{"metadata": {"vulnerability": "cve-2022-3236", "count": 93, "kinds": {"milestone": 7, "sighting": 42, "kev": 11, "other": 33}}, "data": [{"timestamp": "2022-09-17T00:00:00Z", "date_only": false, "value": "2022-09-17T00:00:00.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2022-3236", "field": "cveMetadata.dateReserved"}, {"timestamp": "2022-09-23T00:00:00Z", "date_only": false, "value": "2022-09-23T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2022-3236", "field": "timestamps.asserted_at", "uuid": "4d5683f0-255d-4c9f-b7a9-8d4ea4faae08", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-09-23T00:00:00Z", "date_only": false, "value": "2022-09-23T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "kevintel", "record": "CVE-2022-3236", "field": "timestamps.asserted_at", "uuid": "24b42453-18df-4ed2-86e1-37287fc7c0f3", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-09-23T00:00:00Z", "date_only": true, "value": "2022-09-23", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "cve-2022-3236", "field": "containers.adp.1.metrics.1.other.content.dateAdded"}, {"timestamp": "2022-09-23T00:00:00Z", "date_only": false, "value": "2022-09-23T00:00:00.000Z", "kind": "kev", "label": "Catalog added", "source": "kevintel", "record": "CVE-2022-3236", "field": "evidence.0.details.added_date", "uuid": "24b42453-18df-4ed2-86e1-37287fc7c0f3", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-09-23T00:00:00Z", "date_only": false, "value": "2022-09-23T00:00:00", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-202209-1931", "record": "VAR-202209-1931", "field": "sources_release_date.data.0.date"}, {"timestamp": "2022-09-23T00:00:00Z", "date_only": true, "value": "2022-09-23", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2022-3236", "field": "evidence.0.details.date_added", "uuid": "4d5683f0-255d-4c9f-b7a9-8d4ea4faae08", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-09-23T00:00:00Z", "date_only": false, "value": "2022-09-23T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2022-3236", "field": "timestamps.first_seen_at", "uuid": "4d5683f0-255d-4c9f-b7a9-8d4ea4faae08", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-09-23T00:00:00Z", "date_only": false, "value": "2022-09-23T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "kevintel", "record": "CVE-2022-3236", "field": "timestamps.first_seen_at", "uuid": "24b42453-18df-4ed2-86e1-37287fc7c0f3", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-09-23T00:00:00Z", "date_only": false, "value": "2022-09-23T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2022-3236", "field": "status.status_updated_at", "uuid": "4d5683f0-255d-4c9f-b7a9-8d4ea4faae08", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-09-23T00:00:00Z", "date_only": false, "value": "2022-09-23T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "kevintel", "record": "CVE-2022-3236", "field": "status.status_updated_at", "uuid": "24b42453-18df-4ed2-86e1-37287fc7c0f3", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-09-23T12:50:13Z", "date_only": false, "value": "2022-09-23T12:50:13.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2022-3236", "field": "cveMetadata.datePublished"}, {"timestamp": "2022-09-23T12:50:13Z", "date_only": false, "value": "2022-09-23T12:50:13.000Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Sophos", "record": "cve-2022-3236", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2022-09-23T13:15:00Z", "date_only": false, "value": "2022-09-23T13:15:00Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-JV5X-4HFR-X3P5", "record": "GHSA-JV5X-4HFR-X3P5", "field": "database_specific.nvd_published_at"}, {"timestamp": "2022-09-23T13:15:00Z", "date_only": false, "value": "2022-09-23T13:15Z", "kind": "other", "label": "Published Date", "source": "gsd \u00b7 GSD-2022-3236", "record": "GSD-2022-3236", "field": "namespaces.nvd.nist.gov.publishedDate"}, {"timestamp": "2022-09-23T13:15:10.327Z", "date_only": false, "value": "2022-09-23T13:15:10.327000", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-202209-1931", "record": "VAR-202209-1931", "field": "sources_release_date.data.3.date"}, {"timestamp": "2022-09-23T13:15:10.327Z", "date_only": false, "value": "2022-09-23T13:15:10.327", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2022-3236", "record": "FKIE_CVE-2022-3236", "field": "published"}, {"timestamp": "2022-09-23T16:13:26Z", "date_only": false, "value": "2022-09-23T16:13:26.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cibsecurity/50315", "record": "CVE-2022-3236", "field": "creation_timestamp", "uuid": "bb6295fc-5b1d-446b-bc62-c7ed3b47cd27", "content": "\u203c CVE-2022-3236 \u203c\n\nA code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "url": "https://t.me/cibsecurity/50315"}, {"timestamp": "2022-09-24T07:13:55Z", "date_only": false, "value": "2022-09-24T07:13:55.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/thehackernews/2599", "record": "CVE-2022-3236", "field": "creation_timestamp", "uuid": "05cca1ff-a70d-4d75-9ae6-26197d5b0f42", "content": "Sophos has warned of cyberattacks targeting a recently fixed critical RCE vulnerability (CVE-2022-3236) in its firewall product.\n\nRead: https://thehackernews.com/2022/09/hackers-actively-exploiting-new-sophos.html", "url": "https://t.me/thehackernews/2599"}, {"timestamp": "2022-09-25T00:00:26Z", "date_only": false, "value": "2022-09-25T00:00:26Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-JV5X-4HFR-X3P5", "record": "GHSA-JV5X-4HFR-X3P5", "field": "published"}, {"timestamp": "2022-09-25T11:53:57Z", "date_only": false, "value": "2022-09-25T11:53:57.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/secsocteam/322", "record": "CVE-2022-3236", "field": "creation_timestamp", "uuid": "9aef5399-ebae-4b7e-9959-fa59c6b03084", "content": "\u0627\u0644\u0634\u0631\u0643\u0627\u062a \u0627\u0644\u064a \u0628\u062a\u0633\u062a\u062e\u062f\u0645 Firewall Sophos \u0648 \u0627\u0644\u0640 Frameware \u0628\u062a\u0627\u0639\u0647\u0645 \u0623\u0642\u0644 \u0645\u0646 Firewall v19.0.1 MR1 \u064a\u0639\u0645\u0644\u0648 Updates \u0628\u0633\u0628\u0628 \u0638\u0647\u0648\u0631 \u062b\u063a\u0631\u0629 Zero-Day \u0645\u0646 \u0646\u0648\u0639 RCE \u26a0\ufe0f\n\u0648 \u062a\u0645 \u062a\u0623\u0643\u064a\u062f \u0625\u0633\u062a\u063a\u0644\u0627\u0644 \u0627\u0644\u062b\u063a\u0631\u0629 \u0644\u0628\u0639\u0636 \u0639\u0645\u0644\u0627\u0621 Sophos \u0648 \u0628\u0627\u0644\u0623\u062e\u0635 \u0641\u064a \u062c\u0646\u0648\u0628 \u0622\u0633\u064a\u0627 \u0648 \u0628\u0644\u063a\u062a \u062e\u0637\u0648\u0631\u0629 \u0627\u0644\u062b\u063a\u0631\u0629 9.8 \u0648 \u0631\u0642\u0645\u0647\u0627 CVE-2022-3236 \u26d4\ufe0f\n\n\u0648 \u0627\u0644\u0623\u0641\u0636\u0644 \u0623\u0646\u0643 \u0643\u0640 Network Admin \u062a\u0642\u0641\u0644 \u0627\u0644\u0640 WAN Access \u0648 \u0627\u0644\u0640 WAN Ping \u0644\u0648 \u0645\u0641\u064a\u0634 \u0625\u0633\u062a\u062e\u062f\u0627\u0645 \u0636\u0631\u0648\u0631\u064a \u0644\u064a\u0647\u0645 \u0645\u0646\u0639\u0627\u064b \u0645\u0646 \u0625\u0633\u062a\u063a\u0644\u0627\u0644\u0647\u0645 \u062e\u0635\u0648\u0635\u0627\u064b \u0645\u0639 \u0638\u0647\u0648\u0631 \u062b\u063a\u0631\u0627\u062a Zero-Day \u0644\u0640 Sophos \u062e\u0644\u0627\u0644 \u0627\u0644\u0623\u0634\u0647\u0631 \u0627\u0644\u064a \u0641\u0627\u062a\u062a \ud83d\udc4c\n\n\u0627\u0644\u0645\u0635\u0627\u062f\u0631 \u0644\u0644\u062a\u0641\u0627\u0635\u064a\u0644 \u0623\u0643\u062a\u0631 :\n[1] Sophos :\nhttps://www.sophos.com/en-us/security-advisories/sophos-sa-20220923-sfos-rce\n\n[2] TheHackerNews :\nhttps://thehackernews.com/2022/09/hackers-actively-exploiting-new-sophos.html\n\n#Security_Society", "url": "https://t.me/secsocteam/322"}, {"timestamp": "2022-09-26T00:00:00Z", "date_only": false, "value": "2022-09-26T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2022-AVI-853", "record": "CERTFR-2022-AVI-853", "field": "initial_release_date"}, {"timestamp": "2022-09-26T00:00:00Z", "date_only": false, "value": "2022-09-26T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2022-AVI-853", "record": "CERTFR-2022-AVI-853", "field": "revisions.0.revision_date"}, {"timestamp": "2022-09-26T04:00:00Z", "date_only": false, "value": "2022-09-26T04:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=878", "record": "CVE-2022-3236", "field": "creation_timestamp", "uuid": "61d04db9-4717-42c0-9272-e6564d13f19f", "url": "https://www.govcert.gov.hk/en/alerts_detail.php?id=878"}, {"timestamp": "2022-09-26T13:08:25Z", "date_only": false, "value": "2022-09-26T13:08:25.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/ctinow/65576", "record": "CVE-2022-3236", "field": "creation_timestamp", "uuid": "e0892541-ea35-4b32-ad4a-90c9d6338faf", "content": "RCE in Sophos Firewall is being exploited in the wild (CVE-2022-3236)\n\nhttps://ift.tt/M7wV4v5", "url": "https://t.me/ctinow/65576"}, {"timestamp": "2022-09-26T15:37:03Z", "date_only": false, "value": "2022-09-26T15:37:03.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/true_secator/3466", "record": "CVE-2022-3236", "field": "creation_timestamp", "uuid": "ecd4d9af-db3d-496c-91dd-016e8a8da2c5", "content": "\u0411\u0440\u0438\u0442\u0430\u043d\u0441\u043a\u0430\u044f Sophos \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u0435\u0442 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043e \u043d\u043e\u0432\u043e\u0439 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u043e\u0439 \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0437 \u0435\u0435 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430.\n\n\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044e, \u0432\u0435\u0440\u0441\u0438\u044f 19.0 MR1 (19.0.1) \u0438 \u0431\u043e\u043b\u0435\u0435 \u0440\u0430\u043d\u043d\u0438\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 Sophos Firewall \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a\u00a0CVE-2022-3236 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 9,8). \u041e\u0448\u0438\u0431\u043a\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b User Portal \u0438 Webadmin.\n\n\u0420\u0435\u0441\u0435\u0440\u0447\u0435\u0440\u044b Sophos \u0437\u0430\u044f\u0432\u0438\u043b\u0438, \u0447\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u0445\u043e\u0434\u0435 \u0430\u0442\u0430\u043a \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u044b\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438, \u043f\u0440\u0435\u0438\u043c\u0443\u0449\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e - \u0432 \u042e\u0436\u043d\u043e\u0439 \u0410\u0437\u0438\u0438.\u00a0\u041a\u0430\u0436\u0434\u0443\u044e \u0438\u0437 \u044d\u0442\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u043d\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e.\n\n\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u043c \u0441 \u0431\u043e\u043b\u0435\u0435 \u0440\u0430\u043d\u043d\u0438\u043c\u0438 \u0432\u0435\u0440\u0441\u0438\u044f\u043c\u0438 Sophos Firewall, \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u043f\u0440\u043e\u0438\u0437\u0432\u0435\u0441\u0442\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043b\u044f  \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0445 \u0441\u0440\u0435\u0434\u0441\u0442\u0432 \u0437\u0430\u0449\u0438\u0442\u044b \u0438 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0439.\n\n\u0412 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043e\u0431\u0445\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0443\u0442\u0438 Sophos \u0442\u0430\u043a\u0436\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u043f\u0440\u0438\u043d\u044f\u0442\u044c \u043c\u0435\u0440\u044b \u0434\u043b\u044f \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0442\u043e\u0433\u043e, \u0447\u0442\u043e\u0431\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b \u0431\u0438\u043b \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u043e\u0442 \u0433\u043b\u043e\u0431\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438. \u0414\u043b\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043a\u043e\u043d\u0441\u043e\u043b\u044c Sophos Central \u0438\u043b\u0438 VPN.\n\n\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0438 \u043f\u043e \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0430\u0442\u0447\u0430.\n\n\u0414\u043b\u044f \u043f\u043e\u043d\u0438\u043c\u0430\u043d\u0438\u044f \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u0430 \u0443\u0433\u0440\u043e\u0437, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0438\u0437 \u042f\u043f\u043e\u043d\u0438\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0443 Shodan, \u0441\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0434\u043e 200 000 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 Sophos \u043f\u043e \u0432\u0441\u0435\u043c\u0443 \u043c\u0438\u0440\u0443\u00a0\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u0447\u0435\u0440\u0435\u0437 \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442.\n\n\u041d\u0435\u0443\u0442\u0435\u0448\u0438\u0442\u0435\u043b\u044c\u043d\u0430\u044f \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0430 \u0434\u043b\u044f \u0440\u0435\u0448\u0435\u043d\u0438\u0439 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Sophos, \u0432\u0435\u0434\u044c \u0432\u0442\u043e\u0440\u043e\u0439 \u0440\u0430\u0437 \u0437\u0430 \u0433\u043e\u0434, \u043a\u043e\u0433\u0434\u0430 0-day \u043f\u043e\u0434\u0432\u0435\u0440\u0433\u043b\u0430\u0441\u044c \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u043c \u0430\u0442\u0430\u043a\u0430\u043c.\n\n\u0420\u0430\u043d\u0435\u0435 \u0432 \u043c\u0430\u0440\u0442\u0435 \u044d\u0442\u043e\u0433\u043e \u0433\u043e\u0434\u0430 \u0434\u0440\u0443\u0433\u0430\u044f CVE-2022-1040 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0432 \u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0430 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432 \u044d\u0442\u043e\u043c \u0436\u0435 \u0440\u0435\u0433\u0438\u043e\u043d\u0435. Volexity \u0441\u0432\u044f\u0437\u0430\u043b\u0430 \u0430\u0442\u0430\u043a\u0438 \u0441 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439\u00a0DriftingCloud.