@blamejs/exceptd-skills 0.15.7 → 0.15.9

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (8) hide show
  1. package/CHANGELOG.md +8 -0
  2. package/data/_indexes/_meta.json +5 -5
  3. package/data/attack-techniques.json +9 -0
  4. package/data/cve-catalog.json +228 -79
  5. package/data/zeroday-lessons.json +580 -188
  6. package/manifest.json +44 -44
  7. package/package.json +1 -1
  8. package/sbom.cdx.json +18 -18
package/data/zeroday-lessons.json CHANGED
@@ -6903,35 +6903,63 @@
6903
6903
  },
6904
6904
  "CVE-2025-29635": {
6905
6905
  "name": "D-Link DIR-823X Command Injection Vulnerability",
6906
- "lesson_date": "2026-05-18",
6906
+ "lesson_date": "2026-05-29",
6907
6907
  "attack_vector": {
6908
- "description": "D-Link DIR-823X contains a command injection vulnerability that allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.",
6909
- "privileges_required": "network attacker (no authentication required)",
6910
- "complexity": "moderate (bulk-import default)",
6911
- "ai_factor": "Bulk-imported — AI-discovery provenance not surfaced in KEV. Detection method that surfaces this class: ADVISORIES_SOURCE (12 primary-source feeds) + CISA-KEV poller. Refine when researcher writeup publishes."
6908
+ "description": "command injection (CWE-77) on the D-Link DIR-823X, giving an unauthenticated attacker command execution on the device. CISA KEV-listed 2026-04-24 with confirmed in-the-wild exploitation.",
6909
+ "privileges_required": "none (unauthenticated network reach to the device/service)",
6910
+ "complexity": "low — KEV-listed, actively exploited; treat as weaponized",
6911
+ "ai_factor": "No AI involvement documented in discovery or weaponization."
6912
+ },
6913
+ "defense_chain": {
6914
+ "prevention": {
6915
+ "what_would_have_worked": "Apply the D-Link firmware fix if available; if the device is end-of-life with no fix, replace it and isolate it from untrusted networks. Consumer routers in this class are common botnet-recruitment targets.",
6916
+ "was_this_required": true,
6917
+ "framework_requiring_it": "CISA BOD 22-01 (KEV remediation)",
6918
+ "adequacy": "Patch/replace is definitive; the gap is that the affected class is internet-exposed by function and (for consumer/EoL devices) often unpatchable, so network isolation is the load-bearing control."
6919
+ },
6920
+ "detection": {
6921
+ "what_would_have_worked": "Monitoring for the router web interface: exploit-shaped requests, device crashes/reboots, malicious firmware, and outbound botnet/C2 traffic from the device.",
6922
+ "was_this_required": false,
6923
+ "framework_requiring_it": null,
6924
+ "adequacy": "Necessary to catch exploitation of devices not yet patched/replaced; edge devices are frequently recruited into botnets."
6925
+ },
6926
+ "response": {
6927
+ "what_would_have_worked": "Patch or replace the device, isolate it from untrusted networks, and rotate any credentials reachable from it; reflash firmware on indicators of a malicious-update compromise.",
6928
+ "was_this_required": true,
6929
+ "framework_requiring_it": "NIST 800-53 IR-4",
6930
+ "adequacy": "Mandatory for a KEV-listed unauthenticated device flaw; firmware implants survive a reboot without a reflash."
6931
+ }
6912
6932
  },
6913
6933
  "framework_coverage": {
6914
6934
  "NIST-800-53-SI-2": {
6915
6935
  "covered": true,
6916
6936
  "adequate": false,
6917
- "gap": "30-day SLA inadequate for KEV-listed actively-exploited CVE; KEV due date is the operational clock."
6937
+ "gap": "The 30-day flaw-remediation SLA is far longer than the observed exploitation window for a KEV-listed unauthenticated network-device/service flaw; CISA KEV due dates are days."
6918
6938
  },
6919
6939
  "ISO-27001-2022-A.8.8": {
6920
6940
  "covered": true,
6921
6941
  "adequate": false,
6922
- "gap": "Standard does not differentiate routinely-disclosed CVE from KEV-listed actively-exploited CVE."
6942
+ "gap": "'Appropriate timescales' is undefined; the standard 30-day reading is unsafe for an unauthenticated, actively-exploited flaw on an internet-facing device — and end-of-life consumer devices have no patch at all, so the only control is replacement/isolation."
6943
+ },
6944
+ "NIS2-Art21-network-security": {
6945
+ "covered": true,
6946
+ "adequate": false,
6947
+ "gap": "Treats the class as essential-function infrastructure but lacks a compressed remediation SLA; consumer/edge devices in particular are routinely internet-exposed and unpatched."
6948
+ },
6949
+ "PCI-DSS-4.0-6.3.3": {
6950
+ "covered": true,
6951
+ "adequate": false,
6952
+ "gap": "The 30-day critical-patch window is exploitation acceptance for an unauthenticated flaw on an internet-facing device in or adjacent to the CDE."
6923
6953
  }
6924
6954
  },
6925
6955
  "compliance_exposure_score": {
6926
- "percent_audit_passing_orgs_still_exposed": 55,
6927
- "basis": "KEV-listed but not yet ransomware-attributed; exposure concentrated in orgs whose patch SLA defaults to NIST 30 days.",
6956
+ "percent_audit_passing_orgs_still_exposed": 72,
6957
+ "basis": "Internet-facing D-Link DIR-823X router is routinely run on a standard patch SLA — or, for consumer/EoL devices, not patched at all — which was active exposure for this KEV-listed, actively-exploited flaw.",
6928
6958
  "theater_pattern": "patch_management"
6929
6959
  },
6930
6960
  "ai_discovered_zeroday": false,
6931
- "ai_discovery_source": "unknown",
6932
- "ai_assist_factor": "none",
6933
- "_auto_imported": true,
6934
- "_intake_method": "v0.13.17-bulk-cisa-kev-import"
6961
+ "ai_discovery_source": "vendor_research",
6962
+ "ai_assist_factor": "none"
6935
6963
  },
6936
6964
  "CVE-2024-7399": {
6937
6965
  "name": "Samsung MagicINFO 9 Server Path Traversal Vulnerability",
@@ -11543,35 +11571,63 @@
11543
11571
  },
11544
11572
  "CVE-2022-20775": {
11545
11573
  "name": "Cisco SD-WAN Path Traversal Vulnerability",
11546
- "lesson_date": "2026-05-18",
11574
+ "lesson_date": "2026-05-29",
11547
11575
  "attack_vector": {
11548
- "description": "Cisco SD-WAN CLI contains a path traversal vulnerability that could allow an authenticated local attacker to gain elevated privileges via improper access controls on commands within the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user.",
11549
- "privileges_required": "network attacker (no authentication required)",
11550
- "complexity": "moderate (bulk-import default)",
11551
- "ai_factor": "Bulk-imported — AI-discovery provenance not surfaced in KEV. Detection method that surfaces this class: ADVISORIES_SOURCE (12 primary-source feeds) + CISA-KEV poller. Refine when researcher writeup publishes."
11576
+ "description": "a path-traversal flaw (CWE-25/CWE-282) reachable by an unauthenticated attacker. CISA KEV-listed 2026-02-25 with confirmed in-the-wild exploitation.",
11577
+ "privileges_required": "none (unauthenticated network reach to the device)",
11578
+ "complexity": "low — KEV-listed, actively exploited; treat as weaponized",
11579
+ "ai_factor": "No AI involvement documented in discovery or weaponization."
11580
+ },
11581
+ "defense_chain": {
11582
+ "prevention": {
11583
+ "what_would_have_worked": "Apply the Cisco SD-WAN fixed release; restrict the management surface to trusted networks.",
11584
+ "was_this_required": true,
11585
+ "framework_requiring_it": "CISA BOD 22-01 (KEV remediation)",
11586
+ "adequacy": "Patch is definitive once applied; the gap is the SLA — a network-device patch cycle (gated on a maintenance window) loses to the KEV-confirmed exploitation window."
11587
+ },
11588
+ "detection": {
11589
+ "what_would_have_worked": "Monitoring on the SD-WAN surface: requests matching the exploited weakness, device crashes/reloads, and unexpected command execution or restricted-endpoint access.",
11590
+ "was_this_required": false,
11591
+ "framework_requiring_it": null,
11592
+ "adequacy": "Necessary to catch exploitation of devices not yet patched within the compressed window."
