Sensor Intel Series: Top CVEs in July 2023

Targeting Trends

Figure 2 shows the change over the past twelve months in attack volume and rank for 13 of the top vulnerabilities. These 13 collectively constitute the top five from each of the twelve months. In this plot, several things stand out: the light yellow color here is the new SSL VPN vulnerability, and you can see how it spiked in May, only to subside in June before growing again to near its May level in July. CVE-2022-42475 was allocated in 2022 but was published in early January 2023, so it has been public knowledge for seven months by now.

Long Term Trends

Figure 3 shows the traffic volume over the last 12 months for 72 CVEs that we track. In this view the recent growth of CVE-2022-42475 is apparent, since it grew roughly a thousandfold between April and May 2023. This plot also shows the continuing decline of another Fortinet vulnerability, CVE-2018-13379.

Since recent traffic has shown change in several Fortinet CVEs, we decided to compare them in more detail. Figure 4 shows the traffic over time for three Fortinet vulnerabilities, CVE-2018-13379, CVE-2022-40684, and the most recent, CVE-2022-42475. 13379 is a directory traversal vulnerability that can result in the disclosure of administrator credentials for the VPN, 40684 is an authentication bypass vulnerability affecting many of the same versions, and this latest one, 42475, is a buffer overflow leading to RCE.

Figure 4 shows that attacker interest in the other two Fortinet vulnerabilities dropped months before CVE-2022-42475 was released, probably because most affected versions were patched. Nevertheless it is interesting to see this continued interest in remote access infrastructure. We will be on the lookout for other exploit attempts against Fortinet vulnerabilities in the future.

Conclusions

One thing that is consistently apparent in the SIS data is the mutability of attacker interest. This is not the first time CVE-2020-8958 has dropped dramatically, and in the past it has always rebounded, which was partly why we have assessed this traffic to indicate interest in building DDoS infrastructure. (The other reason is that gigabit-capable fiberoptic routers such as the one that CVE-2020-8958 applies to are perfect for DDoS because of their prodigious throughput capability.) We will be curious to see how this evolves over the next few months. In the meantime, we have some demonstrated interest in Fortinet products after some quiet time on that front—we will dig into this and see if we can unearth any more interesting intelligence about SSL VPNs or remote infrastructure targeting. See you next month!