DNS Hijacking Abuses Trust In Core Internet Service
blog.talosintelligence.com · 17 Apr 2019 · Licence: not cleared; local research copy only
CVEs this report names
10 CVEs- CVE-2026-20182Cisco Catalyst SD-WAN Controller Authentication Bypass VulnerabilityCisco · Catalyst SD-WANKEVPublic exploitCritical · 10.0T1190Exploit Public-Facing Application4 reports91.8%Top 0.18%83.9priority
- CVE-2018-7600Drupal Core Remote Code Execution VulnerabilityDrupal · Drupal CoreKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+2 more · 1 report>99.9%Top 0.01%83.7priority
- CVE-2025-20333Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow…Cisco · Secure Firewall Adaptive Security Appliance and Secure Firewall Threat DefenseKEVPublic exploitCritical · 9.9T1133External Remote ServicesT1059Command and Scripting Interpreter5 reports71.2%Top 0.59%79.8priority
- CVE-2025-20362Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization…Cisco · Secure Firewall Adaptive Security Appliance and Secure Firewall Threat DefenseKEVPublic exploitHigh · 8.6T1190Exploit Public-Facing ApplicationT1499.004Application or System Exploitation5 reports87.1%Top 0.25%79.0priority
- CVE-2014-6271GNU Bourne-Again Shell (Bash) Arbitrary Code Execution VulnerabilityGNU · Bourne-Again Shell (Bash)KEVPublic exploitCritical · 9.8T1133External Remote ServicesT1190Exploit Public-Facing Application+1 more · 2 reports>99.9%Top 0.01%76.0priority
- CVE-2009-1151phpMyAdmin Remote Code Execution VulnerabilityphpMyAdmin · phpMyAdminKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter1 report96.6%Top 0.12%73.7priority
- CVE-2017-3881Cisco IOS and IOS XE Remote Code Execution VulnerabilityCisco · IOS and IOS XEKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+1 more · 1 report99.0%Top 0.07%73.7priority
- CVE-2017-6736Cisco IOS and IOS XE Software SNMP Remote Code Execution VulnerabilityCisco · IOS and IOS XE SoftwareKEVPublic exploitHigh · 8.8T1078Valid AccountsT1059Command and Scripting Interpreter+1 more · 1 report70.4%Top 0.62%72.9priority
- CVE-2017-12617Apache Tomcat Remote Code Execution VulnerabilityApache · TomcatKEVPublic exploitHigh · 8.1T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+1 more · 1 report>99.9%Top 0.02%72.5priority
- CVE-2018-0296Cisco Adaptive Security Appliance (ASA) Denial-of-Service VulnerabilityCisco · Adaptive Security Appliance (ASA)KEVPublic exploitHigh · 7.5T1005Data from Local System1 report99.9%Top 0.03%72.1priority
Where it names them
CVE-2026-20182 Original (opens in a new tab) ↗
Cisco Talos is tracking the active exploitation of CVE-2026-20182, an authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage.
CVE-2018-7600 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
CVE-2018-7600: RCE for Website built with Drupal, aka "Drupalgeddon"
Service Router 2811SID: 43424 - 43432CVE-2017-12617: RCE affecting Apache web servers running TomcatSID: 44531CVE-2018-0296: Directory traversal to gain unauthorized access to Cisco Adaptive Security Appliances (ASAs) and FirewallsSID: 46897CVE-2018-7600: RCE for Website built with Drupal aka "Drupalgeddon"SID:
CVE-2025-20333 Original (opens in a new tab) ↗
UAT-4356 exploited n-day vulnerabilities (CVE-2025-20333 and CVE-2025-20362) to gain unauthorized access to vulnerable devices.
CVE-2025-20362 Original (opens in a new tab) ↗
UAT-4356 exploited n-day vulnerabilities (CVE-2025-20333 and CVE-2025-20362) to gain unauthorized access to vulnerable devices.
CVE-2014-6271 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
CVE-2014-6271: RCE affecting GNU bash system, specifically the SMTP (this was part of the Shellshock CVEs)
PHP code injection vulnerability affecting phpMyAdminSID: 2281CVE-2014-6271: RCE affecting GNU bash system, specific the SMTP (this was part of the Shellshock CVEs)SID: 31975 - 31978, 31985, 32038, 32039, 32041 - 32043, 32069, 32335, 32336CVE-2017-3881: RCE for Cisco switchesSID: 41909 -
CVE-2009-1151 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
CVE-2009-1151: PHP code injection vulnerability affecting phpMyAdmin
CVE-2009-1151: PHP code injection vulnerability affecting phpMyAdminSID: 2281CVE-2014-6271: RCE affecting GNU bash system, specific the SMTP (this was part of the Shellshock CVEs)SID: 31975 - 31978, 31985, 32038, 32039, 32041 - 32043, 32069, 32335, 32336CVE-2017-3881: RCE for Cisco switchesSID: 41909 - 41910CVE-2017-67
CVE-2017-3881 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
CVE-2017-3881: RCE by unauthenticated user with elevated privileges Cisco switches
GNU bash system, specific the SMTP (this was part of the Shellshock CVEs)SID: 31975 - 31978, 31985, 32038, 32039, 32041 - 32043, 32069, 32335, 32336CVE-2017-3881: RCE for Cisco switchesSID: 41909 - 41910CVE-2017-6736: Remote Code Exploit (RCE) for Cisco integrated Service Router 2811SID: 43424 -
CVE-2017-6736 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
CVE-2017-6736: Remote Code Exploit (RCE) for Cisco integrated Service Router 2811
the Shellshock CVEs)SID: 31975 - 31978, 31985, 32038, 32039, 32041 - 32043, 32069, 32335, 32336CVE-2017-3881: RCE for Cisco switchesSID: 41909 - 41910CVE-2017-6736: Remote Code Exploit (RCE) for Cisco integrated Service Router 2811SID: 43424 - 43432CVE-2017-12617: RCE affecting Apache web servers running TomcatSID:
CVE-2017-12617 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
CVE-2017-12617: RCE affecting Apache web servers running Tomcat
RCE for Cisco switchesSID: 41909 - 41910CVE-2017-6736: Remote Code Exploit (RCE) for Cisco integrated Service Router 2811SID: 43424 - 43432CVE-2017-12617: RCE affecting Apache web servers running TomcatSID: 44531CVE-2018-0296: Directory traversal to gain unauthorized access to Cisco Adaptive Security
CVE-2018-0296 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
CVE-2018-0296: Directory traversal allowing unauthorized access to Cisco Adaptive Security Appliances (ASAs) and firewalls
Code Exploit (RCE) for Cisco integrated Service Router 2811SID: 43424 - 43432CVE-2017-12617: RCE affecting Apache web servers running TomcatSID: 44531CVE-2018-0296: Directory traversal to gain unauthorized access to Cisco Adaptive Security Appliances (ASAs) and FirewallsSID: 46897CVE-2018-7600: RCE for Website
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.