11593
+ },
11594
+ "response": {
11595
+ "what_would_have_worked": "Patch immediately under the KEV SLA, then investigate for post-exploitation persistence (implants/config changes) and rotate credentials reachable from the SD-WAN surface; on indicators of compromise, follow the vendor's forensic/recovery guidance.",
11596
+ "was_this_required": true,
11597
+ "framework_requiring_it": "NIST 800-53 IR-4",
11598
+ "adequacy": "Mandatory for a KEV-listed unauthenticated device flaw; network-device implants survive patching without explicit recovery steps."
11599
+ }
11552
11600
  },
11553
11601
  "framework_coverage": {
11554
11602
  "NIST-800-53-SI-2": {
11555
11603
  "covered": true,
11556
11604
  "adequate": false,
11557
- "gap": "30-day SLA inadequate for KEV-listed actively-exploited CVE; KEV due date is the operational clock."
11605
+ "gap": "The 30-day flaw-remediation SLA is far longer than the observed exploitation window for a KEV-listed unauthenticated network-device flaw; CISA KEV due dates are days."
11558
11606
  },
11559
11607
  "ISO-27001-2022-A.8.8": {
11560
11608
  "covered": true,
11561
11609
  "adequate": false,
11562
- "gap": "Standard does not differentiate routinely-disclosed CVE from KEV-listed actively-exploited CVE."
11610
+ "gap": "'Appropriate timescales' is undefined; the standard 30-day reading is unsafe for an unauthenticated, actively-exploited flaw on an internet-facing network device."
11611
+ },
11612
+ "NIS2-Art21-network-security": {
11613
+ "covered": true,
11614
+ "adequate": false,
11615
+ "gap": "Treats the device class as essential-function infrastructure but lacks a CISA-KEV-style compressed remediation SLA."
11616
+ },
11617
+ "PCI-DSS-4.0-6.3.3": {
11618
+ "covered": true,
11619
+ "adequate": false,
11620
+ "gap": "The 30-day critical-patch window is exploitation acceptance for an unauthenticated flaw on a perimeter network device in or adjacent to the CDE."
11563
11621
  }
11564
11622
  },
11565
11623
  "compliance_exposure_score": {
11566
- "percent_audit_passing_orgs_still_exposed": 55,
11567
- "basis": "KEV-listed but not yet ransomware-attributed; exposure concentrated in orgs whose patch SLA defaults to NIST 30 days.",
11624
+ "percent_audit_passing_orgs_still_exposed": 70,
11625
+ "basis": "Internet-facing Cisco SD-WAN is routinely run by audited organizations on a standard 30-day patch SLA, which was active exposure for this KEV-listed, actively-exploited flaw.",
11568
11626
  "theater_pattern": "patch_management"
11569
11627
  },
11570
11628
  "ai_discovered_zeroday": false,
11571
- "ai_discovery_source": "unknown",
11572
- "ai_assist_factor": "none",
11573
- "_auto_imported": true,
11574
- "_intake_method": "v0.13.17-bulk-cisa-kev-import"
11629
+ "ai_discovery_source": "vendor_research",
11630
+ "ai_assist_factor": "none"
11575
11631
  },
11576
11632
  "CVE-2026-20127": {
11577
11633
  "name": "Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability",
@@ -13363,35 +13419,63 @@
13363
13419
  },
13364
13420
  "CVE-2025-20393": {
13365
13421
  "name": "Cisco Multiple Products Improper Input Validation Vulnerability",
13366
- "lesson_date": "2026-05-18",
13422
+ "lesson_date": "2026-05-29",
13367
13423
  "attack_vector": {
13368
- "description": "Cisco Secure Email Gateway, Secure Email, AsyncOS Software, and Web Manager appliances contains an improper input validation vulnerability that allows threat actors to execute arbitrary commands with root privileges on the underlying operating system of an affected appliance.",
13369
- "privileges_required": "network attacker (no authentication required)",
13370
- "complexity": "moderate (bulk-import default)",
13371
- "ai_factor": "Bulk-imported — AI-discovery provenance not surfaced in KEV. Detection method that surfaces this class: ADVISORIES_SOURCE (12 primary-source feeds) + CISA-KEV poller. Refine when researcher writeup publishes."
13424
+ "description": "improper input validation (CWE-20) reachable by an unauthenticated attacker. CISA KEV-listed 2025-12-17 with confirmed in-the-wild exploitation.",
13425
+ "privileges_required": "none (unauthenticated network reach to the device)",
13426
+ "complexity": "low — KEV-listed, actively exploited; treat as weaponized",
13427
+ "ai_factor": "No AI involvement documented in discovery or weaponization."
13428
+ },
13429
+ "defense_chain": {
13430
+ "prevention": {
13431
+ "what_would_have_worked": "Apply the Cisco fixed releases for each affected product; restrict management/data interfaces to trusted networks.",
13432
+ "was_this_required": true,
13433
+ "framework_requiring_it": "CISA BOD 22-01 (KEV remediation)",
13434
+ "adequacy": "Patch is definitive once applied; the gap is the SLA — a network-device patch cycle (gated on a maintenance window) loses to the KEV-confirmed exploitation window."
13435
+ },
13436
+ "detection": {
13437
+ "what_would_have_worked": "Monitoring on the Cisco product surface: requests matching the exploited weakness, device crashes/reloads, and unexpected command execution or restricted-endpoint access.",
13438
+ "was_this_required": false,
13439
+ "framework_requiring_it": null,
13440
+ "adequacy": "Necessary to catch exploitation of devices not yet patched within the compressed window."
13441
+ },
13442
+ "response": {
13443
+ "what_would_have_worked": "Patch immediately under the KEV SLA, then investigate for post-exploitation persistence (implants/config changes) and rotate credentials reachable from the Cisco product surface; on indicators of compromise, follow the vendor's forensic/recovery guidance.",
13444
+ "was_this_required": true,
13445
+ "framework_requiring_it": "NIST 800-53 IR-4",
13446
+ "adequacy": "Mandatory for a KEV-listed unauthenticated device flaw; network-device implants survive patching without explicit recovery steps."
13447
+ }
13372
13448
  },
13373
13449
  "framework_coverage": {
13374
13450
  "NIST-800-53-SI-2": {
13375
13451
  "covered": true,
13376
13452
  "adequate": false,
13377
- "gap": "30-day SLA inadequate for KEV-listed actively-exploited CVE; KEV due date is the operational clock."
13453
+ "gap": "The 30-day flaw-remediation SLA is far longer than the observed exploitation window for a KEV-listed unauthenticated network-device flaw; CISA KEV due dates are days."
13378
13454
  },
13379
13455
  "ISO-27001-2022-A.8.8": {
13380
13456
  "covered": true,
13381
13457
  "adequate": false,
13382
- "gap": "Standard does not differentiate routinely-disclosed CVE from KEV-listed actively-exploited CVE."
13458
+ "gap": "'Appropriate timescales' is undefined; the standard 30-day reading is unsafe for an unauthenticated, actively-exploited flaw on an internet-facing network device."
13459
+ },
13460
+ "NIS2-Art21-network-security": {
13461
+ "covered": true,
13462
+ "adequate": false,
13463
+ "gap": "Treats the device class as essential-function infrastructure but lacks a CISA-KEV-style compressed remediation SLA."
13464
+ },
13465
+ "PCI-DSS-4.0-6.3.3": {
13466
+ "covered": true,
13467
+ "adequate": false,
13468
+ "gap": "The 30-day critical-patch window is exploitation acceptance for an unauthenticated flaw on a perimeter network device in or adjacent to the CDE."
