轉發 台灣電腦網路危機處理暨協調中心 資安訊息警訊 TWCERTCC-200-202512-00000007
[內容說明]
【CVE-2022-37055】D-Link Routers Buffer Overflow Vulnerability (CVSS v3.1: 9.8)
【是否遭勒索軟體利用:未知】 D-Link 路由器存在緩衝區溢位漏洞，對機密性、完整性與可用性具有高度影響。受影響的產品可能已達生命週期終止（EoL）及／或服務終止（EoS）狀態，使用者應停止使用這些產品。
【CVE-2025-66644】Array Networks ArrayOS AG OS Command Injection Vulnerability (CVSS v3.1: 7.2)
【是否遭勒索軟體利用:未知】 Array Networks ArrayOS AG 存在作業系統指令注入漏洞，可能允許攻擊者執行任意指令。
【CVE-2025-6218】RARLAB WinRAR Path Traversal Vulnerability (CVSS v3.1: 7.8)
【是否遭勒索軟體利用:未知】 RARLAB WinRAR 存在路徑遍歷漏洞，允許攻擊者以當前使用者身分執行程式碼。
【CVE-2025-62221】Microsoft Windows Use After Free Vulnerability (CVSS v3.1: 7.8)
【是否遭勒索軟體利用:未知】 Microsoft Windows Cloud Files Mini Filter Driver 存在記憶體使用後釋放漏洞，可能允許已授權的攻擊者在本機提升權限。
【CVE-2025-58360】OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability (CVSS v3.1: 8.2)
【是否遭勒索軟體利用:未知】 OSGeo GeoServer 存在 XML 外部實體參照限制不當的漏洞，當應用程式接收 /geoserver/wms 端點 GetMap 操作的 XML 輸入時，可能允許攻擊者在 XML 請求中定義外部實體。
【CVE-2018-4063】Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability (CVSS v3.1: 8.8)
【是否遭勒索軟體利用:未知】 Sierra Wireless AirLink ALEOS 存在未受限制的危險類型檔案上傳漏洞。攻擊者可透過特製的 HTTP 請求上傳檔案，導致可執行程式碼被上傳至 Web 伺服器上，並可透過網路存取。
攻擊者僅需發送已驗證的 HTTP 請求即可觸發此漏洞。受影響的產品可能已達生命週期終止（EoL）及／或服務終止（EoS）狀態，使用者應停止使用這些產品。
【CVE-2025-14174】Google Chromium Out of Bounds Memory Access Vulnerability (CVSS v3.1: 8.8)
【是否遭勒索軟體利用:未知】 Google Chromium 的 ANGLE 元件中存在越界記憶體存取漏洞，可能允許遠端攻擊者透過特製的 HTML 頁面執行越界記憶體存取。此漏洞可能影響多個使用 Chromium 的網頁瀏覽器，包括但不限於 Google Chrome、Microsoft Edge 與 Opera。
[影響平台]
【CVE-2022-37055】請參考官方所列的影響版本 https://www.dlink.com/en/security-bulletin/
【CVE-2025-66644】ArrayOS AG 9.4.5.8(含)之前的版本
【CVE-2025-6218】請參考官方所列的影響版本 https://www.win-rar.com/singlenewsview.html
【CVE-2025-62221】請參考官方所列的影響版本 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62221
【CVE-2025-58360】請參考官方所列的影響版本 https://github.com/geoserver/geoserver/security/advisories/GHSA-fjf5-xgmq-5525
【CVE-2018-4063】 Sierra Wireless AirLink ES450 FW 4.9.3
【CVE-2025-14174】請參考官方所列的影響版本 https://learn.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security#december-11-2025
[建議措施]
【CVE-2022-37055】 受影響的產品可能已達生命週期終止（EoL）及／或服務終止（EoS）狀態，使用者應停止使用這些產品。
【CVE-2025-66644】 對應產品升級至以下版本(或更高) ArrayOS AG 9.4.5.9
【CVE-2025-6218】 官方已針對漏洞釋出修復更新，請更新至相關版本 https://www.win-rar.com/singlenewsview.html
【CVE-2025-62221】 官方已針對漏洞釋出修復更新，請更新至相關版本 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62221
【CVE-2025-58360】 官方已針對漏洞釋出修復更新，請更新至相關版本 https://github.com/geoserver/geoserver/security/advisories/GHSA-fjf5-xgmq-5525
【CVE-2018-4063】 受影響的產品可能已達生命週期終止（EoL）及／或服務終止（EoS）狀態，使用者應停止使用這些產品。
【CVE-2025-14174】 官方已針對漏洞釋出修復更新，請更新至相關版本 https://learn.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security#december-11-2025
Forwarded from Taiwan Computer Network Crisis Management and Coordination Center: Cybersecurity Alert TWCERTCC-200-202512-00000007
[Content Description]
【CVE-2022-37055】D-Link Routers Buffer Overflow Vulnerability (CVSS v3.1: 9.8)
【Exploitation by Ransomware: Unknown】 A buffer overflow vulnerability exists in D-Link routers, which has a high impact on confidentiality, integrity, and availability. Affected products may have reached End-of-Life (EoL) and/or End-of-Service (EoS) status. Users should stop using these products.
