CISA KEV Catalog Update – Part III – February 2023

The US CISA added the following actively exploited flaws to its Known Exploited Vulnerabilities Catalog:

CVE-2022-46169 – Cacti is an open-source platform that provides a robust and extensible operational monitoring and fault management framework for users. The flaw is a command injection vulnerability that can be exploited by an unauthenticated user to execute arbitrary code on a server running Cacti.

CISA orders federal agencies to fix this vulnerability by March 9, 2023.

CVE-2023-21715 – The flaw is a Microsoft Office Publisher security feature bypass vulnerability.

CVE-2023-23376 – The flaw is a Windows common log file system driver elevation of privilege vulnerability. An attacker can exploit this vulnerability to gain SYSTEM privileges.

CVE-2023-21823 – The vulnerability is a Windows Graphics Component remote code execution issue.

The above flaws in Microsoft products have been addressed with the release of Patch Tuesday security updates for February 2023, and CISA orders federal agencies to fix them by March 7, 2023.

CVE-2023-23529 – The vulnerability is the first zeroday of the year. A type confusion issue in WebKit that was addressed by the Apple with improved checks. The flaw impacts iOS, iPadOS, and macOS. An attacker can achieve arbitrary code execution by tricking the victims into visiting maliciously crafted web content. This CISA orders federal agencies to fix this flaw by March 7, 2023