Full Width [alt+shift+f] Shortcuts [alt+shift+k]
Sign Up [alt+shift+s] Log In [alt+shift+l]

watchTowr Labs

watchTowr Labs
Backdooring Your Backdoors - Another $20 Domain, More Governments After the excitement of our .MOBI research, we were left twiddling our thumbs. As you may recall, in...
2 months ago
49
2 months ago
After the excitement of our .MOBI research, we were left twiddling our thumbs. As you may recall, in 2024, we demonstrated the impact of an unregistered domain when we subverted the TLS/SSL CA process for verifying domain ownership to give ourselves the ability to issue valid and...
watchTowr Labs
Do Secure-By-Design Pledges Come With Stickers? - Ivanti Connect Secure RCE (CVE-2025-0282) Did you have a good break? Have you had a chance to breathe? Wake up. It’s 2025, and the chaos...
2 months ago
40
2 months ago
Did you have a good break? Have you had a chance to breathe? Wake up. It’s 2025, and the chaos continues. Haha, see what we did? We wrote the exact same thing in 2024 because 2024 was exactly the same. As an industry, we are on GroundHog day
watchTowr Labs
Exploitation Walkthrough and Techniques - Ivanti Connect Secure RCE (CVE-2025-0282) As we saw in our previous blogpost, we fully analyzed Ivanti’s most recent unauthenticated Remote...
2 months ago
38
2 months ago
As we saw in our previous blogpost, we fully analyzed Ivanti’s most recent unauthenticated Remote Code Execution vulnerability in their Connect Secure (VPN) appliance. Specifically, we analyzed CVE-2025-0282. Today, we’re going to walk through exploitation. Once again, however,...
watchTowr Labs
Cleo Harmony, VLTrader, and LexiCom - RCE via Arbitrary File Write (CVE-2024-50623) We were having a nice uneventful week at watchTowr, when we got news of some ransomware operators...
3 months ago
34
3 months ago
We were having a nice uneventful week at watchTowr, when we got news of some ransomware operators using a zero-day exploit in Cleo MFT software - namely, LexiCom, VLTransfer, and Harmony - applications that many large enterprises rely on to share files securely. Cleo have a...
watchTowr Labs
Get FortiRekt, I am the Super_Admin Now - FortiOS Authentication Bypass CVE-2024-55591 Welcome to Monday, and what an excitingly fresh start to the week we're all having. Grab your...
a month ago
26
a month ago
Welcome to Monday, and what an excitingly fresh start to the week we're all having. Grab your coffee, grab your vodka - we're diving into a currently exploited-in-the-wild critical Authentication Bypass affecting foRtinet's (we are returning the misspelling gesture 🥰) flagship...
watchTowr Labs
Where There’s Smoke, There’s Fire - Mitel MiCollab CVE-2024-35286, CVE-2024-41713 And An 0day It is not just APTs that like to target telephone systems, but ourselves at watchTowr too. We can't...
3 months ago
25
3 months ago
It is not just APTs that like to target telephone systems, but ourselves at watchTowr too. We can't overstate the consequences of an attacker crossing the boundary from the 'computer system' to the 'telephone system'. We've seen attackers realise this in 2024,
watchTowr Labs
8 Million Requests Later, We Made The SolarWinds Supply Chain Attack Look Amateur Surprise surprise, we've done it again. We've demonstrated an ability to compromise significantly...
a month ago
24
a month ago
Surprise surprise, we've done it again. We've demonstrated an ability to compromise significantly sensitive networks, including governments, militaries, space agencies, cyber security companies, supply chains, software development systems and environments, and more. “Ugh, won’t...
watchTowr Labs
Hop-Skip-FortiJump-FortiJump-Higher - Fortinet FortiManager CVE-2024-47575 It’s been a tricky time for Fortinet (and their customers) lately - arguably, even more so than...
4 months ago
22
4 months ago
It’s been a tricky time for Fortinet (and their customers) lately - arguably, even more so than usual. Adding to the steady flow of vulnerabilities in appliances recently was a nasty CVSS 9.8 vulnerability in FortiManager, their tool for central management of FortiGate...
watchTowr Labs
Pots and Pans, AKA an SSLVPN - Palo Alto PAN-OS CVE-2024-0012 and CVE-2024-9474 It'll be no surprise that 2024, 2023, 2022, and every other year of humanities' existence has been...
4 months ago
19
4 months ago
It'll be no surprise that 2024, 2023, 2022, and every other year of humanities' existence has been tough for SSLVPN appliances. Anyhow, there are new vulnerabilities (well, two of them) that are being exploited in the Palo Alto Networks firewall and SSLVPN offering, and as ever,...
watchTowr Labs
Visionaries Have Democratised Remote Network Access - Citrix Virtual Apps and Desktops... Well, we’re back again, with yet another fresh-off-the-press bug chain (and associated Interactive...
4 months ago
18
4 months ago
Well, we’re back again, with yet another fresh-off-the-press bug chain (and associated Interactive Artifact Generator). This time, it’s in Citrix’s “Virtual Apps and Desktops” offering. This is a tech stack that enables end-users (and likely, your friendly neighbourhood...
watchTowr Labs
The Best Security Is When We All Agree To Keep Everything Secret (Except The Secrets) - NAKIVO... As an industry, we believe that we’ve come to a common consensus after 25 years of circular debates...
4 weeks ago
16
4 weeks ago
As an industry, we believe that we’ve come to a common consensus after 25 years of circular debates - disclosure is terrible, information is actually dangerous, it’s best that it’s not shared, and the only way to really to ensure that no one ever
watchTowr Labs
Fortinet FortiGate CVE-2024-23113 - A Super Complex Vulnerability In A Super Secure Appliance In... Today we'd like to share a recent journey into (yet another) SSLVPN appliance vulnerability - a...