13383
13469
  }
13384
13470
  },
13385
13471
  "compliance_exposure_score": {
13386
- "percent_audit_passing_orgs_still_exposed": 55,
13387
- "basis": "KEV-listed but not yet ransomware-attributed; exposure concentrated in orgs whose patch SLA defaults to NIST 30 days.",
13472
+ "percent_audit_passing_orgs_still_exposed": 70,
13473
+ "basis": "Internet-facing Cisco (multiple products) is routinely run by audited organizations on a standard 30-day patch SLA, which was active exposure for this KEV-listed, actively-exploited flaw.",
13388
13474
  "theater_pattern": "patch_management"
13389
13475
  },
13390
13476
  "ai_discovered_zeroday": false,
13391
- "ai_discovery_source": "unknown",
13392
- "ai_assist_factor": "none",
13393
- "_auto_imported": true,
13394
- "_intake_method": "v0.13.17-bulk-cisa-kev-import"
13477
+ "ai_discovery_source": "vendor_research",
13478
+ "ai_assist_factor": "none"
13395
13479
  },
13396
13480
  "CVE-2025-59718": {
13397
13481
  "name": "Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability",
@@ -13615,35 +13699,63 @@
13615
13699
  },
13616
13700
  "CVE-2022-37055": {
13617
13701
  "name": "D-Link Routers Buffer Overflow Vulnerability",
13618
- "lesson_date": "2026-05-18",
13702
+ "lesson_date": "2026-05-29",
13619
13703
  "attack_vector": {
13620
- "description": "D-Link Routers contains a buffer overflow vulnerability that has a high impact on confidentiality, integrity, and availability. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.",
13621
- "privileges_required": "network attacker (no authentication required)",
13622
- "complexity": "moderate (bulk-import default)",
13623
- "ai_factor": "Bulk-imported — AI-discovery provenance not surfaced in KEV. Detection method that surfaces this class: ADVISORIES_SOURCE (12 primary-source feeds) + CISA-KEV poller. Refine when researcher writeup publishes."
13704
+ "description": "a buffer overflow (CWE-120) on affected D-Link routers reachable by an unauthenticated attacker. CISA KEV-listed 2025-12-08 with confirmed in-the-wild exploitation.",
13705
+ "privileges_required": "none (unauthenticated network reach to the device/service)",
13706
+ "complexity": "low — KEV-listed, actively exploited; treat as weaponized",
13707
+ "ai_factor": "No AI involvement documented in discovery or weaponization."
13708
+ },
13709
+ "defense_chain": {
13710
+ "prevention": {
13711
+ "what_would_have_worked": "Apply the D-Link firmware fix or replace the device if end-of-life; do not expose the router management interface to the internet.",
13712
+ "was_this_required": true,
13713
+ "framework_requiring_it": "CISA BOD 22-01 (KEV remediation)",
13714
+ "adequacy": "Patch/replace is definitive; the gap is that the affected class is internet-exposed by function and (for consumer/EoL devices) often unpatchable, so network isolation is the load-bearing control."
13715
+ },
13716
+ "detection": {
13717
+ "what_would_have_worked": "Monitoring for the router web interface: exploit-shaped requests, device crashes/reboots, malicious firmware, and outbound botnet/C2 traffic from the device.",
13718
+ "was_this_required": false,
13719
+ "framework_requiring_it": null,
13720
+ "adequacy": "Necessary to catch exploitation of devices not yet patched/replaced; edge devices are frequently recruited into botnets."
13721
+ },
13722
+ "response": {
13723
+ "what_would_have_worked": "Patch or replace the device, isolate it from untrusted networks, and rotate any credentials reachable from it; reflash firmware on indicators of a malicious-update compromise.",
13724
+ "was_this_required": true,
13725
+ "framework_requiring_it": "NIST 800-53 IR-4",
13726
+ "adequacy": "Mandatory for a KEV-listed unauthenticated device flaw; firmware implants survive a reboot without a reflash."
13727
+ }
13624
13728
  },
13625
13729
  "framework_coverage": {
13626
13730
  "NIST-800-53-SI-2": {
13627
13731
  "covered": true,
13628
13732
  "adequate": false,
13629
- "gap": "30-day SLA inadequate for KEV-listed actively-exploited CVE; KEV due date is the operational clock."
13733
+ "gap": "The 30-day flaw-remediation SLA is far longer than the observed exploitation window for a KEV-listed unauthenticated network-device/service flaw; CISA KEV due dates are days."
13630
13734
  },
13631
13735
  "ISO-27001-2022-A.8.8": {
13632
13736
  "covered": true,
13633
13737
  "adequate": false,
13634
- "gap": "Standard does not differentiate routinely-disclosed CVE from KEV-listed actively-exploited CVE."
13738
+ "gap": "'Appropriate timescales' is undefined; the standard 30-day reading is unsafe for an unauthenticated, actively-exploited flaw on an internet-facing device — and end-of-life consumer devices have no patch at all, so the only control is replacement/isolation."
13739
+ },
13740
+ "NIS2-Art21-network-security": {
13741
+ "covered": true,
13742
+ "adequate": false,
13743
+ "gap": "Treats the class as essential-function infrastructure but lacks a compressed remediation SLA; consumer/edge devices in particular are routinely internet-exposed and unpatched."
13744
+ },
13745
+ "PCI-DSS-4.0-6.3.3": {
13746
+ "covered": true,
13747
+ "adequate": false,
13748
+ "gap": "The 30-day critical-patch window is exploitation acceptance for an unauthenticated flaw on an internet-facing device in or adjacent to the CDE."
13635
13749
  }
13636
13750
  },
13637
13751
  "compliance_exposure_score": {
13638
- "percent_audit_passing_orgs_still_exposed": 55,
13639
- "basis": "KEV-listed but not yet ransomware-attributed; exposure concentrated in orgs whose patch SLA defaults to NIST 30 days.",
13752
+ "percent_audit_passing_orgs_still_exposed": 72,
13753
+ "basis": "Internet-facing D-Link routers is routinely run on a standard patch SLA — or, for consumer/EoL devices, not patched at all — which was active exposure for this KEV-listed, actively-exploited flaw.",
13640
13754
  "theater_pattern": "patch_management"
13641
13755
  },
13642
13756
  "ai_discovered_zeroday": false,
13643
- "ai_discovery_source": "unknown",
13644
- "ai_assist_factor": "none",
13645
- "_auto_imported": true,
13646
- "_intake_method": "v0.13.17-bulk-cisa-kev-import"
13757
+ "ai_discovery_source": "vendor_research",
13758
+ "ai_assist_factor": "none"
13647
13759
  },
13648
13760
  "CVE-2025-66644": {
13649
13761
  "name": "Array Networks ArrayOS AG OS Command Injection Vulnerability",
@@ -15303,35 +15415,63 @@
15303
15415
  },
15304
15416
  "CVE-2025-20352": {
15305
15417
  "name": "Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability",
15306
- "lesson_date": "2026-05-18",
15418
+ "lesson_date": "2026-05-29",
15307
15419
  "attack_vector": {
15308
- "description": "Cisco IOS and IOS XE contains a stack-based buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) subsystem that could allow for denial of service or remote code execution. A successful exploit could allow a low-privileged attacker to cause the affected system to reload, resulting in a DoS condition, or allow a high-privileged attacker to execute arbitrary code as the root user and obtain full control of the affected system.",
15309
- "privileges_required": "network attacker (no authentication required)",
15310
- "complexity": "moderate (bulk-import default)",
15311
- "ai_factor": "Bulk-imported — AI-discovery provenance not surfaced in KEV. Detection method that surfaces this class: ADVISORIES_SOURCE (12 primary-source feeds) + CISA-KEV poller. Refine when researcher writeup publishes."
15420
+ "description": "a stack-based overflow (CWE-121) in the SNMP subsystem, exploitable by an unauthenticated attacker for denial of service and remote code execution. CISA KEV-listed 2025-09-29 with confirmed in-the-wild exploitation.",
15421
+ "privileges_required": "none (unauthenticated network reach to the device)",
15422
+ "complexity": "low — KEV-listed, actively exploited; treat as weaponized",
15423
+ "ai_factor": "No AI involvement documented in discovery or weaponization."
15424
+ },
15425
+ "defense_chain": {
15426
+ "prevention": {
15427
+ "what_would_have_worked": "Apply the Cisco IOS/IOS XE fixed release; restrict SNMP to trusted hosts and disable affected OIDs where the advisory permits, pending the upgrade.",
15428
+ "was_this_required": true,
15429
+ "framework_requiring_it": "CISA BOD 22-01 (KEV remediation)",
15430
+ "adequacy": "Patch is definitive once applied; the gap is the SLA — a network-device patch cycle (gated on a maintenance window) loses to the KEV-confirmed exploitation window."
