Full Width [alt+shift+f] Shortcuts [alt+shift+k]
Sign Up [alt+shift+s] Log In [alt+shift+l]

watchTowr Labs

watchTowr Labs
Backdooring Your Backdoors - Another $20 Domain, More Governments After the excitement of our .MOBI research, we were left twiddling our thumbs. As you may recall, in...
a month ago
42
a month ago
After the excitement of our .MOBI research, we were left twiddling our thumbs. As you may recall, in 2024, we demonstrated the impact of an unregistered domain when we subverted the TLS/SSL CA process for verifying domain ownership to give ourselves the ability to issue valid and...
watchTowr Labs
Do Secure-By-Design Pledges Come With Stickers? - Ivanti Connect Secure RCE (CVE-2025-0282) Did you have a good break? Have you had a chance to breathe? Wake up. It’s 2025, and the chaos...
a month ago
31
a month ago
Did you have a good break? Have you had a chance to breathe? Wake up. It’s 2025, and the chaos continues. Haha, see what we did? We wrote the exact same thing in 2024 because 2024 was exactly the same. As an industry, we are on GroundHog day
watchTowr Labs
Exploitation Walkthrough and Techniques - Ivanti Connect Secure RCE (CVE-2025-0282) As we saw in our previous blogpost, we fully analyzed Ivanti’s most recent unauthenticated Remote...
a month ago
29
a month ago
As we saw in our previous blogpost, we fully analyzed Ivanti’s most recent unauthenticated Remote Code Execution vulnerability in their Connect Secure (VPN) appliance. Specifically, we analyzed CVE-2025-0282. Today, we’re going to walk through exploitation. Once again, however,...
watchTowr Labs
Cleo Harmony, VLTrader, and LexiCom - RCE via Arbitrary File Write (CVE-2024-50623) We were having a nice uneventful week at watchTowr, when we got news of some ransomware operators...
2 months ago
29
2 months ago
We were having a nice uneventful week at watchTowr, when we got news of some ransomware operators using a zero-day exploit in Cleo MFT software - namely, LexiCom, VLTransfer, and Harmony - applications that many large enterprises rely on to share files securely. Cleo have a...
watchTowr Labs
Where There’s Smoke, There’s Fire - Mitel MiCollab CVE-2024-35286, CVE-2024-41713 And An 0day It is not just APTs that like to target telephone systems, but ourselves at watchTowr too. We can't...
2 months ago
22
2 months ago
It is not just APTs that like to target telephone systems, but ourselves at watchTowr too. We can't overstate the consequences of an attacker crossing the boundary from the 'computer system' to the 'telephone system'. We've seen attackers realise this in 2024,
watchTowr Labs
Hop-Skip-FortiJump-FortiJump-Higher - Fortinet FortiManager CVE-2024-47575 It’s been a tricky time for Fortinet (and their customers) lately - arguably, even more so than...
3 months ago
20
3 months ago
It’s been a tricky time for Fortinet (and their customers) lately - arguably, even more so than usual. Adding to the steady flow of vulnerabilities in appliances recently was a nasty CVSS 9.8 vulnerability in FortiManager, their tool for central management of FortiGate...
watchTowr Labs
Pots and Pans, AKA an SSLVPN - Palo Alto PAN-OS CVE-2024-0012 and CVE-2024-9474 It'll be no surprise that 2024, 2023, 2022, and every other year of humanities' existence has been...
3 months ago
16
3 months ago
It'll be no surprise that 2024, 2023, 2022, and every other year of humanities' existence has been tough for SSLVPN appliances. Anyhow, there are new vulnerabilities (well, two of them) that are being exploited in the Palo Alto Networks firewall and SSLVPN offering, and as ever,...
watchTowr Labs
Get FortiRekt, I am the Super_Admin Now - FortiOS Authentication Bypass CVE-2024-55591 Welcome to Monday, and what an excitingly fresh start to the week we're all having. Grab your...
3 weeks ago
15
3 weeks ago
Welcome to Monday, and what an excitingly fresh start to the week we're all having. Grab your coffee, grab your vodka - we're diving into a currently exploited-in-the-wild critical Authentication Bypass affecting foRtinet's (we are returning the misspelling gesture 🥰) flagship...
watchTowr Labs
Visionaries Have Democratised Remote Network Access - Citrix Virtual Apps and Desktops... Well, we’re back again, with yet another fresh-off-the-press bug chain (and associated Interactive...
3 months ago
15
3 months ago
Well, we’re back again, with yet another fresh-off-the-press bug chain (and associated Interactive Artifact Generator). This time, it’s in Citrix’s “Virtual Apps and Desktops” offering. This is a tech stack that enables end-users (and likely, your friendly neighbourhood...
watchTowr Labs
8 Million Requests Later, We Made The SolarWinds Supply Chain Attack Look Amateur Surprise surprise, we've done it again. We've demonstrated an ability to compromise significantly...