\n\n\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u044d\u0442\u043e \u0443\u0436\u0435 \u0447\u0435\u0442\u0432\u0435\u0440\u0442\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0430\u0440\u044f\u0434\u0443 \u0441 CVE-2020-25223 (Sophos SG UTM), CVE-2020-12271 (XG Firewall) \u0438 CVE-2022-1040 \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 Sophos, \u043a\u043e\u0442\u043e\u0440\u0443\u044e CISA \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u0430 \u0432 \u0441\u0432\u043e\u0439 \u043a\u0430\u0442\u0430\u043b\u043e\u0433.\n\n\u041f\u043e\u0445\u043e\u0436\u0435, \u0447\u0442\u043e Sophos \u043d\u0435 \u043e\u0442\u0441\u0442\u0430\u0435\u0442 \u043e\u0442 \u0441\u0432\u043e\u0438\u0445 \u044f\u043f\u043e\u043d\u0441\u043a\u0438\u0445 \u043a\u043e\u043b\u043b\u0435\u0433 \u0438\u0437 Trend Micro \u0441 \u0438\u0445 \u0434\u044b\u0440\u044f\u0432\u044b\u043c\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c\u0438 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0438 \u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0443\u0433\u0440\u043e\u0437, \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043e\u0434\u043d\u0430\u0436\u0434\u044b \u0443\u043a\u0440\u0430\u043b\u0438 \u043b\u0438\u0447\u043d\u0443\u044e \u0438 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u0443 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u0438\u043a\u0438 Mitsubishi Electric.", "url": "https://t.me/true_secator/3466"}, {"timestamp": "2022-09-28T00:00:00Z", "date_only": false, "value": "2022-09-28T00:00:00", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-202209-1931", "record": "VAR-202209-1931", "field": "sources_update_date.data.0.date"}, {"timestamp": "2022-09-28T00:00:00Z", "date_only": true, "value": "2022-09-28", "kind": "other", "label": "Submit Time", "source": "cnvd \u00b7 CNVD-2022-88208", "record": "CNVD-2022-88208", "field": "submitTime"}, {"timestamp": "2022-09-28T19:11:00Z", "date_only": false, "value": "2022-09-28T19:11Z", "kind": "other", "label": "Last Modified Date", "source": "gsd \u00b7 GSD-2022-3236", "record": "GSD-2022-3236", "field": "namespaces.nvd.nist.gov.lastModifiedDate"}, {"timestamp": "2022-09-29T00:00:00Z", "date_only": false, "value": "2022-09-29T00:00:00", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-202209-1931", "record": "VAR-202209-1931", "field": "sources_update_date.data.1.date"}, {"timestamp": "2022-10-08T16:30:47Z", "date_only": false, "value": "2022-10-08T16:30:47.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/MrVGunz/545", "record": "CVE-2022-3236", "field": "creation_timestamp", "uuid": "dcad631b-944b-44be-b464-a686d9d301fb", "content": "\u0634\u0631\u06a9\u062a \u0627\u0645\u0646\u06cc\u062a\u06cc \u0633\u0648\u0641\u0648\u0633 \u062e\u0628\u0631 \u0631\u0641\u0639 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0628\u0627 \u062f\u0631\u062c\u0647 \u0627\u0647\u0645\u06cc\u062a \u062d\u06cc\u0627\u062a\u06cc (CVSS:9.8) \u0648 \u0645\u0628\u062a\u0646\u06cc \u0628\u0631 CVE-2022-3236 \u06a9\u0647 \u0627\u0632 \u0646\u0648\u0639 RCE \u0645\u06cc \u0628\u0627\u0634\u062f \u0631\u0627 \u0628\u0637\u0648\u0631 \u0631\u0633\u0645\u06cc \u0631\u0633\u0627\u0646\u0647 \u0627\u06cc \u06a9\u0631\u062f.\n\n\u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u0631\u06cc \u0628\u0647 \u0645\u0647\u0627\u062c\u0645 \u0627\u06cc\u0646 \u0627\u0645\u06a9\u0627\u0646 \u0631\u0627 \u0645\u06cc \u062f\u0647\u062f \u062a\u0627 \u06a9\u062f \u0645\u062e\u0631\u0628 \u062e\u0648\u062f \u0631\u0627 \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 \u0648 \u0627\u0632 \u0637\u0631\u06cc\u0642 \u0628\u062e\u0634 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631 Webadmin \u0627\u062c\u0631\u0627 \u0646\u0645\u0627\u06cc\u062f.\n\u062f\u0631 \u0635\u0648\u0631\u062a\u06cc \u06a9\u0647 \u0627\u0632 \u062a\u062c\u0647\u06cc\u0632\u0627\u062a \u0628\u0627 \u0646\u0633\u062e\u0647 \u0646\u0631\u0645 \u0627\u0641\u0632\u0627\u0631\u06cc v19.0 MR1 \u0628\u0647 \u0642\u0628\u0644 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc \u0646\u0645\u0627\u06cc\u062f\u060c \u062d\u062a\u0645\u0627 \u062f\u0631 \u0627\u0633\u0631\u0639 \u0648\u0642\u062a \u0628\u0631\u0648\u0632 \u0631\u0633\u0627\u0646\u06cc \u0631\u0627 \u062f\u0631 \u0627\u0648\u0644\u0648\u06cc\u062a \u0642\u0631\u0627\u0631 \u062f\u0647\u06cc\u062f.\n\u0627\u06cc\u0646 \u062f\u0648\u0645\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u062d\u06cc\u0627\u062a\u06cc \u0627\u06cc\u0646 \u0634\u0631\u06a9\u062a \u062f\u0631 \u0633\u0627\u0644 \u062c\u0627\u0631\u06cc \u0645\u06cc\u0644\u0627\u062f\u06cc \u0627\u0633\u062a \u06a9\u0647 \u0628\u0627 \u062a\u0648\u062c\u0647 \u0628\u0647 \u0627\u0639\u0644\u0627\u0646 CISA \u062f\u0631 \u0644\u06cc\u0633\u062a \u062d\u0645\u0644\u0627\u062a \u062c\u062f\u06cc \u0641\u0639\u0627\u0644 \u0642\u0631\u0627\u0631 \u06af\u0631\u0641\u062a\u0647 \u0627\u0633\u062a.(\u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0642\u0628\u0644\u06cc \u062f\u0631 \u0645\u0627\u0647 \u0645\u0627\u0631\u0633 \u0631\u0633\u0627\u0646\u0647 \u0627\u06cc \u0634\u062f.)\n\u062c\u0632\u0626\u06cc\u0627\u062a \u06a9\u0627\u0645\u0644: https://bit.ly/SopoRCE2", "url": "https://t.me/MrVGunz/545"}, {"timestamp": "2022-10-14T00:00:00Z", "date_only": true, "value": "2022-10-14", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2022-3236", "field": "evidence.0.details.due_date", "uuid": "4d5683f0-255d-4c9f-b7a9-8d4ea4faae08", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2022-10-25T18:57:44Z", "date_only": false, "value": "2022-10-25T18:57:44.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/3120", "record": "CVE-2022-3236", "field": "creation_timestamp", "uuid": "a0e36936-673b-438b-8c14-f5725f49159d", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aanalyze and PoC for sophos userportal and webadmin (CVE-2022-3236) RCE\nURL\uff1ahttps://github.com/Ha110w/CVE-2022-3236-RCE-POC\n\n\u6807\u7b7e\uff1a#CVE-2022", "url": "https://t.me/GithubRedTeam/3120"}, {"timestamp": "2022-11-01T11:01:02Z", "date_only": false, "value": "2022-11-01T11:01:02.