ConnectedIO routers impacted by high-severity bugs

Malicious code execution and data compromise are possible with the exploitation of several high-severity bugs impacting ConnectedIO's ER2000 edge routers, The Hacker News reports. Threat actors could chain the vulnerabilities, tracked from CVE-2023-33375 to CVE-2023-33378, to facilitate total cloud infrastructure compromise, remote code execution, and complete data exposure even without direct access to the devices, according to a Claroty report. "These vulnerabilities, if exploited, could pose serious risk for thousands of companies around the world, allowing attackers to disrupt the companies' business and production, along with giving them access to the companies' internal networks," said Claroty researcher Noam Moshe. Moreover, issues in the MQTT communication protocol, including hard-coded authentication credential utilization, could be leveraged by attackers to allow unauthenticated device registrations and MQTT message access. Such a development comes after Synology and Western Digital network-attached storage devices were reported by Claroty to be affected by vulnerabilities that could be exploited to facilitate spoofing and hijacking attacks.