15431
+ },
15432
+ "detection": {
15433
+ "what_would_have_worked": "Monitoring on the IOS/IOS XE SNMP subsystem: requests matching the exploited weakness, device crashes/reloads, and unexpected command execution or restricted-endpoint access.",
15434
+ "was_this_required": false,
15435
+ "framework_requiring_it": null,
15436
+ "adequacy": "Necessary to catch exploitation of devices not yet patched within the compressed window."
15437
+ },
15438
+ "response": {
15439
+ "what_would_have_worked": "Patch immediately under the KEV SLA, then investigate for post-exploitation persistence (implants/config changes) and rotate credentials reachable from the IOS/IOS XE SNMP subsystem; on indicators of compromise, follow the vendor's forensic/recovery guidance.",
15440
+ "was_this_required": true,
15441
+ "framework_requiring_it": "NIST 800-53 IR-4",
15442
+ "adequacy": "Mandatory for a KEV-listed unauthenticated device flaw; network-device implants survive patching without explicit recovery steps."
15443
+ }
15312
15444
  },
15313
15445
  "framework_coverage": {
15314
15446
  "NIST-800-53-SI-2": {
15315
15447
  "covered": true,
15316
15448
  "adequate": false,
15317
- "gap": "30-day SLA inadequate for KEV-listed actively-exploited CVE; KEV due date is the operational clock."
15449
+ "gap": "The 30-day flaw-remediation SLA is far longer than the observed exploitation window for a KEV-listed unauthenticated network-device flaw; CISA KEV due dates are days."
15318
15450
  },
15319
15451
  "ISO-27001-2022-A.8.8": {
15320
15452
  "covered": true,
15321
15453
  "adequate": false,
15322
- "gap": "Standard does not differentiate routinely-disclosed CVE from KEV-listed actively-exploited CVE."
15454
+ "gap": "'Appropriate timescales' is undefined; the standard 30-day reading is unsafe for an unauthenticated, actively-exploited flaw on an internet-facing network device."
15455
+ },
15456
+ "NIS2-Art21-network-security": {
15457
+ "covered": true,
15458
+ "adequate": false,
15459
+ "gap": "Treats the device class as essential-function infrastructure but lacks a CISA-KEV-style compressed remediation SLA."
15460
+ },
15461
+ "PCI-DSS-4.0-6.3.3": {
15462
+ "covered": true,
15463
+ "adequate": false,
15464
+ "gap": "The 30-day critical-patch window is exploitation acceptance for an unauthenticated flaw on a perimeter network device in or adjacent to the CDE."
15323
15465
  }
15324
15466
  },
15325
15467
  "compliance_exposure_score": {
15326
- "percent_audit_passing_orgs_still_exposed": 55,
15327
- "basis": "KEV-listed but not yet ransomware-attributed; exposure concentrated in orgs whose patch SLA defaults to NIST 30 days.",
15468
+ "percent_audit_passing_orgs_still_exposed": 70,
15469
+ "basis": "Internet-facing Cisco IOS / IOS XE is routinely run by audited organizations on a standard 30-day patch SLA, which was active exposure for this KEV-listed, actively-exploited flaw.",
15328
15470
  "theater_pattern": "patch_management"
15329
15471
  },
15330
15472
  "ai_discovered_zeroday": false,
15331
- "ai_discovery_source": "unknown",
15332
- "ai_assist_factor": "none",
15333
- "_auto_imported": true,
15334
- "_intake_method": "v0.13.17-bulk-cisa-kev-import"
15473
+ "ai_discovery_source": "vendor_research",
15474
+ "ai_assist_factor": "none"
15335
15475
  },
15336
15476
  "CVE-2021-21311": {
15337
15477
  "name": "Adminer Server-Side Request Forgery Vulnerability",
@@ -15367,67 +15507,123 @@
15367
15507
  },
15368
15508
  "CVE-2025-20362": {
15369
15509
  "name": "Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability",
15370
- "lesson_date": "2026-05-18",
15510
+ "lesson_date": "2026-05-29",
15371
15511
  "attack_vector": {
15372
- "description": "Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a missing authorization vulnerability. This vulnerability could be chained with CVE-2025-20333.",
15373
- "privileges_required": "network attacker (no authentication required)",
15374
- "complexity": "moderate (bulk-import default)",
15375
- "ai_factor": "Bulk-imported — AI-discovery provenance not surfaced in KEV. Detection method that surfaces this class: ADVISORIES_SOURCE (12 primary-source feeds) + CISA-KEV poller. Refine when researcher writeup publishes."
15512
+ "description": "a missing-authorization flaw (CWE-862) allowing an unauthenticated attacker to reach restricted URL endpoints (the ASA web-services chain). CISA KEV-listed 2025-09-25 with confirmed in-the-wild exploitation.",
15513
+ "privileges_required": "none (unauthenticated network reach to the device)",
15514
+ "complexity": "low — KEV-listed, actively exploited; treat as weaponized",
15515
+ "ai_factor": "No AI involvement documented in discovery or weaponization."
15516
+ },
15517
+ "defense_chain": {
15518
+ "prevention": {
15519
+ "what_would_have_worked": "Apply the Cisco ASA/FTD fixed release; restrict the management/VPN web surface and, on indicators of compromise, follow Cisco's ArcaneDoor-class forensic guidance.",
15520
+ "was_this_required": true,
15521
+ "framework_requiring_it": "CISA BOD 22-01 (KEV remediation)",
15522
+ "adequacy": "Patch is definitive once applied; the gap is the SLA — a network-device patch cycle (gated on a maintenance window) loses to the KEV-confirmed exploitation window."
15523
+ },
15524
+ "detection": {
15525
+ "what_would_have_worked": "Monitoring on the ASA/FTD web surface: requests matching the exploited weakness, device crashes/reloads, and unexpected command execution or restricted-endpoint access.",
15526
+ "was_this_required": false,
15527
+ "framework_requiring_it": null,
15528
+ "adequacy": "Necessary to catch exploitation of devices not yet patched within the compressed window."
15529
+ },
15530
+ "response": {
15531
+ "what_would_have_worked": "Patch immediately under the KEV SLA, then investigate for post-exploitation persistence (implants/config changes) and rotate credentials reachable from the ASA/FTD web surface; on indicators of compromise, follow the vendor's forensic/recovery guidance.",
15532
+ "was_this_required": true,
15533
+ "framework_requiring_it": "NIST 800-53 IR-4",
15534
+ "adequacy": "Mandatory for a KEV-listed unauthenticated device flaw; network-device implants survive patching without explicit recovery steps."
15535
+ }
15376
15536
  },
15377
15537
  "framework_coverage": {
15378
15538
  "NIST-800-53-SI-2": {
15379
15539
  "covered": true,
15380
15540
  "adequate": false,
15381
- "gap": "30-day SLA inadequate for KEV-listed actively-exploited CVE; KEV due date is the operational clock."
15541
+ "gap": "The 30-day flaw-remediation SLA is far longer than the observed exploitation window for a KEV-listed unauthenticated network-device flaw; CISA KEV due dates are days."
15382
15542
  },
15383
15543
  "ISO-27001-2022-A.8.8": {
15384
15544
  "covered": true,
15385
15545
  "adequate": false,
15386
- "gap": "Standard does not differentiate routinely-disclosed CVE from KEV-listed actively-exploited CVE."
15546
+ "gap": "'Appropriate timescales' is undefined; the standard 30-day reading is unsafe for an unauthenticated, actively-exploited flaw on an internet-facing network device."
15547
+ },
15548
+ "NIS2-Art21-network-security": {
15549
+ "covered": true,
15550
+ "adequate": false,
15551
+ "gap": "Treats the device class as essential-function infrastructure but lacks a CISA-KEV-style compressed remediation SLA."
15552
+ },
15553
+ "PCI-DSS-4.0-6.3.3": {
15554
+ "covered": true,
15555
+ "adequate": false,
15556
+ "gap": "The 30-day critical-patch window is exploitation acceptance for an unauthenticated flaw on a perimeter network device in or adjacent to the CDE."