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityTechnologies/7085", "record": "CVE-2022-3236", "field": "creation_timestamp", "uuid": "333a6bcc-a094-4d32-9963-c919036c2675", "content": "#exploit\n1. CVE-2021-39144:\nVMware Cloud Foundation RCE vulnerability via XStream\nhttps://github.com/b3wT/CVE-2021-39144-XSTREAM-RCE\n\n2. CVE-2022-3236:\nSophos Firewall User Portal and Web Admin Code Injection\nhttps://www.zerodayinitiative.com/blog/2022/10/19/cve-2022-3236-sophos-firewall-user-portal-and-web-admin-code-injection", "url": "https://t.me/CyberSecurityTechnologies/7085"}, {"timestamp": "2022-12-01T23:00:00Z", "date_only": false, "value": "2022-12-01T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-2217", "record": "WID-SEC-W-2022-2217", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2022-12-01T23:00:00Z", "date_only": false, "value": "2022-12-01T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-2217", "record": "WID-SEC-W-2022-2217", "field": "document.tracking.initial_release_date"}, {"timestamp": "2022-12-01T23:00:00Z", "date_only": false, "value": "2022-12-01T23:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-2217", "record": "WID-SEC-W-2022-2217", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2022-12-05T00:00:00Z", "date_only": false, "value": "2022-12-05T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2022-AVI-1077", "record": "CERTFR-2022-AVI-1077", "field": "last_revision_date"}, {"timestamp": "2022-12-05T00:00:00Z", "date_only": false, "value": "2022-12-05T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2022-AVI-1077", "record": "CERTFR-2022-AVI-1077", "field": "initial_release_date"}, {"timestamp": "2022-12-05T00:00:00Z", "date_only": false, "value": "2022-12-05T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2022-AVI-1077", "record": "CERTFR-2022-AVI-1077", "field": "revisions.0.revision_date"}, {"timestamp": "2022-12-07T10:30:06Z", "date_only": false, "value": "2022-12-07T10:30:06.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/true_secator/3794", "record": "CVE-2022-3236", "field": "creation_timestamp", "uuid": "f7ea3162-02c0-4d2d-bf8a-64309417b725", "content": "Sophos \u043f\u0440\u043e\u0438\u043d\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u0432 Sophos Firewall \u0432\u0435\u0440\u0441\u0438\u0438 19.5 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0442\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a RCE.\n\n\u0412 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a \u0443\u043b\u0443\u0447\u0448\u0435\u043d\u0438\u044f\u043c \u043e\u0442\u043a\u0430\u0437\u043e\u0443\u0441\u0442\u043e\u0439\u0447\u0438\u0432\u043e\u0441\u0442\u0438 \u0438 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044e \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438\u00a0\u043f\u043e\u0441\u043b\u0435\u0434\u043d\u044f\u044f \u0432\u0435\u0440\u0441\u0438\u044f Sophos Firewall\u00a0 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442\u00a0\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0441\u0435\u043c\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439.\n\n\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044e, \u043e\u0434\u043d\u043e\u0439 \u0438\u0437 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 19.5 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f CVE-2022-3236, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0438\u043c\u0435\u0435\u0442 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u043e\u0446\u0435\u043d\u043a\u0443 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438.\n\n\u041e\u0434\u043d\u0430\u043a\u043e \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u043a \u043d\u0435\u043b\u044c\u0437\u044f \u043d\u0430\u0437\u0432\u0430\u0442\u044c \u043d\u043e\u0432\u044b\u043c.\u00a0\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043a\u043b\u0438\u0435\u043d\u0442\u0430\u043c \u043e \u0435\u0433\u043e \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u0438 \u0432 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u0435, \u043a\u043e\u0433\u0434\u0430 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0430, \u0447\u0442\u043e CVE-2022-3236 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0432 \u0430\u0442\u0430\u043a\u0430\u0445, \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043d\u0430 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u044b\u0439 \u043a\u0440\u0443\u0433 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439, \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0445 \u0432 \u042e\u0436\u043d\u043e\u0439 \u0410\u0437\u0438\u0438.\n\n\u0422\u0440\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0432 Sophos Firewall 19.5, \u0438\u043c\u0435\u044e\u0442 \u0432\u044b\u0441\u043e\u043a\u0438\u0439 \u0440\u0435\u0439\u0442\u0438\u043d\u0433 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438, \u0432\u043a\u043b\u044e\u0447\u0430\u044f CVE-2022-3226, \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434 \u041e\u0421, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 SSL VPN.\n\nCVE-2022-3713 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0432 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0435 Wi-Fi, \u0430 \u0442\u0440\u0435\u0442\u044c\u044f \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 CVE-2022-3696 - \u0432 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u043c \u0432\u0435\u0431-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0435, \u043d\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0430 \u0445\u0430\u043a\u0435\u0440\u0443 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430.\n\n\u041e\u0441\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u0442\u0440\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438\u043c\u0435\u044e\u0442 \u0441\u0440\u0435\u0434\u043d\u044e\u044e \u0438\u043b\u0438 \u043d\u0438\u0437\u043a\u0443\u044e \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u044c.\u00a0\u041e\u043d\u0438 \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0442 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 XSS, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438, \u0438 \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u0432\u0430\u044e\u0442 \u043d\u0435\u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0435 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0431\u0430\u0437\u044b \u0434\u0430\u043d\u043d\u044b\u0445 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438.\n\n\u041d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0437 \u044d\u0442\u0438\u0445 \u0431\u0430\u0433 \u0431\u044b\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u0441\u0430\u043c\u043e\u0439 Sophos, \u0432 \u0442\u043e \u0432\u0440\u0435\u043c\u044f \u043a\u0430\u043a \u0434\u0440\u0443\u0433\u0438\u0435 \u0431\u044b\u043b\u0438 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0432\u043d\u0435\u0448\u043d\u0438\u043c\u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 Bug Bounty.\n\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0447\u0430\u0441\u0442\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 Sophos, \u0438 \u0438\u043c\u0435\u044e\u0442 \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0435 \u0447\u0438\u0441\u043b\u043e \u0446\u0435\u043b\u0435\u0439 \u0434\u043b\u044f \u0430\u0442\u0430\u043a, \u0443\u0447\u0438\u0442\u044b\u0432\u0430\u044f \u0438\u0445 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u0432 \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0435.", "url": "https://t.me/true_secator/3794"}, {"timestamp": "2022-12-07T23:00:00Z", "date_only": false, "value": "2022-12-07T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-2217", "record": "WID-SEC-W-2022-2217", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2022-12-07T23:00:00Z", "date_only": false, "value": "2022-12-07T23:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-2217", "record": "WID-SEC-W-2022-2217", "field": "document.tracking.current_release_date"}, {"timestamp": "2022-12-17T00:00:00Z", "date_only": true, "value": "2022-12-17", "kind": "other", "label": "Open Time", "source": "cnvd \u00b7 CNVD-2022-88208", "record": "CNVD-2022-88208", "field": "openTime"}, {"timestamp": "2023-01-18T06:46:21Z", "date_only": false, "value": "2023-01-18T06:46:21.