CISA recently updated its Known Exploited Vulnerabilities (KEV) catalog with critical vulnerabilities across GNU Bash, Juniper, Samsung, Jenkins, and Meteobridge products as follows:
- GNU Bash: CVE-2014-6278 is a Shellshock-era OS command injection vulnerability in Bash through version 4.3. It allows crafted environment variables to execute arbitrary commands, still exploitable in embedded and legacy systems.
- Juniper: CVE-2015-7755 involves improper authentication in Juniper ScreenOS, allowing administrative access via SSH/TELNET. It is actively exploited, with a critical impact on Juniper networking devices.
- Samsung: CVE-2025-21043 is an out-of-bounds write flaw in Samsung’s Quram image codec used on mobile devices. This vulnerability was patched after reports of exploitation in the wild. Another Samsung MagicINFO 9 Server flaw (CVE-2025-4632) involves improper pathname limitation allowing arbitrary file write as system authority.
- Jenkins: CVE-2017-1000353: Jenkins deserialization flaw enabling unauthenticated remote code execution, bypassing protections.
- Meteobridge: CVE-2025-4008 is a high-severity command injection vulnerability in the Meteobridge web interface. It allows unauthenticated attackers to execute arbitrary commands with root privileges via a vulnerable CGI script endpoint, requiring urgent patching.
These vulnerabilities highlight critical risks to infrastructure, requiring immediate patching and mitigation to prevent exploitation within enterprise and federal environments.