15387
15557
  }
15388
15558
  },
15389
15559
  "compliance_exposure_score": {
15390
- "percent_audit_passing_orgs_still_exposed": 55,
15391
- "basis": "KEV-listed but not yet ransomware-attributed; exposure concentrated in orgs whose patch SLA defaults to NIST 30 days.",
15560
+ "percent_audit_passing_orgs_still_exposed": 70,
15561
+ "basis": "Internet-facing Cisco Secure Firewall ASA / FTD is routinely run by audited organizations on a standard 30-day patch SLA, which was active exposure for this KEV-listed, actively-exploited flaw.",
15392
15562
  "theater_pattern": "patch_management"
15393
15563
  },
15394
15564
  "ai_discovered_zeroday": false,
15395
- "ai_discovery_source": "unknown",
15396
- "ai_assist_factor": "none",
15397
- "_auto_imported": true,
15398
- "_intake_method": "v0.13.17-bulk-cisa-kev-import"
15565
+ "ai_discovery_source": "vendor_research",
15566
+ "ai_assist_factor": "none"
15399
15567
  },
15400
15568
  "CVE-2025-20333": {
15401
15569
  "name": "Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability",
15402
- "lesson_date": "2026-05-18",
15570
+ "lesson_date": "2026-05-29",
15403
15571
  "attack_vector": {
15404
- "description": "Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Software VPN Web Server contain a buffer overflow vulnerability that allows for remote code execution. This vulnerability could be chained with CVE-2025-20362.",
15405
- "privileges_required": "network attacker (no authentication required)",
15406
- "complexity": "moderate (bulk-import default)",
15407
- "ai_factor": "Bulk-imported — AI-discovery provenance not surfaced in KEV. Detection method that surfaces this class: ADVISORIES_SOURCE (12 primary-source feeds) + CISA-KEV poller. Refine when researcher writeup publishes."
15572
+ "description": "a buffer overflow (CWE-120) enabling unauthenticated remote code execution (chained with the missing-authorization flaw). CISA KEV-listed 2025-09-25 with confirmed in-the-wild exploitation.",
15573
+ "privileges_required": "none (unauthenticated network reach to the device)",
15574
+ "complexity": "low — KEV-listed, actively exploited; treat as weaponized",
15575
+ "ai_factor": "No AI involvement documented in discovery or weaponization."
15408
15576
  },
15409
- "framework_coverage": {
15410
- "NIST-800-53-SI-2": {
15411
- "covered": true,
15412
- "adequate": false,
15413
- "gap": "30-day SLA inadequate for KEV-listed actively-exploited CVE; KEV due date is the operational clock."
15577
+ "defense_chain": {
15578
+ "prevention": {
15579
+ "what_would_have_worked": "Apply the Cisco ASA/FTD fixed release; this is chained for full compromise, so on any indicator treat the appliance as compromised and follow Cisco's forensic/recovery guidance.",
15580
+ "was_this_required": true,
15581
+ "framework_requiring_it": "CISA BOD 22-01 (KEV remediation)",
15582
+ "adequacy": "Patch is definitive once applied; the gap is the SLA — a network-device patch cycle (gated on a maintenance window) loses to the KEV-confirmed exploitation window."
15583
+ },
15584
+ "detection": {
15585
+ "what_would_have_worked": "Monitoring on the ASA/FTD web surface: requests matching the exploited weakness, device crashes/reloads, and unexpected command execution or restricted-endpoint access.",
15586
+ "was_this_required": false,
15587
+ "framework_requiring_it": null,
15588
+ "adequacy": "Necessary to catch exploitation of devices not yet patched within the compressed window."
15589
+ },
15590
+ "response": {
15591
+ "what_would_have_worked": "Patch immediately under the KEV SLA, then investigate for post-exploitation persistence (implants/config changes) and rotate credentials reachable from the ASA/FTD web surface; on indicators of compromise, follow the vendor's forensic/recovery guidance.",
15592
+ "was_this_required": true,
15593
+ "framework_requiring_it": "NIST 800-53 IR-4",
15594
+ "adequacy": "Mandatory for a KEV-listed unauthenticated device flaw; network-device implants survive patching without explicit recovery steps."
15595
+ }
15596
+ },
15597
+ "framework_coverage": {
15598
+ "NIST-800-53-SI-2": {
15599
+ "covered": true,
15600
+ "adequate": false,
15601
+ "gap": "The 30-day flaw-remediation SLA is far longer than the observed exploitation window for a KEV-listed unauthenticated network-device flaw; CISA KEV due dates are days."
15414
15602
  },
15415
15603
  "ISO-27001-2022-A.8.8": {
15416
15604
  "covered": true,
15417
15605
  "adequate": false,
15418
- "gap": "Standard does not differentiate routinely-disclosed CVE from KEV-listed actively-exploited CVE."
15606
+ "gap": "'Appropriate timescales' is undefined; the standard 30-day reading is unsafe for an unauthenticated, actively-exploited flaw on an internet-facing network device."
15607
+ },
15608
+ "NIS2-Art21-network-security": {
15609
+ "covered": true,
15610
+ "adequate": false,
15611
+ "gap": "Treats the device class as essential-function infrastructure but lacks a CISA-KEV-style compressed remediation SLA."
15612
+ },
15613
+ "PCI-DSS-4.0-6.3.3": {
15614
+ "covered": true,
15615
+ "adequate": false,
15616
+ "gap": "The 30-day critical-patch window is exploitation acceptance for an unauthenticated flaw on a perimeter network device in or adjacent to the CDE."
15419
15617
  }
15420
15618
  },
15421
15619
  "compliance_exposure_score": {
15422
- "percent_audit_passing_orgs_still_exposed": 55,
15423
- "basis": "KEV-listed but not yet ransomware-attributed; exposure concentrated in orgs whose patch SLA defaults to NIST 30 days.",
15620
+ "percent_audit_passing_orgs_still_exposed": 70,
15621
+ "basis": "Internet-facing Cisco Secure Firewall ASA / FTD is routinely run by audited organizations on a standard 30-day patch SLA, which was active exposure for this KEV-listed, actively-exploited flaw.",
15424
15622
  "theater_pattern": "patch_management"
15425
15623
  },
15426
15624
  "ai_discovered_zeroday": false,
15427
- "ai_discovery_source": "unknown",
15428
- "ai_assist_factor": "none",
15429
- "_auto_imported": true,
15430
- "_intake_method": "v0.13.17-bulk-cisa-kev-import"
15625
+ "ai_discovery_source": "vendor_research",
15626
+ "ai_assist_factor": "none"
15431
15627
  },
15432
15628
  "CVE-2025-5086": {
15433
15629
  "name": "Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data Vulnerability",
@@ -16007,99 +16203,183 @@
16007
16203
  },
16008
16204
  "CVE-2020-25078": {
16009
16205
  "name": "D-Link DCS-2530L and DCS-2670L Devices Unspecified Vulnerability",
16010
- "lesson_date": "2026-05-18",
16206
+ "lesson_date": "2026-05-29",
16011
16207
  "attack_vector": {
16012
- "description": "D-Link DCS-2530L and DCS-2670L devices contains an unspecified vulnerability that could allow for remote administrator password disclosure. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.",
16013
- "privileges_required": "network attacker (no authentication required)",
16014
- "complexity": "moderate (bulk-import default)",
16015
- "ai_factor": "Bulk-imported — AI-discovery provenance not surfaced in KEV. Detection method that surfaces this class: ADVISORIES_SOURCE (12 primary-source feeds) + CISA-KEV poller. Refine when researcher writeup publishes."
16208
+ "description": "an unauthenticated code-execution flaw (CWE-94) on the D-Link DCS-2530L/2670L network cameras. CISA KEV-listed 2025-08-05 with confirmed in-the-wild exploitation.",
16209
+ "privileges_required": "none (unauthenticated network reach to the device/service)",
16210
+ "complexity": "low — KEV-listed, actively exploited; treat as weaponized",
16211
+ "ai_factor": "No AI involvement documented in discovery or weaponization."
16212
+ },
16213
+ "defense_chain": {
16214
+ "prevention": {
16215
+ "what_would_have_worked": "Apply the D-Link camera firmware fix or replace if end-of-life; place IP cameras on an isolated network segment, never internet-exposed.",
16216
+ "was_this_required": true,
16217
+ "framework_requiring_it": "CISA BOD 22-01 (KEV remediation)",
16218
+ "adequacy": "Patch/replace is definitive; the gap is that the affected class is internet-exposed by function and (for consumer/EoL devices) often unpatchable, so network isolation is the load-bearing control."
