admin

admin

CISA: No Broader Federal Impact from Treasury Cyber Incident; Investigation Continues

Jan 07, 2025
Critical Infrastructure / Cyber Attack

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) announced on Monday that there are no signs indicating the recent cyber attack on the Treasury Department has affected other federal agencies. CISA is collaborating closely with the Treasury Department and BeyondTrust to fully understand the breach and reduce its effects. CISA emphasized, “The security of federal systems and the data they safeguard is crucial to our national security. We are taking proactive measures to prevent any further repercussions and will provide updates as needed.” This statement follows the Treasury Department’s disclosure of being targeted in a “major cybersecurity incident” involving Chinese state-sponsored actors, which enabled remote access to certain computers and unclassified documents. The incident, revealed in early December 2024, stemmed from a breach in BeyondTrust’s systems, allowing adversaries to gain sensitive access.

CISA Reports No Broader Federal Impact from Treasury Cyber Attack; Investigation Continues On January 7, 2025, the Cybersecurity and Infrastructure Security Agency (CISA) announced that the recent cyber breach affecting the Treasury Department does not appear to have compromised other…

CISA Alerts: Active Exploitation of SysAid Vulnerabilities Allows Remote File Access and SSRF

Jul 23, 2025
Vulnerability / Software Security

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two security flaws affecting SysAid IT support software to its Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation. The vulnerabilities are as follows:

  • CVE-2025-2775 (CVSS score: 9.3): This vulnerability involves improper restrictions on XML external entity (XXE) references in the Checkin processing functionality, enabling potential administrator account takeover and file read access.

  • CVE-2025-2776 (CVSS score: 9.3): Similar to the first, this flaw also concerns improper restrictions on XXE references, but it affects the Server URL processing functionality, leading to possible administrator account takeover and file read access.

Both vulnerabilities were disclosed by watchTowr Labs researchers Sina Kheirkhah and Jake Knott in May, along with CVE-2025-2777 (CVSS score: 9.3), which pertains to a pre-authenticated XXE vulnerability within the /lshw endpoint. SysAid has since addressed these issues in their on-premises software.

CISA Alerts: Vulnerabilities in SysAid Software Under Active Attack On July 23, 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) unveiled critical vulnerabilities affecting SysAid, a popular IT support software, highlighting their presence in the agency’s Known Exploited Vulnerabilities…