【CVE-2025-66644】Array Networks ArrayOS AG OS Command Injection Vulnerability (CVSS v3.1: 7.2)
【Exploited by Ransomware: Unknown】 An operating system command injection vulnerability exists in Array Networks ArrayOS AG, which could allow attackers to execute arbitrary commands.
【CVE-2025-6218】RARLAB WinRAR Path Traversal Vulnerability (CVSS v3.1: 7.8)
【Exploited by Ransomware: Unknown】 A path traversal vulnerability exists in RARLAB WinRAR, which allows attackers to execute code as the current user.
【CVE-2025-62221】Microsoft Windows Use After Free Vulnerability (CVSS v3.1: 7.8)
【Exploited by Ransomware: Unknown】 A vulnerability exists in the Microsoft Windows Cloud Files Mini Filter Driver that allows a free-of-use vulnerability, potentially enabling an authorized attacker to escalate privileges on the local machine.
【CVE-2025-58360】OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability (CVSS v3.1: 8.2)
【Exploited by Ransomware: Unknown】 An improper restriction vulnerability exists in OSGeo GeoServer that could allow an attacker to define external entities in the XML request when an application receives XML input for a GetMap operation from the /geoserver/wms endpoint.
【CVE-2018-4063】Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability (CVSS v3.1: 8.8)
【Ransomware Exploitation: Unknown】 A vulnerability exists in Sierra Wireless AirLink ALEOS that allows unrestricted upload of a dangerous type of file. An attacker could upload a file using a specially crafted HTTP request, resulting in executable code being uploaded to a web server and accessible over the network.
An attacker only needs to send a verified HTTP request to trigger this vulnerability. Affected products may have reached End-of-Life (EoL) and/or End-of-Service (EoS) states; users should stop using these products.
【CVE-2025-14174】Google Chromium Out of Bounds Memory Access Vulnerability (CVSS v3.1: 8.8)
【Exploitation by Ransomware: Unknown】 A vulnerability exists in the ANGLE component of Google Chromium that allows an attacker to perform out-of-bounds memory access through a specially crafted HTML page. This vulnerability may affect multiple web browsers that use Chromium, including but not limited to Google Chrome, Microsoft Edge, and Opera.
[Affected Platforms]
【CVE-2022-37055】Please refer to the official list of affected versions: https://www.dlink.com/en/security-bulletin/
【CVE-2025-66644】ArrayOS AG versions 9.4.5.8 and earlier
【CVE-2025-6218】Please refer to the official list of affected versions: https://www.win-rar.com/singlenewsview.html
【CVE-2025-62221】Please refer to the official list of affected versions: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62221
【CVE-2025-58360】Please refer to the official list of affected versions https://github.com/geoserver/geoserver/security/advisories/GHSA-fjf5-xgmq-5525
【CVE-2018-4063】 Sierra Wireless AirLink ES450 FW 4.9.3
【CVE-2025-14174】 Please refer to the official list of affected versions: https://learn.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security#december-11-2025
[Recommended Actions]
【CVE-2022-37055】 Affected products may have reached End-of-Life (EoL) and/or End-of-Service (EoS) status. Users should stop using these products.
[CVE-2025-66644] Upgrade your product to the following version (or higher): ArrayOS AG 9.4.5.9
[CVE-2025-6218] An official patch update has been released for this vulnerability. Please update to the relevant version: https://www.win-rar.com/singlenewsview.html
[CVE-2025-62221] An official patch update has been released for this vulnerability. Please update to the relevant version: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62221
[CVE-2025-58360] An official patch update has been released for this vulnerability. Please update to the relevant version: https://github.com/geoserver/geoserver/security/advisories/GHSA-fjf5-xgmq-5525 [CVE-2018-4063] Affected products may have reached End-of-Life (EoL) and/or End-of-Service (EoS) status. Users should stop using these products.
[CVE-2025-14174] An official patch update has been released for this vulnerability. Please update to the relevant version: https://learn.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security#december-11-2025