16219
+ },
16220
+ "detection": {
16221
+ "what_would_have_worked": "Monitoring for the IP camera web interface: exploit-shaped requests, device crashes/reboots, malicious firmware, and outbound botnet/C2 traffic from the device.",
16222
+ "was_this_required": false,
16223
+ "framework_requiring_it": null,
16224
+ "adequacy": "Necessary to catch exploitation of devices not yet patched/replaced; edge devices are frequently recruited into botnets."
16225
+ },
16226
+ "response": {
16227
+ "what_would_have_worked": "Patch or replace the device, isolate it from untrusted networks, and rotate any credentials reachable from it; reflash firmware on indicators of a malicious-update compromise.",
16228
+ "was_this_required": true,
16229
+ "framework_requiring_it": "NIST 800-53 IR-4",
16230
+ "adequacy": "Mandatory for a KEV-listed unauthenticated device flaw; firmware implants survive a reboot without a reflash."
16231
+ }
16016
16232
  },
16017
16233
  "framework_coverage": {
16018
16234
  "NIST-800-53-SI-2": {
16019
16235
  "covered": true,
16020
16236
  "adequate": false,
16021
- "gap": "30-day SLA inadequate for KEV-listed actively-exploited CVE; KEV due date is the operational clock."
16237
+ "gap": "The 30-day flaw-remediation SLA is far longer than the observed exploitation window for a KEV-listed unauthenticated network-device/service flaw; CISA KEV due dates are days."
16022
16238
  },
16023
16239
  "ISO-27001-2022-A.8.8": {
16024
16240
  "covered": true,
16025
16241
  "adequate": false,
16026
- "gap": "Standard does not differentiate routinely-disclosed CVE from KEV-listed actively-exploited CVE."
16242
+ "gap": "'Appropriate timescales' is undefined; the standard 30-day reading is unsafe for an unauthenticated, actively-exploited flaw on an internet-facing device — and end-of-life consumer devices have no patch at all, so the only control is replacement/isolation."
16243
+ },
16244
+ "NIS2-Art21-network-security": {
16245
+ "covered": true,
16246
+ "adequate": false,
16247
+ "gap": "Treats the class as essential-function infrastructure but lacks a compressed remediation SLA; consumer/edge devices in particular are routinely internet-exposed and unpatched."
16248
+ },
16249
+ "PCI-DSS-4.0-6.3.3": {
16250
+ "covered": true,
16251
+ "adequate": false,
16252
+ "gap": "The 30-day critical-patch window is exploitation acceptance for an unauthenticated flaw on an internet-facing device in or adjacent to the CDE."
16027
16253
  }
16028
16254
  },
16029
16255
  "compliance_exposure_score": {
16030
- "percent_audit_passing_orgs_still_exposed": 55,
16031
- "basis": "KEV-listed but not yet ransomware-attributed; exposure concentrated in orgs whose patch SLA defaults to NIST 30 days.",
16256
+ "percent_audit_passing_orgs_still_exposed": 72,
16257
+ "basis": "Internet-facing D-Link DCS-2530L / DCS-2670L cameras is routinely run on a standard patch SLA — or, for consumer/EoL devices, not patched at all — which was active exposure for this KEV-listed, actively-exploited flaw.",
16032
16258
  "theater_pattern": "patch_management"
16033
16259
  },
16034
16260
  "ai_discovered_zeroday": false,
16035
- "ai_discovery_source": "unknown",
16036
- "ai_assist_factor": "none",
16037
- "_auto_imported": true,
16038
- "_intake_method": "v0.13.17-bulk-cisa-kev-import"
16261
+ "ai_discovery_source": "vendor_research",
16262
+ "ai_assist_factor": "none"
16039
16263
  },
16040
16264
  "CVE-2020-25079": {
16041
16265
  "name": "D-Link DCS-2530L and DCS-2670L Command Injection Vulnerability",
16042
- "lesson_date": "2026-05-18",
16266
+ "lesson_date": "2026-05-29",
16043
16267
  "attack_vector": {
16044
- "description": "D-Link DCS-2530L and DCS-2670L devices contains a command injection vulnerability in the cgi-bin/ddns_enc.cgi. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.",
16045
- "privileges_required": "network attacker (no authentication required)",
16046
- "complexity": "moderate (bulk-import default)",
16047
- "ai_factor": "Bulk-imported — AI-discovery provenance not surfaced in KEV. Detection method that surfaces this class: ADVISORIES_SOURCE (12 primary-source feeds) + CISA-KEV poller. Refine when researcher writeup publishes."
16268
+ "description": "command injection (CWE-77) on the D-Link DCS-2530L/2670L cameras, giving an unauthenticated attacker command execution. CISA KEV-listed 2025-08-05 with confirmed in-the-wild exploitation.",
16269
+ "privileges_required": "none (unauthenticated network reach to the device/service)",
16270
+ "complexity": "low — KEV-listed, actively exploited; treat as weaponized",
16271
+ "ai_factor": "No AI involvement documented in discovery or weaponization."
16272
+ },
16273
+ "defense_chain": {
16274
+ "prevention": {
16275
+ "what_would_have_worked": "Apply the D-Link camera firmware fix or replace if end-of-life; isolate IP cameras from untrusted networks.",
16276
+ "was_this_required": true,
16277
+ "framework_requiring_it": "CISA BOD 22-01 (KEV remediation)",
16278
+ "adequacy": "Patch/replace is definitive; the gap is that the affected class is internet-exposed by function and (for consumer/EoL devices) often unpatchable, so network isolation is the load-bearing control."
16279
+ },
16280
+ "detection": {
16281
+ "what_would_have_worked": "Monitoring for the IP camera web interface: exploit-shaped requests, device crashes/reboots, malicious firmware, and outbound botnet/C2 traffic from the device.",
16282
+ "was_this_required": false,
16283
+ "framework_requiring_it": null,
16284
+ "adequacy": "Necessary to catch exploitation of devices not yet patched/replaced; edge devices are frequently recruited into botnets."
16285
+ },
16286
+ "response": {
16287
+ "what_would_have_worked": "Patch or replace the device, isolate it from untrusted networks, and rotate any credentials reachable from it; reflash firmware on indicators of a malicious-update compromise.",
16288
+ "was_this_required": true,
16289
+ "framework_requiring_it": "NIST 800-53 IR-4",
16290
+ "adequacy": "Mandatory for a KEV-listed unauthenticated device flaw; firmware implants survive a reboot without a reflash."
16291
+ }
16048
16292
  },
16049
16293
  "framework_coverage": {
16050
16294
  "NIST-800-53-SI-2": {
16051
16295
  "covered": true,
16052
16296
  "adequate": false,
16053
- "gap": "30-day SLA inadequate for KEV-listed actively-exploited CVE; KEV due date is the operational clock."
16297
+ "gap": "The 30-day flaw-remediation SLA is far longer than the observed exploitation window for a KEV-listed unauthenticated network-device/service flaw; CISA KEV due dates are days."
16054
16298
  },
16055
16299
  "ISO-27001-2022-A.8.8": {
16056
16300
  "covered": true,
16057
16301
  "adequate": false,
16058
- "gap": "Standard does not differentiate routinely-disclosed CVE from KEV-listed actively-exploited CVE."
16302
+ "gap": "'Appropriate timescales' is undefined; the standard 30-day reading is unsafe for an unauthenticated, actively-exploited flaw on an internet-facing device — and end-of-life consumer devices have no patch at all, so the only control is replacement/isolation."
16303
+ },
16304
+ "NIS2-Art21-network-security": {
16305
+ "covered": true,
16306
+ "adequate": false,
16307
+ "gap": "Treats the class as essential-function infrastructure but lacks a compressed remediation SLA; consumer/edge devices in particular are routinely internet-exposed and unpatched."
16308
+ },
16309
+ "PCI-DSS-4.0-6.3.3": {
16310
+ "covered": true,
16311
+ "adequate": false,
16312
+ "gap": "The 30-day critical-patch window is exploitation acceptance for an unauthenticated flaw on an internet-facing device in or adjacent to the CDE."