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cKure/10612", "record": "CVE-2022-3236", "field": "creation_timestamp", "uuid": "5f414bff-a19f-4a67-bcf2-828a0387580e", "content": "\u25a0\u25a0\u25a0\u25a1\u25a1 \ud83d\udea8 Over 4,000 Sophos Firewall devices vulnerable to RCE attacks viz. CVE-2022-3236.\n\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-3236\n\nhttps://www.bleepingcomputer.com/news/security/over-4-000-sophos-firewall-devices-vulnerable-to-rce-attacks/", "url": "https://t.me/cKure/10612"}, {"timestamp": "2023-01-19T13:35:02Z", "date_only": false, "value": "2023-01-19T13:35:02.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/xakep_ru/13493", "record": "CVE-2022-3236", "field": "creation_timestamp", "uuid": "08d53e7b-e3ed-45a6-96cb-55724c7a7f8e", "content": "\u0411\u043e\u043b\u0435\u0435 4000 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0432\u0441\u0435 \u0435\u0449\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u043f\u0435\u0440\u0435\u0434 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u043c \u0431\u0430\u0433\u043e\u043c \u0432 Sophos Firewall\n\n\u0421\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438, \u0447\u0442\u043e \u0431\u043e\u043b\u0435\u0435 4000 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 Sophos Firewall, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0435 \u0447\u0435\u0440\u0435\u0437 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442, \u0432\u0441\u0435 \u0435\u0449\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u043f\u0435\u0440\u0435\u0434 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u043c \u0431\u0430\u0433\u043e\u043c, \u043f\u0430\u0442\u0447 \u0434\u043b\u044f \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0432\u044b\u0448\u0435\u043b \u0435\u0449\u0435 \u043e\u0441\u0435\u043d\u044c\u044e 2022 \u0433\u043e\u0434\u0430.\n\nhttps://xakep.ru/2023/01/19/cve-2022-3236-warning/", "url": "https://t.me/xakep_ru/13493"}, {"timestamp": "2023-06-14T21:10:04Z", "date_only": false, "value": "2023-06-14T21:10:04.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "record": "CVE-2022-3236", "field": "creation_timestamp", "uuid": "875dae87-f88d-436f-803d-a73859764d59"}, {"timestamp": "2023-10-17T00:00:00Z", "date_only": false, "value": "2023-10-17T00:00:00", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-202209-1931", "record": "VAR-202209-1931", "field": "sources_release_date.data.2.date"}, {"timestamp": "2023-10-17T08:05:00Z", "date_only": false, "value": "2023-10-17T08:05:00", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-202209-1931", "record": "VAR-202209-1931", "field": "sources_update_date.data.2.date"}, {"timestamp": "2023-12-04T00:19:39Z", "date_only": false, "value": "2023-12-04T00:19:39.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/arpsyndicate/1067", "record": "CVE-2022-3236", "field": "creation_timestamp", "uuid": "bcdb6d82-3c9b-40e3-bc9a-9e26edcfdc99", "content": "#ExploitObserverAlert\n\nCVE-2022-3236\n\nDESCRIPTION: Exploit Observer has 17 entries related to CVE-2022-3236. A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older.\n\nFIRST-EPSS: 0.106520000\nNVD-IS: 5.9\nNVD-ES: 3.9", "url": "https://t.me/arpsyndicate/1067"}, {"timestamp": "2023-12-12T21:27:36Z", "date_only": false, "value": "2023-12-12T21:27:36.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/BleepingComputer/19045", "record": "CVE-2022-3236", "field": "creation_timestamp", "uuid": "26d98a1c-6567-4e37-a718-cef1f0867088", "content": "\u200aSophos backports RCE fix after attacks on unsupported firewalls\n\nSophos was forced to backport a security update for CVE-2022-3236 for end-of-life (EOL) firewall firmware versions after discovering hackers actively exploiting the flaw in attacks. [...]\n\nhttps://www.bleepingcomputer.com/news/security/sophos-backports-rce-fix-after-attacks-on-unsupported-firewalls/", "url": "https://t.me/BleepingComputer/19045"}, {"timestamp": "2023-12-13T00:00:00Z", "date_only": false, "value": "2023-12-13T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2022-AVI-853", "record": "CERTFR-2022-AVI-853", "field": "last_revision_date"}, {"timestamp": "2023-12-13T00:00:00Z", "date_only": false, "value": "2023-12-13T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2022-AVI-853", "record": "CERTFR-2022-AVI-853", "field": "revisions.1.revision_date"}, {"timestamp": "2023-12-13T01:19:39.701Z", "date_only": false, "value": "2023-12-13T01:19:39.701607Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2022-3236", "record": "GSD-2022-3236", "field": "gsd.osvSchema.modified"}, {"timestamp": "2023-12-13T12:02:00Z", "date_only": false, "value": "2023-12-13T12:02:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/ctinow/154801", "record": "CVE-2022-3236", "field": "creation_timestamp", "uuid": "0c32f50d-2cbc-4ede-83b8-769dc474f077", "content": "https://ift.tt/WyDxmAn\nSophos backports fix for CVE-2022-3236 for EOL firewall firmware versions due to ongoing attacks", "url": "https://t.me/ctinow/154801"}, {"timestamp": "2023-12-13T12:12:14Z", "date_only": false, "value": "2023-12-13T12:12:14.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/ctinow/154807", "record": "CVE-2022-3236", "field": "creation_timestamp", "uuid": "3d454bd8-a113-4518-b687-b0fe1c90e53c", "content": "https://ift.tt/Yb18hRj\nEOL Sophos firewalls get hotfix for old but still exploited vulnerability (CVE-2022-3236)", "url": "https://t.me/ctinow/154807"}, {"timestamp": "2023-12-13T15:48:07Z", "date_only": false, "value": "2023-12-13T15:48:07.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/ctinow/154851", "record": "CVE-2022-3236", "field": "creation_timestamp", "uuid": "1be66272-969e-4818-a9f5-772343ba2daa", "content": "https://ift.tt/WyDxmAn\nSophos Backports Fix for CVE-2022-3236 for EOL Firewall Firmware", "url": "https://t.me/ctinow/154851"}, {"timestamp": "2023-12-16T14:50:52Z", "date_only": false, "value": "2023-12-16T14:50:52.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/arpsyndicate/1831", "record": "CVE-2022-3236", "field": "creation_timestamp", "uuid": "6d022ff9-b53e-4e2f-8986-99bdd1195630", "content": "#ExploitObserverAlert\n\nCVE-2022-3236\n\nDESCRIPTION: Exploit Observer has 17 entries related to CVE-2022-3236. A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older.