Zero-day report: June 2023
CISA added 24 exploited vulnerabilities to its catalog in June 2023, 5 more than May (19). 7 were zero-days, listed within a week of going public. 2 are known to be used by ransomware. The most-hit vendor was Samsung, with 6.
By technology
Most-hit vendors
Every flaw added in June 2023
- D-Link · DIR-859 RouterD-Link DIR-859 Router Command Execution Vulnerability
- D-Link · DWL-2600AP Access PointD-Link DWL-2600AP Access Point Command Injection Vulnerability
- Samsung · Mobile DevicesSamsung Mobile Devices Unspecified Vulnerability
- Samsung · Mobile DevicesSamsung Mobile Devices Improper Boundary Check Vulnerability
- Samsung · Mobile DevicesSamsung Mobile Devices Race Condition Vulnerability
- Samsung · Mobile DevicesSamsung Mobile Devices Race Condition Vulnerability
- Samsung · Mobile DevicesSamsung Mobile Devices Out-of-Bounds Read Vulnerability
- Samsung · Mobile DevicesSamsung Mobile Devices Improper Input Validation Vulnerability
- VMware · ToolsVMware Tools Authentication Bypass Vulnerability
- Zyxel · Multiple Network-Attached Storage (NAS) DevicesZyxel Multiple NAS Devices Command Injection Vulnerability
- Apple · Multiple ProductsApple Multiple Products Integer Overflow Vulnerability
- Apple · Multiple ProductsApple Multiple Products WebKit Memory Corruption Vulnerability
- Apple · Multiple ProductsApple Multiple Products WebKit Type Confusion Vulnerability
- Microsoft · Win32kMicrosoft Win32k Privilege Escalation Vulnerability
- Mozilla · Firefox, Firefox ESR, and ThunderbirdMozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability
- Roundcube · Roundcube WebmailRoundcube Webmail Remote Code Execution Vulnerability
- Roundcube · Roundcube WebmailRoundcube Webmail Cross-Site Scripting (XSS) Vulnerability
- Roundcube · Roundcube WebmailRoundcube Webmail SQL Injection Vulnerability
- VMware · Aria Operations for NetworksVmware Aria Operations for Networks Command Injection Vulnerability
- Fortinet · FortiOS and FortiProxy SSL-VPNFortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability
- Google · Chromium V8Google Chromium V8 Type Confusion Vulnerability
- Zyxel · Multiple FirewallsZyxel Multiple Firewalls Buffer Overflow Vulnerability
- Zyxel · Multiple FirewallsZyxel Multiple Firewalls Buffer Overflow Vulnerability
- Progress · MOVEit TransferProgress MOVEit Transfer SQL Injection Vulnerability
Source: CISA's Known Exploited Vulnerabilities catalog, by the date CISA added each flaw. Ransomware use is CISA's flag.