16059
16313
  }
16060
16314
  },
16061
16315
  "compliance_exposure_score": {
16062
- "percent_audit_passing_orgs_still_exposed": 55,
16063
- "basis": "KEV-listed but not yet ransomware-attributed; exposure concentrated in orgs whose patch SLA defaults to NIST 30 days.",
16316
+ "percent_audit_passing_orgs_still_exposed": 72,
16317
+ "basis": "Internet-facing D-Link DCS-2530L / DCS-2670L cameras is routinely run on a standard patch SLA — or, for consumer/EoL devices, not patched at all — which was active exposure for this KEV-listed, actively-exploited flaw.",
16064
16318
  "theater_pattern": "patch_management"
16065
16319
  },
16066
16320
  "ai_discovered_zeroday": false,
16067
- "ai_discovery_source": "unknown",
16068
- "ai_assist_factor": "none",
16069
- "_auto_imported": true,
16070
- "_intake_method": "v0.13.17-bulk-cisa-kev-import"
16321
+ "ai_discovery_source": "vendor_research",
16322
+ "ai_assist_factor": "none"
16071
16323
  },
16072
16324
  "CVE-2022-40799": {
16073
16325
  "name": "D-Link DNR-322L Download of Code Without Integrity Check Vulnerability",
16074
- "lesson_date": "2026-05-18",
16326
+ "lesson_date": "2026-05-29",
16075
16327
  "attack_vector": {
16076
- "description": "D-Link DNR-322L contains a download of code without integrity check vulnerability that could allow an authenticated attacker to execute OS level commands on the device. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.",
16077
- "privileges_required": "network attacker (no authentication required)",
16078
- "complexity": "moderate (bulk-import default)",
16079
- "ai_factor": "Bulk-imported — AI-discovery provenance not surfaced in KEV. Detection method that surfaces this class: ADVISORIES_SOURCE (12 primary-source feeds) + CISA-KEV poller. Refine when researcher writeup publishes."
16328
+ "description": "download of code without an integrity check (CWE-494) on the D-Link DNR-322L, letting an attacker supply a malicious update for code execution. CISA KEV-listed 2025-08-05 with confirmed in-the-wild exploitation.",
16329
+ "privileges_required": "none (unauthenticated network reach to the device/service)",
16330
+ "complexity": "low — KEV-listed, actively exploited; treat as weaponized",
16331
+ "ai_factor": "No AI involvement documented in discovery or weaponization."
16332
+ },
16333
+ "defense_chain": {
16334
+ "prevention": {
16335
+ "what_would_have_worked": "Apply the D-Link DNR-322L firmware fix or replace if end-of-life; restrict the NAS management interface and verify update integrity out-of-band.",
16336
+ "was_this_required": true,
16337
+ "framework_requiring_it": "CISA BOD 22-01 (KEV remediation)",
16338
+ "adequacy": "Patch/replace is definitive; the gap is that the affected class is internet-exposed by function and (for consumer/EoL devices) often unpatchable, so network isolation is the load-bearing control."
16339
+ },
16340
+ "detection": {
16341
+ "what_would_have_worked": "Monitoring for the NAS management interface: exploit-shaped requests, device crashes/reboots, malicious firmware, and outbound botnet/C2 traffic from the device.",
16342
+ "was_this_required": false,
16343
+ "framework_requiring_it": null,
16344
+ "adequacy": "Necessary to catch exploitation of devices not yet patched/replaced; edge devices are frequently recruited into botnets."
16345
+ },
16346
+ "response": {
16347
+ "what_would_have_worked": "Patch or replace the device, isolate it from untrusted networks, and rotate any credentials reachable from it; reflash firmware on indicators of a malicious-update compromise.",
16348
+ "was_this_required": true,
16349
+ "framework_requiring_it": "NIST 800-53 IR-4",
16350
+ "adequacy": "Mandatory for a KEV-listed unauthenticated device flaw; firmware implants survive a reboot without a reflash."
16351
+ }
16080
16352
  },
16081
16353
  "framework_coverage": {
16082
16354
  "NIST-800-53-SI-2": {
16083
16355
  "covered": true,
16084
16356
  "adequate": false,
16085
- "gap": "30-day SLA inadequate for KEV-listed actively-exploited CVE; KEV due date is the operational clock."
16357
+ "gap": "The 30-day flaw-remediation SLA is far longer than the observed exploitation window for a KEV-listed unauthenticated network-device/service flaw; CISA KEV due dates are days."
16086
16358
  },
16087
16359
  "ISO-27001-2022-A.8.8": {
16088
16360
  "covered": true,
16089
16361
  "adequate": false,
16090
- "gap": "Standard does not differentiate routinely-disclosed CVE from KEV-listed actively-exploited CVE."
16362
+ "gap": "'Appropriate timescales' is undefined; the standard 30-day reading is unsafe for an unauthenticated, actively-exploited flaw on an internet-facing device — and end-of-life consumer devices have no patch at all, so the only control is replacement/isolation."
16363
+ },
16364
+ "NIS2-Art21-network-security": {
16365
+ "covered": true,
16366
+ "adequate": false,
16367
+ "gap": "Treats the class as essential-function infrastructure but lacks a compressed remediation SLA; consumer/edge devices in particular are routinely internet-exposed and unpatched."
16368
+ },
16369
+ "PCI-DSS-4.0-6.3.3": {
16370
+ "covered": true,
16371
+ "adequate": false,
16372
+ "gap": "The 30-day critical-patch window is exploitation acceptance for an unauthenticated flaw on an internet-facing device in or adjacent to the CDE."
16091
16373
  }
16092
16374
  },
16093
16375
  "compliance_exposure_score": {
16094
- "percent_audit_passing_orgs_still_exposed": 55,
16095
- "basis": "KEV-listed but not yet ransomware-attributed; exposure concentrated in orgs whose patch SLA defaults to NIST 30 days.",
16376
+ "percent_audit_passing_orgs_still_exposed": 72,
16377
+ "basis": "Internet-facing D-Link DNR-322L NAS is routinely run on a standard patch SLA — or, for consumer/EoL devices, not patched at all — which was active exposure for this KEV-listed, actively-exploited flaw.",
16096
16378
  "theater_pattern": "patch_management"
16097
16379
  },
16098
16380
  "ai_discovered_zeroday": false,
16099
- "ai_discovery_source": "unknown",
16100
- "ai_assist_factor": "none",
16101
- "_auto_imported": true,
16102
- "_intake_method": "v0.13.17-bulk-cisa-kev-import"
16381
+ "ai_discovery_source": "vendor_research",
16382
+ "ai_assist_factor": "none"
16103
16383
  },
16104
16384
  "CVE-2023-2533": {
16105
16385
  "name": "PaperCut NG/MF Cross-Site Request Forgery (CSRF) Vulnerability",
@@ -16135,67 +16415,123 @@
16135
16415
  },
16136
16416
  "CVE-2025-20337": {
16137
16417
  "name": "Cisco Identity Services Engine Injection Vulnerability",
16138
- "lesson_date": "2026-05-18",
16418
+ "lesson_date": "2026-05-29",
16139
16419
  "attack_vector": {
16140
- "description": "Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a crafted API request. Successful exploitation could allow an attacker to perform remote code execution and obtaining root privileges on an affected device.",
16141
- "privileges_required": "network attacker (no authentication required)",
16142
- "complexity": "moderate (bulk-import default)",
16143
- "ai_factor": "Bulk-imported — AI-discovery provenance not surfaced in KEV. Detection method that surfaces this class: ADVISORIES_SOURCE (12 primary-source feeds) + CISA-KEV poller. Refine when researcher writeup publishes."
16420
+ "description": "an injection flaw (CWE-74) enabling unauthenticated code execution on Cisco ISE. CISA KEV-listed 2025-07-28 with confirmed in-the-wild exploitation.",
16421
+ "privileges_required": "none (unauthenticated network reach to the device)",
16422
+ "complexity": "low — KEV-listed, actively exploited; treat as weaponized",
16423
+ "ai_factor": "No AI involvement documented in discovery or weaponization."
