co/feed/technique/T1091.json","description":"New and newly exploited CVEs that lead to ATT&CK T1091 Replication Through Removable Media, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2025-24985#kev","url":"https://patchfirst.co/cve/CVE-2025-24985/","title":"[KEV] CVE-2025-24985: Microsoft Windows Fast FAT File System Driver Integer Overflow Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2025-03-11. ENISA EUVD lists it as exploited. EPSS 3.9% (higher than 90.2% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1091 Replication Through Removable Media; T1059 Command and Scripting Interpreter. Priority 66.5 of 100.","summary":"Microsoft Windows Fast FAT File System Driver Integer Overflow Vulnerability","date_published":"2025-03-11T00:00:00.000Z","date_modified":"2026-06-17T08:59:55.000Z","tags":["kev","public-exploit","T1091","T1059"],"_patchfirst":{"reason":"kev","priority":66.5,"kev":{"dateAdded":"2025-03-11","ransomware":false},"epss":{"score":0.0389,"percentile":0.90229},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1091","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-24991#kev","url":"https://patchfirst.co/cve/CVE-2025-24991/","title":"[KEV] CVE-2025-24991: Microsoft Windows NTFS Out-Of-Bounds Read Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2025-03-11. ENISA EUVD lists it as exploited. EPSS 2.0% (higher than 80.9% of CVEs). CVSS 5.5 MEDIUM. ATT&CK: T1091 Replication Through Removable Media; T1005 Data from Local System. Priority 58.0 of 100.","summary":"Microsoft Windows NTFS Out-Of-Bounds Read Vulnerability","date_published":"2025-03-11T00:00:00.000Z","date_modified":"2026-06-17T08:59:56.000Z","tags":["kev","T1091","T1005"],"_patchfirst":{"reason":"kev","priority":58,"kev":{"dateAdded":"2025-03-11","ransomware":false},"epss":{"score":0.02018,"percentile":0.8091},"cvss":{"score":5.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1091","T1005"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2019-15959","url":"https://patchfirst.co/cve/CVE-2019-15959/","title":"CVE-2019-15959: Cisco Small Business SPA500 Series IP Phones Local Script Execution Vulnerability","content_text":"Cisco · Cisco SPA525G2 5-line IP Phone. Not in CISA KEV. EPSS 0.4% (higher than 32.7% of CVEs). CVSS 6.6 MEDIUM. ATT&CK: T1091 Replication Through Removable Media; T1059 Command and Scripting Interpreter. Priority 11.2 of 100.","summary":"Cisco Small Business SPA500 Series IP Phones Local Script Execution Vulnerability","date_published":"2020-09-23T00:00:00.000Z","date_modified":"2024-11-13T18:02:58.000Z","tags":["T1091","T1059"],"_patchfirst":{"reason":"published","priority":11.2,"kev":null,"epss":{"score":0.00386,"percentile":0.32693},"cvss":{"score":6.6,"severity":"MEDIUM","version":"3.0"},"vendor":"Cisco","product":"Cisco SPA525G2 5-line IP Phone","techniqueIds":["T1091","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-12024","url":"https://patchfirst.co/cve/CVE-2020-12024/","title":"CVE-2020-12024: Baxter ExactaMix EM 2400 versions 1.10, 1.11, 1.13, 1.14 and ExactaMix EM1200 Versions 1.1, 1.2, 1.4 and 1.5 does not…","content_text":"Not in CISA KEV. EPSS 0.4% (higher than 29.8% of CVEs). ATT&CK: T1091 Replication Through Removable Media. Priority 6.0 of 100.","summary":"Baxter ExactaMix EM 2400 versions 1.10, 1.11, 1.13, 1.14 and ExactaMix EM1200 Versions 1.1, 1.2, 1.4 and 1.5 does not…","date_published":"2020-06-29T00:00:00.000Z","date_modified":"2024-08-04T11:48:58.000Z","tags":["T1091"],"_patchfirst":{"reason":"published","priority":6,"kev":null,"epss":{"score":0.0036,"percentile":0.29772},"cvss":null,"vendor":null,"product":null,"techniqueIds":["T1091"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-4068","url":"https://patchfirst.co/cve/CVE-2020-4068/","title":"CVE-2020-4068: Heap-based Buffer Overflow in APNSwift","content_text":"kylebrowning · APNSwift. Not in CISA KEV. EPSS 1.3% (higher than 70.7% of CVEs). CVSS 6.3 MEDIUM. ATT&CK: T1091 Replication Through Removable Media; T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1566 Phishing; T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow. Priority 18.6 of 100.","summary":"Heap-based Buffer Overflow in APNSwift","date_published":"2020-06-22T00:00:00.000Z","date_modified":"2024-08-04T07:52:20.000Z","tags":["T1091","T1133","T1190","T1566","T1499.004","T1574"],"_patchfirst":{"reason":"published","priority":18.6,"kev":null,"epss":{"score":0.01316,"percentile":0.70744},"cvss":{"score":6.3,"severity":"MEDIUM","version":"3.1"},"vendor":"kylebrowning","product":"APNSwift","techniqueIds":["T1091","T1133","T1190","T1566","T1499.004","T1574"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}}]}