\n\nFIRST-EPSS: 0.106520000\nNVD-IS: 5.9\nNVD-ES: 3.9", "url": "https://t.me/arpsyndicate/1831"}, {"timestamp": "2024-08-03T01:00:10.526Z", "date_only": false, "value": "2024-08-03T01:00:10.526Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "cve-2022-3236", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2024-08-15T17:39:06.888Z", "date_only": false, "value": "2024-08-15T17:39:06.888+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2022-2217", "record": "WID-SEC-W-2022-2217", "field": "document.tracking.generator.date"}, {"timestamp": "2024-11-26T13:40:05Z", "date_only": false, "value": "2024-11-26T13:40:05.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/true_secator/6473", "record": "CVE-2022-3236", "field": "creation_timestamp", "uuid": "e8f0f5aa-65ad-4024-96e8-6fa86ecdbbf2", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 Trend Micro \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u0431\u044d\u043a\u0434\u043e\u0440 GhostSpider, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u0441\u044f Salt Typhoon (Earth Estries, GhostEmperor \u0438\u043b\u0438 UNC2286) \u0432 \u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0430 \u043f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a\u043e\u0432 \u0442\u0435\u043b\u0435\u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0443\u0441\u043b\u0443\u0433.\n\n\u041f\u043e\u043c\u0438\u043c\u043e GhostSpider Salt Typhoon \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043d\u0430\u0431\u043e\u0440 \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0445 \u0438 \u0441\u0442\u0440\u043e\u0433\u0438\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0434\u043b\u044f \u0441\u043b\u043e\u0436\u043d\u044b\u0445 \u043c\u043d\u043e\u0433\u043e\u044d\u0442\u0430\u043f\u043d\u044b\u0445 \u0430\u0442\u0430\u043a: SNAPPYBEE (Deed RAT), SparrowDoor, CrowDoor \u0438 MASOL RAT \u0434\u043b\u044f Linux, \u0440\u0443\u0442\u043a\u0438\u0442 DEMODEX, ShadowPad, NeoReGeorg, frpc\u00a0\u0438 Cobalt Strike.\n\nSalt Typhoon - \u044d\u0442\u043e \u0441\u043b\u043e\u0436\u043d\u0430\u044f \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0430, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u0435\u0442 \u043a\u0430\u043a \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u0441 2019 \u0433\u043e\u0434\u0430 \u0438 \u0442\u0430\u0440\u0433\u0435\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043d\u0430 \u0432\u0437\u043b\u043e\u043c\u0435 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0445 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439 \u0438 \u0442\u0435\u043b\u0435\u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439, \u0441\u0440\u0435\u0434\u0438 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0445 \u0436\u0435\u0440\u0442\u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 Verizon, AT&T, Lumen Technologies \u0438\u00a0T-Mobile.\n\n\u0411\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u043c \u0443\u0441\u043f\u0435\u0448\u043d\u044b\u043c \u0430\u0442\u0430\u043a\u0430\u043c, \u043a\u0430\u043a \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442 Washington Post, Salt Typhoon \u0442\u0430\u043a\u0436\u0435 \u0443\u0434\u0430\u043b\u043e\u0441\u044c\u00a0\u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u043e\u0439 \u043f\u0435\u0440\u0435\u043f\u0438\u0441\u043a\u0435\u00a0\u043a\u0430\u043a \u043c\u0438\u043d\u0438\u043c\u0443\u043c 150 \u0434\u043e\u043b\u0436\u043d\u043e\u0441\u0442\u043d\u044b\u0445 \u043b\u0438\u0446 \u0438\u0437 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0430 \u0421\u0428\u0410 \u0438 \u043f\u043e\u0445\u0438\u0442\u0438\u0442\u044c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0443\u044e \u0441 \u043f\u0440\u043e\u0441\u043b\u0443\u0448\u0438\u0432\u0430\u043d\u0438\u0435\u043c \u0442\u0435\u043b\u0435\u0444\u043e\u043d\u043d\u044b\u0445 \u0440\u0430\u0437\u0433\u043e\u0432\u043e\u0440\u043e\u0432.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c\u00a0Trend Micro, Salt Typhoon \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u043b \u0442\u0435\u043b\u0435\u043a\u043e\u043c, \u0433\u043e\u0441\u0443\u0447\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f, \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0438\u0435, \u043a\u043e\u043d\u0441\u0430\u043b\u0442\u0438\u043d\u0433\u043e\u0432\u044b\u0435, \u0445\u0438\u043c\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0438 \u0442\u0440\u0430\u043d\u0441\u043f\u043e\u0440\u0442\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0432 \u0421\u0428\u0410, \u0410\u0437\u0438\u0430\u0442\u0441\u043a\u043e-\u0422\u0438\u0445\u043e\u043e\u043a\u0435\u0430\u043d\u0441\u043a\u043e\u043c \u0440\u0435\u0433\u0438\u043e\u043d\u0435, \u043d\u0430 \u0411\u043b\u0438\u0436\u043d\u0435\u043c \u0412\u043e\u0441\u0442\u043e\u043a\u0435, \u0432 \u042e\u0436\u043d\u043e\u0439 \u0410\u0444\u0440\u0438\u043a\u0435 \u0438 \u0434\u0440.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0438 \u043d\u0435 \u043c\u0435\u043d\u0435\u0435 \u0434\u0432\u0430\u0434\u0446\u0430\u0442\u0438 \u0441\u043b\u0443\u0447\u0430\u0435\u0432, \u043a\u043e\u0433\u0434\u0430 Salt Typhoon \u0443\u0441\u043f\u0435\u0448\u043d\u043e \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043b \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0432\u0430\u0436\u043d\u044b\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438, \u0432\u043a\u043b\u044e\u0447\u0430\u044f, \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u043b\u0443\u0447\u0430\u044f\u0445, \u0438\u0445 \u043f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a\u043e\u0432.\n\n\u0412 \u043e\u0442\u0447\u0435\u0442\u0435 \u043e\u0441\u043e\u0431\u043e\u0435 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u0443\u0434\u0435\u043b\u0435\u043d\u043e \u0434\u0432\u0443\u043c \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044f\u043c: \n- \u0410\u043b\u044c\u0444\u0430, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0442\u0430\u0439\u0432\u0430\u043d\u044c\u0441\u043a\u043e\u0435 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u043e \u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439 \u0445\u0438\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043f\u0440\u043e\u0434\u0443\u043a\u0446\u0438\u0438 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c Demodex \u0438 SnappyBee,\n- \u0411\u0435\u0442\u0430 - \u0434\u043e\u043b\u0433\u043e\u0441\u0440\u043e\u0447\u043d\u044b\u0439 \u0448\u043f\u0438\u043e\u043d\u0430\u0436 \u043f\u0440\u043e\u0442\u0438\u0432 \u0442\u0435\u043b\u0435\u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0438 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439 \u042e\u0433\u043e-\u0412\u043e\u0441\u0442\u043e\u0447\u043d\u043e\u0439 \u0410\u0437\u0438\u0438 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c GhostSpider \u0438 Demodex.