5 months ago
13
5 months ago
Today we'd like to share a recent journey into (yet another) SSLVPN appliance vulnerability - a Format String vulnerability, unusually, in Fortinet's FortiGate devices. It affected (before patching) all currently-maintained branches, and recently was highlighted by CISA as...
watchTowr Labs
IBM QRadar - When The Attacker Controls Your Security Stack (CVE-2022-26377) Welcome to April 2024. A depressing year so far - we've seen critical vulnerabilities across a wide...
11 months ago
12
11 months ago
Welcome to April 2024. A depressing year so far - we've seen critical vulnerabilities across a wide range of enterprise software stacks. In addition, we've seen surreptitious and patient threat actors light our industry on fire with slowly introduced backdoors in the XZ...
watchTowr Labs
Auth. Bypass In (Un)Limited Scenarios - Progress MOVEit Transfer (CVE-2024-5806) In the early hours of a day in a month in 2024, watchTowr Labs was sent a chat log: 13:37 -!-...
9 months ago
12
9 months ago
In the early hours of a day in a month in 2024, watchTowr Labs was sent a chat log: 13:37 -!- dav1d_bl41ne [def_not_phalanx@kernel.org] has joined #!hack (irc.efnet.nl) 13:37 -!- dav1d_bl41ne changed the topic of #!hack to: mag1c sh0w
watchTowr Labs
We Spent $20 To Achieve RCE And Accidentally Became The Admins Of .MOBI Welcome back to another watchTowr Labs blog. Brace yourselves, this is one of our most astounding...
6 months ago
12
6 months ago
Welcome back to another watchTowr Labs blog. Brace yourselves, this is one of our most astounding discoveries. Summary What started out as a bit of fun between colleagues while avoiding the Vegas heat and $20 bottles of water in our Black Hat hotel rooms - has now seemingly...
watchTowr Labs
No Way, PHP Strikes Again! (CVE-2024-4577) Orange Tsai tweeted a few hours ago about “One of [his] PHP vulnerabilities, which affects XAMPP by...
9 months ago
11
9 months ago
Orange Tsai tweeted a few hours ago about “One of [his] PHP vulnerabilities, which affects XAMPP by default”, and we were curious to say the least. XAMPP is a very popular way for administrators and developers to rapidly deploy Apache, PHP, and a bunch of other tools, and
watchTowr Labs
“To live is to fight, to fight is to live! - IBM ODM Remote Code Execution In previous blogs, we’ve discussed some of the big players in the enterprise software space, but...
a year ago
10
a year ago
In previous blogs, we’ve discussed some of the big players in the enterprise software space, but there is one that we have not mentioned before, that is - quite frankly - the heavy-weight champion of the world in terms of applications for large enterprises. With over a hundred
watchTowr Labs
Check Point - Wrong Check Point (CVE-2024-24919) Gather round, gather round - it’s time for another blogpost tearing open an SSLVPN appliance and...
10 months ago
9
10 months ago
Gather round, gather round - it’s time for another blogpost tearing open an SSLVPN appliance and laying bare a recent in-the-wild exploited bug. This time, it is Check Point who is the focus of our penetrative gaze. Check Point, for those unaware, is the vendor responsible for...
watchTowr Labs
Bypassing Authentication Like It’s The ‘90s - Pre-Auth RCE Chain(s) in Kentico Xperience CMS I recently joined watchTowr, and it is, therefore, time - time for my first watchTowr Labs blogpost,...
a week ago
9
a week ago
I recently joined watchTowr, and it is, therefore, time - time for my first watchTowr Labs blogpost, previously teased in a tweet of a pre-auth RCE chain affecting some ‘unknown software’. Joining the team, I wanted to maintain the trail of destruction left by the watchTowr Labs...
watchTowr Labs
QNAP QTS - QNAPping At The Wheel (CVE-2024-27130 and friends) Infosec is, at it’s heart, all about that data. Obtaining access to it (or disrupting access to it)...
10 months ago
9
10 months ago
Infosec is, at it’s heart, all about that data. Obtaining access to it (or disrupting access to it) is in every ransomware gang and APT group’s top-10 to-do-list items, and so it makes sense that our research voyage would, at some point, cross paths with products
watchTowr Labs
Veeam Backup & Response - RCE With Auth, But Mostly Without Auth (CVE-2024-40711) Every sysadmin is familiar with Veeam’s enterprise-oriented backup solution, ‘Veeam Backup &...
6 months ago
8
6 months ago
Every sysadmin is familiar with Veeam’s enterprise-oriented backup solution, ‘Veeam Backup & Replication’. Unfortunately, so is every ransomware operator, given it's somewhat 'privileged position' in the storage world of most enterprise's networks. There's no point deploying...
watchTowr Labs
Palo Alto - Putting The Protecc In GlobalProtect (CVE-2024-3400) Welcome to April 2024, again. We’re back, again. Over the weekend, we were all greeted by...
11 months ago
7
11 months ago
Welcome to April 2024, again. We’re back, again. Over the weekend, we were all greeted by now-familiar news—a nation-state was exploiting a “sophisticated” vulnerability for full compromise in yet another enterprise-grade SSLVPN device. We’ve seen all the commentary around the...
watchTowr Labs
By Executive Order, We Are Banning Blacklists - Domain-Level RCE in Veeam Backup & Replication... It’s us again! Once again, we hear the collective groans - but we're back and with yet another...
a week ago
7
a week ago
It’s us again! Once again, we hear the collective groans - but we're back and with yet another merciless pwnage of an inspired and clearly comprehensive RCE solution - no, wait, it's another vuln in yet another backup and replication solution.. While we would