DFIR Lab

[DFIR Lab @DFIR_Lab]

🚨 CRITICAL: CVE-2019-25741 (CVSS 9.8)

Mobatek MobaXterm 12.1 SEH buffer overflow in session files enables remote code execution. Malicious session file imports can trigger reverse shells.

Avoid untrusted .moba files. Update immediately.

#CVE #PatchNow

[DFIR Lab @DFIR_Lab]

🚨 CRITICAL: CVE-2025-67446 (CVSS 9.8)

Neterbit NW-431F Router ≤20241014-IR03 has authentication bypass via predictable cookie manipulation. Attackers can gain full admin access remotely.

Patch immediately if affected.

#CVE #PatchNow #ThreatIntel

[DFIR Lab @DFIR_Lab]

🚨 HIGH SEVERITY: CVE-2026-50213 (CVSS 7.5)

User validation endpoint exposes full profile data via predictable ID enumeration. Network-accessible, no auth required.

Patch immediately or disable /v1/User/validate.

#CVE #Vulnerability #PatchNow #ThreatIntel

[DFIR Lab @DFIR_Lab]

🚨 CRITICAL: CVE-2026-50211 (CVSS 9.8)

Leftover diagnostic software in retail builds exposes internal NVRAM registers to malicious apps with write privileges.

Network exploitable, no user interaction required.

#CVE #Vulnerability #PatchNow #ThreatIntel

[DFIR Lab @DFIR_Lab]

🚨 HIGH: CVE-2026-50210 (CVSS 7.5)

Device uses AES-CBC with static zero-filled IVs, enabling replay attacks & known-plaintext decryption. Network exploitable, no auth required.

Mitigation: Replace with random IVs per encryption operation.

#CVE #Vulnerability

[DFIR Lab @DFIR_Lab]

🚨 HIGH Severity Alert

CVE-2025-13183 | CVSS 7.3
Stored XSS in Hotech Software Otello (v2.4.0 - 2.4.3)

Impact: High confidentiality & integrity risk
Fix: Update to v2.4.4+

#CVE #Vulnerability #PatchNow

[DFIR Lab @DFIR_Lab]

🚨 CRITICAL: CVE-2026-25550 (CVSS 9.8)

Seagull BarTender 2010/2016/2019 - Unauthenticated RCE via .NET Remoting (TCP 7375). Runs as SYSTEM. Patch immediately or disable service.

#CVE #Vulnerability #PatchNow #ThreatIntel #DFIR

[DFIR Lab @DFIR_Lab]

🚨 HIGH severity CVE-2025-14018 (CVSS 7.3)

Unquoted search path vulnerability in NetBT E-Fatura <1.2.15 allows local privilege escalation via DLL hijacking.

Patch to v1.2.15+ immediately.

#CVE #Vulnerability #PatchNow

[DFIR Lab @DFIR_Lab]

Insertion of Sensitive Information Into Sent Data vulnerability in Argus Technology Inc. BILGER allows Choosing Message Identifier.

This issue affects BILGER: before 2.4.9.

[DFIR Lab @DFIR_Lab]

A vulnerability was identified in ealpha072 Student-Management-System up to 01451bd7a2f58cdda07bd0b86e3967582e3ecd08. Affected by this issue is some unknown functionality of the file admin/config.php of the component Administrative Backend. Such manipulation leads to improper authentication. The attack may be performed from remote. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

[DFIR Lab @DFIR_Lab]

Dräger Protector Software prior to version 6.4.2 contains a local privilege escalation vulnerability due to insecure file system permissions that allows local attackers to execute arbitrary code with elevated privileges. Attackers can replace binaries or loaded modules on the host system to execute code with NT SYSTEM privileges.

[DFIR Lab @DFIR_Lab]

Mirasvit Full Page Cache Warmer contains a deserialization of untrusted data vulnerability that could allow unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie.

[DFIR Lab @DFIR_Lab]

PCAP files are the gold standard of network forensics — full packet captures that preserve complete network conversations, including payloads.

Unlike flow records or connection logs, PCAPs capture everything: every byte transmitted, every protocol exchange, every payload. This makes them invaluable for deep-dive investigations into data exfiltration (T1041), command-and-control traffic (T1071), and lateral movement.

Capture methods include tcpdump on Linux/Unix systems, Wireshark for targeted collection, or enterprise-grade network taps and SPAN port configurations. Analysis tools range from Wireshark and tshark for manual inspection to NetworkMiner for automated artifact extraction and Zeek for converting PCAPs into structured logs.

PCAPs enable file carving from network streams, credential harvesting from cleartext protocols (FTP, HTTP Basic Auth, Telnet), malware payload extraction, and full reconstruction of attacker C2 sessions. You can literally replay what happened on the wire.

The tradeoff: storage. A 1 Gbps link generates approximately 450 GB of uncompressed PCAP data per hour. Plan your retention strategy accordingly — many orgs capture selectively at chokepoints or use triggered capture during incidents.

When logs fail you, PCAPs tell the truth.

#DFIR #NetworkForensics

[DFIR Lab @DFIR_Lab]

🚨 CRITICAL: CVE-2026-10880 (CVSS 9.8)

OSNexus QuantaStor SDS Manager SQL injection in login endpoint allows unauthenticated remote attackers to bypass authentication & gain admin access.

Affected: Username field in login
Patch immediately!

#CVE #Vulnerability #PatchNow

[DFIR Lab @DFIR_Lab]

🚨 HIGH SEVERITY: CVE-2025-14101 (CVSS 7.1)

Authorization bypass in PaperWork by GG Soft (v5.2.0.9427 - <6.0). Attackers can exploit trusted identifiers for unauthorized access.

Update to v6.0+ immediately.

#CVE #PatchNow #ThreatIntel

[DFIR Lab @DFIR_Lab]

🚨 HIGH SEVERITY: CVE-2026-10796 (CVSS 7.5)

nvm ≤0.40.4 executes arbitrary commands from malicious mirror version strings. Attackers controlling mirrors or MitM attacks can achieve RCE.

Mitigation: Use default HTTPS mirror, update to patched version

#CVE #Vulnerability

[DFIR Lab @DFIR_Lab]

🚨 HIGH severity CVE-2025-13474 (CVSS 7.5): Authorization bypass in Menulux Mobile App <9.5.8. Allows exploitation via user-controlled keys. Update immediately. #CVE #Vulnerability #PatchNow #ThreatIntel #CyberSecurity

[DFIR Lab @DFIR_Lab]

🚨 HIGH Severity: CVE-2025-69755 (CVSS 8.2)

Neterbit NW-431F Router vulnerable to remote code execution & info disclosure via at_command[.]asp. No authentication required.

Patch immediately if affected.

#CVE #Vulnerability #PatchNow

[DFIR Lab @DFIR_Lab]

🚨 HIGH SEVERITY: CVE-2025-13506 (CVSS 8.8)

Nebim V3 ERP privilege escalation flaw allows attackers to expand control from database to OS. Affects versions 2.0.59 to <3.0.1.

Update to v3.0.1+ immediately.

#CVE #PatchNow #ThreatIntel

[DFIR Lab @DFIR_Lab]

🚨 HIGH severity CVE-2025-67448 (CVSS 7.1): Stored XSS in Neterbit NW-431F Router firmware ≤20241014-IR03. Attackers can execute malicious code via SMS messages. Patch immediately. #CVE #Vulnerability #PatchNow