Taiwan Security Firm Confirms Flaw Flagged by CISA Likely Exploited by Chinese APTs

The Taiwan-based cybersecurity firm TeamT5 has confirmed that the vulnerability added recently by CISA to its Known Exploited Vulnerabilities (KEV) catalog was likely exploited by Chinese threat actors. 

The vulnerability added last week to the CISA KEV list is tracked as CVE-2024-7694 and it allows an attacker with admin privileges to upload malicious files, which can lead to arbitrary command execution on the server. The security hole was fixed in August 2024.

TeamT5’s website indicates that the company’s solutions are used in the United States, Japan, and Taiwan, including by government agencies. This could explain why CISA added the vulnerability to its KEV catalog, instructing government agencies to address it by March 10.

However, TeamT5 told SecurityWeek that the attacks exploiting CVE-2024-7694 occurred in 2024 and only targeted a few of its customers. Affected customers were notified at the time and assisted with patching and mitigations.

The company ...