\n\n\u041f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u0434\u043e\u0441\u0442\u0438\u0433\u0430\u0435\u0442\u0441\u044f \u043f\u0443\u0442\u0435\u043c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u043a\u043e\u043d\u0435\u0447\u043d\u044b\u0445 \u0442\u043e\u0447\u0435\u043a \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c: CVE-2023-46805, CVE-2024-21887\u00a0(VPN-\u0441\u0435\u0440\u0432\u0438\u0441 Ivanti Connect), CVE-2023-48788 (FortiClient EMS), CVE-2022-3236 (\u0431\u0440\u0430\u043d\u0434\u043c\u0430\u0443\u044d\u0440 Sophos), CVE-2021-26855, CVE-2021-26857 - 26858, CVE-2021-27065 (ProxyLogon).\n\nSalt Typhoon \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b LOLbin \u0434\u043b\u044f \u0441\u0431\u043e\u0440\u0430 \u0440\u0430\u0437\u0432\u0435\u0434\u044b\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0438 \u0433\u043e\u0440\u0438\u0437\u043e\u043d\u0442\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u0435\u0440\u0435\u043c\u0435\u0449\u0435\u043d\u0438\u044f \u043f\u043e \u0441\u0435\u0442\u0438 \u043d\u0430 \u044d\u0442\u0430\u043f\u0435 \u043f\u043e\u0441\u043b\u0435 \u0432\u0437\u043b\u043e\u043c\u0430.\n\n\u0412 \u0441\u0432\u043e\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c, GhostSpider - \u044d\u0442\u043e \u043c\u043e\u0434\u0443\u043b\u044c\u043d\u044b\u0439 \u0431\u044d\u043a\u0434\u043e\u0440, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043d\u044b\u0439 \u0434\u043b\u044f \u0434\u043e\u043b\u0433\u043e\u0441\u0440\u043e\u0447\u043d\u044b\u0445 \u0448\u043f\u0438\u043e\u043d\u0441\u043a\u0438\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439, \u0442\u0440\u0435\u0431\u0443\u044e\u0449\u0438\u0445 \u0432\u044b\u0441\u043e\u043a\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u0441\u043a\u0440\u044b\u0442\u043d\u043e\u0441\u0442\u0438, \u0434\u043e\u0441\u0442\u0438\u0433\u0430\u0435\u043c\u043e\u0433\u043e \u0437\u0430 \u0441\u0447\u0435\u0442 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438 \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u0438\u044f \u0438\u0441\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0432 \u043f\u0430\u043c\u044f\u0442\u0438.\n\n\u041e\u043d \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442\u0441\u044f \u0432 \u0446\u0435\u043b\u0435\u0432\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0430 DLL \u0438 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u0441\u043b\u0443\u0436\u0431\u0430 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u043e\u0433\u043e \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430 regsvr32.exe, \u0432 \u0442\u043e \u0432\u0440\u0435\u043c\u044f \u043a\u0430\u043a \u0432\u0442\u043e\u0440\u0438\u0447\u043d\u044b\u0439 \u043c\u043e\u0434\u0443\u043b\u044c, \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a \u043c\u0430\u044f\u043a\u043e\u0432, \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442 \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u043d\u0435\u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0432 \u043f\u0430\u043c\u044f\u0442\u044c.\n\nGhostSpider \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u043a\u043e\u043c\u0430\u043d\u0434\u044b, \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u044b\u0435 \u043e\u0442 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f (C2), \u0441\u043a\u0440\u044b\u0442\u044b\u0435 \u0432 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0430\u0445 HTTP \u0438\u043b\u0438 \u0444\u0430\u0439\u043b\u0430\u0445 cookie, \u0447\u0442\u043e\u0431\u044b \u0441\u043c\u0435\u0448\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u0441 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u043c \u0442\u0440\u0430\u0444\u0438\u043a\u043e\u043c. \u0421\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430 \u043a\u043e\u043c\u0430\u043d\u0434 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u0431\u044d\u043a\u0434\u043e\u0440\u0443 \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0430\u0442\u0430\u043a\u0443.\n\n\u0412 \u0446\u0435\u043b\u043e\u043c, \u0430\u0440\u0441\u0435\u043d\u0430\u043b Salt Typhoon \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043e\u0431\u0448\u0438\u0440\u0435\u043d \u0438 \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u0438\u0437\u0443\u0435\u0442 \u0435\u0435 \u043a\u0430\u043a \u043e\u0434\u043d\u0443 \u0438\u0437 \u0441\u0430\u043c\u044b\u0445 \u0430\u0433\u0440\u0435\u0441\u0441\u0438\u0432\u043d\u044b\u0445 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0445 APT.", "url": "https://t.me/true_secator/6473"}, {"timestamp": "2024-11-27T08:28:21Z", "date_only": false, "value": "2024-11-27T08:28:21.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/ffea72a3-7935-4078-b769-b872475c5eae", "record": "CVE-2022-3236", "field": "creation_timestamp", "uuid": "28789df5-5986-484c-8ab9-6d12b2ed120d"}, {"timestamp": "2024-12-24T20:33:12.466Z", "date_only": false, "value": "2024-12-24T20:33:12.466950Z", "kind": "sighting", "label": "Seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971718", "record": "CVE-2022-3236", "field": "creation_timestamp", "uuid": "d7b03974-92a2-4b7a-b223-7a9ee7b38dfa", "url": "https://feedsin.space/feed/CISAKevBot/items/2971718"}, {"timestamp": "2025-01-28T21:40:50.761Z", "date_only": false, "value": "2025-01-28T21:40:50.761466Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2022-3236", "field": "containers.adp.1.metrics.0.other.content.timestamp"}, {"timestamp": "2025-01-28T21:40:50.761Z", "date_only": false, "value": "2025-01-28T21:40:50.761466Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2022-3236", "record": "FKIE_CVE-2022-3236", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2025-02-23T02:10:37Z", "date_only": false, "value": "2025-02-23T02:10:37.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "record": "CVE-2022-3236", "field": "creation_timestamp", "uuid": "9f34d5ab-f5ff-493d-a04b-3505a5c8e503"}, {"timestamp": "2025-08-21T02:29:05Z", "date_only": false, "value": "2025-08-21T02:29:05.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/8263fd3f-ae50-413c-8bac-1d69abcdb7bc", "record": "CVE-2022-3236", "field": "creation_timestamp", "uuid": "03b461dc-5998-4481-a7b7-742f0cae057e"}, {"timestamp": "2025-10-22T00:32:36Z", "date_only": false, "value": "2025-10-22T00:32:36Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-JV5X-4HFR-X3P5", "record": "GHSA-JV5X-4HFR-X3P5", "field": "modified"}, {"timestamp": "2025-10-27T17:00:44.353Z", "date_only": false, "value": "2025-10-27T17:00:44.353000", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-202209-1931", "record": "VAR-202209-1931", "field": "sources_update_date.data.3.date"}, {"timestamp": "2025-11-18T15:28:35.157Z", "date_only": false, "value": "2025-11-18T15:28:35.157000Z", "kind": "other", "label": "Last update date", "source": "variot \u00b7 