2 weeks ago
14
2 weeks ago
Surprise surprise, we've done it again. We've demonstrated an ability to compromise significantly sensitive networks, including governments, militaries, space agencies, cyber security companies, supply chains, software development systems and environments, and more. “Ugh, won’t...
watchTowr Labs
Fortinet FortiGate CVE-2024-23113 - A Super Complex Vulnerability In A Super Secure Appliance In... Today we'd like to share a recent journey into (yet another) SSLVPN appliance vulnerability - a...
4 months ago
12
4 months ago
Today we'd like to share a recent journey into (yet another) SSLVPN appliance vulnerability - a Format String vulnerability, unusually, in Fortinet's FortiGate devices. It affected (before patching) all currently-maintained branches, and recently was highlighted by CISA as...
watchTowr Labs
Auth. Bypass In (Un)Limited Scenarios - Progress MOVEit Transfer (CVE-2024-5806) In the early hours of a day in a month in 2024, watchTowr Labs was sent a chat log: 13:37 -!-...
8 months ago
11
8 months ago
In the early hours of a day in a month in 2024, watchTowr Labs was sent a chat log: 13:37 -!- dav1d_bl41ne [def_not_phalanx@kernel.org] has joined #!hack (irc.efnet.nl) 13:37 -!- dav1d_bl41ne changed the topic of #!hack to: mag1c sh0w
watchTowr Labs
We Spent $20 To Achieve RCE And Accidentally Became The Admins Of .MOBI Welcome back to another watchTowr Labs blog. Brace yourselves, this is one of our most astounding...
5 months ago
10
5 months ago
Welcome back to another watchTowr Labs blog. Brace yourselves, this is one of our most astounding discoveries. Summary What started out as a bit of fun between colleagues while avoiding the Vegas heat and $20 bottles of water in our Black Hat hotel rooms - has now seemingly...
watchTowr Labs
IBM QRadar - When The Attacker Controls Your Security Stack (CVE-2022-26377) Welcome to April 2024. A depressing year so far - we've seen critical vulnerabilities across a wide...
10 months ago
10
10 months ago
Welcome to April 2024. A depressing year so far - we've seen critical vulnerabilities across a wide range of enterprise software stacks. In addition, we've seen surreptitious and patient threat actors light our industry on fire with slowly introduced backdoors in the XZ...
watchTowr Labs
No Way, PHP Strikes Again! (CVE-2024-4577) Orange Tsai tweeted a few hours ago about “One of [his] PHP vulnerabilities, which affects XAMPP by...
8 months ago
9
8 months ago
Orange Tsai tweeted a few hours ago about “One of [his] PHP vulnerabilities, which affects XAMPP by default”, and we were curious to say the least. XAMPP is a very popular way for administrators and developers to rapidly deploy Apache, PHP, and a bunch of other tools, and
watchTowr Labs
Check Point - Wrong Check Point (CVE-2024-24919) Gather round, gather round - it’s time for another blogpost tearing open an SSLVPN appliance and...
8 months ago
8
8 months ago
Gather round, gather round - it’s time for another blogpost tearing open an SSLVPN appliance and laying bare a recent in-the-wild exploited bug. This time, it is Check Point who is the focus of our penetrative gaze. Check Point, for those unaware, is the vendor responsible for...
watchTowr Labs
“To live is to fight, to fight is to live! - IBM ODM Remote Code Execution In previous blogs, we’ve discussed some of the big players in the enterprise software space, but...
a year ago
8
a year ago
In previous blogs, we’ve discussed some of the big players in the enterprise software space, but there is one that we have not mentioned before, that is - quite frankly - the heavy-weight champion of the world in terms of applications for large enterprises. With over a hundred
watchTowr Labs
QNAP QTS - QNAPping At The Wheel (CVE-2024-27130 and friends) Infosec is, at it’s heart, all about that data. Obtaining access to it (or disrupting access to it)...
9 months ago
7
9 months ago
Infosec is, at it’s heart, all about that data. Obtaining access to it (or disrupting access to it) is in every ransomware gang and APT group’s top-10 to-do-list items, and so it makes sense that our research voyage would, at some point, cross paths with products
watchTowr Labs
Veeam Backup & Response - RCE With Auth, But Mostly Without Auth (CVE-2024-40711) Every sysadmin is familiar with Veeam’s enterprise-oriented backup solution, ‘Veeam Backup &...
5 months ago
6
5 months ago
Every sysadmin is familiar with Veeam’s enterprise-oriented backup solution, ‘Veeam Backup & Replication’. Unfortunately, so is every ransomware operator, given it's somewhat 'privileged position' in the storage world of most enterprise's networks. There's no point deploying...
watchTowr Labs
Palo Alto - Putting The Protecc In GlobalProtect (CVE-2024-3400) Welcome to April 2024, again. We’re back, again. Over the weekend, we were all greeted by...
10 months ago
5
10 months ago
Welcome to April 2024, again. We’re back, again. Over the weekend, we were all greeted by now-familiar news—a nation-state was exploiting a “sophisticated” vulnerability for full compromise in yet another enterprise-grade SSLVPN device. We’ve seen all the commentary around the...