Forwarded from Taiwan Computer Network Crisis Management and Coordination Center: Cybersecurity Alert TWCERTCC-200-202512-00000007
[Content Description]
【CVE-2022-37055】D-Link Routers Buffer Overflow Vulnerability (CVSS v3.1: 9.8)
【Exploitation by Ransomware: Unknown】 A buffer overflow vulnerability exists in D-Link routers, which has a high impact on confidentiality, integrity, and availability. Affected products may have reached End-of-Life (EoL) and/or End-of-Service (EoS) status. Users should stop using these products.
【CVE-2025-66644】Array Networks ArrayOS AG OS Command Injection Vulnerability (CVSS v3.1: 7.2)
【Exploited by Ransomware: Unknown】 An operating system command injection vulnerability exists in Array Networks ArrayOS AG, which could allow attackers to execute arbitrary commands.
【CVE-2025-6218】RARLAB WinRAR Path Traversal Vulnerability (CVSS v3.1: 7.8)
【Exploited by Ransomware: Unknown】 A path traversal vulnerability exists in RARLAB WinRAR, which allows attackers to execute code as the current user.
【CVE-2025-62221】Microsoft Windows Use After Free Vulnerability (CVSS v3.1: 7.8)
【Exploited by Ransomware: Unknown】 A vulnerability exists in the Microsoft Windows Cloud Files Mini Filter Driver that allows a free-of-use vulnerability, potentially enabling an authorized attacker to escalate privileges on the local machine.
【CVE-2025-58360】OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability (CVSS v3.1: 8.2)
【Exploited by Ransomware: Unknown】 An improper restriction vulnerability exists in OSGeo GeoServer that could allow an attacker to define external entities in the XML request when an application receives XML input for a GetMap operation from the /geoserver/wms endpoint.
【CVE-2018-4063】Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability (CVSS v3.1: 8.8)
【Ransomware Exploitation: Unknown】 A vulnerability exists in Sierra Wireless AirLink ALEOS that allows unrestricted upload of a dangerous type of file. An attacker could upload a file using a specially crafted HTTP request, resulting in executable code being uploaded to a web server and accessible over the network.
An attacker only needs to send a verified HTTP request to trigger this vulnerability. Affected products may have reached End-of-Life (EoL) and/or End-of-Service (EoS) states; users should stop using these products.
【CVE-2025-14174】Google Chromium Out of Bounds Memory Access Vulnerability (CVSS v3.1: 8.8)
【Exploitation by Ransomware: Unknown】 A vulnerability exists in the ANGLE component of Google Chromium that allows an attacker to perform out-of-bounds memory access through a specially crafted HTML page. This vulnerability may affect multiple web browsers that use Chromium, including but not limited to Google Chrome, Microsoft Edge, and Opera.
[Affected Platforms]
【CVE-2022-37055】Please refer to the official list of affected versions: https://www.dlink.com/en/security-bulletin/
【CVE-2025-66644】ArrayOS AG versions 9.4.5.8 and earlier
【CVE-2025-6218】Please refer to the official list of affected versions: https://www.win-rar.com/singlenewsview.html
【CVE-2025-62221】Please refer to the official list of affected versions: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62221
【CVE-2025-58360】Please refer to the official list of affected versions https://github.com/geoserver/geoserver/security/advisories/GHSA-fjf5-xgmq-5525
【CVE-2018-4063】 Sierra Wireless AirLink ES450 FW 4.9.3
【CVE-2025-14174】 Please refer to the official list of affected versions: https://learn.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security#december-11-2025
[Recommended Actions]
【CVE-2022-37055】 Affected products may have reached End-of-Life (EoL) and/or End-of-Service (EoS) status. Users should stop using these products.
[CVE-2025-66644] Upgrade your product to the following version (or higher): ArrayOS AG 9.4.5.9
[CVE-2025-6218] An official patch update has been released for this vulnerability. Please update to the relevant version: https://www.win-rar.com/singlenewsview.html
[CVE-2025-62221] An official patch update has been released for this vulnerability. Please update to the relevant version: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62221
[CVE-2025-58360] An official patch update has been released for this vulnerability. Please update to the relevant version: https://github.com/geoserver/geoserver/security/advisories/GHSA-fjf5-xgmq-5525 [CVE-2018-4063] Affected products may have reached End-of-Life (EoL) and/or End-of-Service (EoS) status. Users should stop using these products.
[CVE-2025-14174] An official patch update has been released for this vulnerability. Please update to the relevant version: https://learn.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security#december-11-2025