VAR-202209-1931", "record": "VAR-202209-1931", "field": "last_update_date"}, {"timestamp": "2026-02-02T12:27:12.319Z", "date_only": false, "value": "2026-02-02T12:27:12.319058Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ac1aea83-1a83-45f7-aade-1adc8f4588fd", "record": "CVE-2022-3236", "field": "creation_timestamp", "uuid": "97739b6f-d992-4033-aca5-388f7be8faaf", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ac1aea83-1a83-45f7-aade-1adc8f4588fd"}, {"timestamp": "2026-02-02T12:27:12.319Z", "date_only": false, "value": "2026-02-02T12:27:12.319058Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ac1aea83-1a83-45f7-aade-1adc8f4588fd", "record": "CVE-2022-3236", "field": "creation_timestamp", "uuid": "d49a1079-82ad-4d87-9402-794ee23fe3b6", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ac1aea83-1a83-45f7-aade-1adc8f4588fd"}, {"timestamp": "2026-02-02T13:24:01Z", "date_only": false, "value": "2026-02-02T13:24:01+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2022-3236", "field": "timestamps.recorded_at", "uuid": "4d5683f0-255d-4c9f-b7a9-8d4ea4faae08", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-17T04:59:07.653Z", "date_only": false, "value": "2026-06-17T04:59:07.653", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2022-3236", "record": "FKIE_CVE-2022-3236", "field": "lastModified"}, {"timestamp": "2026-06-19T12:47:03.329Z", "date_only": false, "value": "2026-06-19T12:47:03.329947Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/312b1ed8-1507-4ad7-a3cb-40e97328e89a", "record": "CVE-2022-3236", "field": "creation_timestamp", "uuid": "3d822bac-6a0e-46d6-8a48-cdb7fbb6d41b", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/312b1ed8-1507-4ad7-a3cb-40e97328e89a"}, {"timestamp": "2026-06-23T11:11:17Z", "date_only": false, "value": "2026-06-23T11:11:17+00:00", "kind": "kev", "label": "Recorded", "source": "kevintel", "record": "CVE-2022-3236", "field": "timestamps.recorded_at", "uuid": "24b42453-18df-4ed2-86e1-37287fc7c0f3", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-23T11:14:01.097Z", "date_only": false, "value": "2026-06-23T11:14:01.097367Z", "kind": "sighting", "label": "Exploited", "source": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/24b42453-18df-4ed2-86e1-37287fc7c0f3", "record": "CVE-2022-3236", "field": "creation_timestamp", "uuid": "0f4b64ee-66bd-488f-8499-960cce90d0bd", "url": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/24b42453-18df-4ed2-86e1-37287fc7c0f3"}, {"timestamp": "2026-06-23T14:05:33.599Z", "date_only": false, "value": "2026-06-23T14:05:33.599920Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/89065f17-5f53-4aa3-81e0-7f95b2994ac2", "record": "CVE-2022-3236", "field": "creation_timestamp", "uuid": "b8cd1a27-34d9-4dec-b063-3733e329353f", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/89065f17-5f53-4aa3-81e0-7f95b2994ac2"}, {"timestamp": "2026-07-12T22:00:16.174Z", "date_only": false, "value": "2026-07-12T22:00:16.174381Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/pleyades_it/10262", "record": "CVE-2022-3236", "field": "creation_timestamp", "uuid": "9200b5a8-fc69-4284-a600-376ba4a56fbd", "url": "https://t.me/pleyades_it/10262"}, {"timestamp": "2026-07-13T01:00:13.765Z", "date_only": false, "value": "2026-07-13T01:00:13.765245Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/pleyades_it/10262", "record": "CVE-2022-3236", "field": "creation_timestamp", "uuid": "7ac00288-1fa8-441d-a9fd-079b9a3c26a3", "url": "https://t.me/pleyades_it/10262"}, {"timestamp": "2026-07-14T00:00:52.560Z", "date_only": false, "value": "2026-07-14T00:00:52.560122Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/pleyades_it/10262", "record": "CVE-2022-3236", "field": "creation_timestamp", "uuid": "aef90ab7-726f-46be-908c-e8603112465e", "url": "https://t.me/pleyades_it/10262"}, {"timestamp": "2026-07-29T12:00:39.014Z", "date_only": false, "value": "2026-07-29T12:00:39.014431Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CVEhub/10650", "record": "CVE-2022-3236", "field": "creation_timestamp", "uuid": "a47df859-f2d7-4f1f-ac6f-f147ea5c0810", "url": "https://t.me/CVEhub/10650"}, {"timestamp": "2026-07-29T12:01:00.279Z", "date_only": false, "value": "2026-07-29T12:01:00.279086Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CVEhub/2861", "record": "CVE-2022-3236", "field": "creation_timestamp", "uuid": "9bc41c65-8c5b-4f7a-a40d-04b68c617e5c", "url": "https://t.me/CVEhub/2861"}, {"timestamp": "2026-07-30T00:01:07.096Z", "date_only": false, "value": "2026-07-30T00:01:07.096685Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CVEhub/10650", "record": "CVE-2022-3236", "field": "creation_timestamp", "uuid": "340cb96c-2376-451e-8cb2-58f750ed76a9", "url": "https://t.me/CVEhub/10650"}, {"timestamp": "2026-07-30T00:01:38.617Z", "date_only": false, "value": "2026-07-30T00:01:38.617612Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CVEhub/2861", "record": "CVE-2022-3236", "field": "creation_timestamp", "uuid": "1ca5c185-a79f-4421-93be-e552758f1163", "url": "https://t.me/CVEhub/2861"}, {"timestamp": "2026-07-31T06:00:03.992Z", "date_only": false, "value": "2026-07-31T06:00:03.992498Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CVEhub/10650", "record": "CVE-2022-3236", "field": "creation_timestamp", "uuid": "3763c930-2792-41a0-b6c8-48570651faf0", "url": "https://t.me/CVEhub/10650"}, {"timestamp": "2026-08-01T00:00:39.913Z", "date_only": false, "value": "2026-08-01T00:00:39.913533Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CVEhub/10650", "record": "CVE-2022-3236", "field": "creation_timestamp", "uuid": "a7d271bf-0e53-4c9d-825f-bcc5654ce708", "url": "https://t.me/CVEhub/10650"}, {"timestamp": "2026-08-01T03:00:04.406Z", "date_only": false, "value": "2026-08-01T03:00:04.406185Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CVEhub/2861", "record": "CVE-2022-3236", "field": "creation_timestamp", "uuid": "4c15092e-1c41-43a5-af2d-54dd093c4123", "url": "https://t.me/CVEhub/2861"}, {"timestamp": "2026-08-02T00:01:19.654Z", "date_only": false, "value": "2026-08-02T00:01:19.654397Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CVEhub/2861", "record": "CVE-2022-3236", "field": "creation_timestamp", "uuid": "dbb9f604-922d-4974-8767-06e9cd9550ef", "url": "https://t.me/CVEhub/2861"}, {"timestamp": "2026-09-01T17:00:25.445Z", "date_only": false, "value": "2026-09-01T17:00:25.445706Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cissp/6296", "record": "CVE-2022-3236", "field": "creation_timestamp", "uuid": "3ca1ec2f-efa7-4991-94eb-384961415b9b", "url": "https://t.me/cissp/6296"}, {"timestamp": "2026-09-10T06:00:05.749Z", "date_only": false, "value": "2026-09-10T06:00:05.749041Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cissp/6296", "record": "CVE-2022-3236", "field": "creation_timestamp", "uuid": "c536a172-5106-4489-8747-5cd1996989de", "url": "https://t.me/cissp/6296"}, {"timestamp": "2026-10-07T17:39:46.242Z", "date_only": false, "value": "2026-10-07T17:39:46.242Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2022-3236", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-07T17:39:46.242Z", "date_only": false, "value": "2026-10-07T17:39:46.242Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2022-3236", "field": "containers.adp.1.providerMetadata.dateUpdated"}]}