16424
+ },
16425
+ "defense_chain": {
16426
+ "prevention": {
16427
+ "what_would_have_worked": "Apply the Cisco ISE fixed release; restrict the ISE admin/portal surface to trusted networks and review for unexpected process execution.",
16428
+ "was_this_required": true,
16429
+ "framework_requiring_it": "CISA BOD 22-01 (KEV remediation)",
16430
+ "adequacy": "Patch is definitive once applied; the gap is the SLA — a network-device patch cycle (gated on a maintenance window) loses to the KEV-confirmed exploitation window."
16431
+ },
16432
+ "detection": {
16433
+ "what_would_have_worked": "Monitoring on the ISE surface: requests matching the exploited weakness, device crashes/reloads, and unexpected command execution or restricted-endpoint access.",
16434
+ "was_this_required": false,
16435
+ "framework_requiring_it": null,
16436
+ "adequacy": "Necessary to catch exploitation of devices not yet patched within the compressed window."
16437
+ },
16438
+ "response": {
16439
+ "what_would_have_worked": "Patch immediately under the KEV SLA, then investigate for post-exploitation persistence (implants/config changes) and rotate credentials reachable from the ISE surface; on indicators of compromise, follow the vendor's forensic/recovery guidance.",
16440
+ "was_this_required": true,
16441
+ "framework_requiring_it": "NIST 800-53 IR-4",
16442
+ "adequacy": "Mandatory for a KEV-listed unauthenticated device flaw; network-device implants survive patching without explicit recovery steps."
16443
+ }
16144
16444
  },
16145
16445
  "framework_coverage": {
16146
16446
  "NIST-800-53-SI-2": {
16147
16447
  "covered": true,
16148
16448
  "adequate": false,
16149
- "gap": "30-day SLA inadequate for KEV-listed actively-exploited CVE; KEV due date is the operational clock."
16449
+ "gap": "The 30-day flaw-remediation SLA is far longer than the observed exploitation window for a KEV-listed unauthenticated network-device flaw; CISA KEV due dates are days."
16150
16450
  },
16151
16451
  "ISO-27001-2022-A.8.8": {
16152
16452
  "covered": true,
16153
16453
  "adequate": false,
16154
- "gap": "Standard does not differentiate routinely-disclosed CVE from KEV-listed actively-exploited CVE."
16454
+ "gap": "'Appropriate timescales' is undefined; the standard 30-day reading is unsafe for an unauthenticated, actively-exploited flaw on an internet-facing network device."
16455
+ },
16456
+ "NIS2-Art21-network-security": {
16457
+ "covered": true,
16458
+ "adequate": false,
16459
+ "gap": "Treats the device class as essential-function infrastructure but lacks a CISA-KEV-style compressed remediation SLA."
16460
+ },
16461
+ "PCI-DSS-4.0-6.3.3": {
16462
+ "covered": true,
16463
+ "adequate": false,
16464
+ "gap": "The 30-day critical-patch window is exploitation acceptance for an unauthenticated flaw on a perimeter network device in or adjacent to the CDE."
16155
16465
  }
16156
16466
  },
16157
16467
  "compliance_exposure_score": {
16158
- "percent_audit_passing_orgs_still_exposed": 55,
16159
- "basis": "KEV-listed but not yet ransomware-attributed; exposure concentrated in orgs whose patch SLA defaults to NIST 30 days.",
16468
+ "percent_audit_passing_orgs_still_exposed": 70,
16469
+ "basis": "Internet-facing Cisco Identity Services Engine (ISE) is routinely run by audited organizations on a standard 30-day patch SLA, which was active exposure for this KEV-listed, actively-exploited flaw.",
16160
16470
  "theater_pattern": "patch_management"
16161
16471
  },
16162
16472
  "ai_discovered_zeroday": false,
16163
- "ai_discovery_source": "unknown",
16164
- "ai_assist_factor": "none",
16165
- "_auto_imported": true,
16166
- "_intake_method": "v0.13.17-bulk-cisa-kev-import"
16473
+ "ai_discovery_source": "vendor_research",
16474
+ "ai_assist_factor": "none"
16167
16475
  },
16168
16476
  "CVE-2025-20281": {
16169
- "name": "Cisco Identity Services Engine Injection Vulnerability",
16170
- "lesson_date": "2026-05-18",
16477
+ "name": "Cisco Identity Services Engine Injection Vulnerability (variant: CVE-2025-20281)",
16478
+ "lesson_date": "2026-05-29",
16171
16479
  "attack_vector": {
16172
- "description": "Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a crafted API request. Successful exploitation could allow an attacker to perform remote code execution and obtaining root privileges on an affected device.",
16173
- "privileges_required": "network attacker (no authentication required)",
16174
- "complexity": "moderate (bulk-import default)",
16175
- "ai_factor": "Bulk-imported — AI-discovery provenance not surfaced in KEV. Detection method that surfaces this class: ADVISORIES_SOURCE (12 primary-source feeds) + CISA-KEV poller. Refine when researcher writeup publishes."
16480
+ "description": "an injection flaw (CWE-74, a variant) enabling unauthenticated code execution on Cisco ISE. CISA KEV-listed 2025-07-28 with confirmed in-the-wild exploitation.",
16481
+ "privileges_required": "none (unauthenticated network reach to the device)",
16482
+ "complexity": "low — KEV-listed, actively exploited; treat as weaponized",
16483
+ "ai_factor": "No AI involvement documented in discovery or weaponization."
16484
+ },
16485
+ "defense_chain": {
16486
+ "prevention": {
16487
+ "what_would_have_worked": "Apply the Cisco ISE fixed release; restrict the ISE admin/portal surface and review for unexpected process execution.",
16488
+ "was_this_required": true,
16489
+ "framework_requiring_it": "CISA BOD 22-01 (KEV remediation)",
16490
+ "adequacy": "Patch is definitive once applied; the gap is the SLA — a network-device patch cycle (gated on a maintenance window) loses to the KEV-confirmed exploitation window."
16491
+ },
16492
+ "detection": {
16493
+ "what_would_have_worked": "Monitoring on the ISE surface: requests matching the exploited weakness, device crashes/reloads, and unexpected command execution or restricted-endpoint access.",
16494
+ "was_this_required": false,
16495
+ "framework_requiring_it": null,
16496
+ "adequacy": "Necessary to catch exploitation of devices not yet patched within the compressed window."
16497
+ },
16498
+ "response": {
16499
+ "what_would_have_worked": "Patch immediately under the KEV SLA, then investigate for post-exploitation persistence (implants/config changes) and rotate credentials reachable from the ISE surface; on indicators of compromise, follow the vendor's forensic/recovery guidance.",
16500
+ "was_this_required": true,
16501
+ "framework_requiring_it": "NIST 800-53 IR-4",
16502
+ "adequacy": "Mandatory for a KEV-listed unauthenticated device flaw; network-device implants survive patching without explicit recovery steps."
16503
+ }
16176
16504
  },
16177
16505
  "framework_coverage": {
16178
16506
  "NIST-800-53-SI-2": {
16179
16507
  "covered": true,
16180
16508
  "adequate": false,
16181
- "gap": "30-day SLA inadequate for KEV-listed actively-exploited CVE; KEV due date is the operational clock."
16509
+ "gap": "The 30-day flaw-remediation SLA is far longer than the observed exploitation window for a KEV-listed unauthenticated network-device flaw; CISA KEV due dates are days."
16182
16510
  },
16183
16511
  "ISO-27001-2022-A.8.8": {
16184
16512
  "covered": true,
16185
16513
  "adequate": false,
16186
- "gap": "Standard does not differentiate routinely-disclosed CVE from KEV-listed actively-exploited CVE."
16514
+ "gap": "'Appropriate timescales' is undefined; the standard 30-day reading is unsafe for an unauthenticated, actively-exploited flaw on an internet-facing network device."
16515
+ },
16516
+ "NIS2-Art21-network-security": {
16517
+ "covered": true,
16518
+ "adequate": false,
16519
+ "gap": "Treats the device class as essential-function infrastructure but lacks a CISA-KEV-style compressed remediation SLA."
16520
+ },
16521
+ "PCI-DSS-4.0-6.3.3": {
16522
+ "covered": true,
16523
+ "adequate": false,
16524
+ "gap": "The 30-day critical-patch window is exploitation acceptance for an unauthenticated flaw on a perimeter network device in or adjacent to the CDE."
16187
16525
  }
16188
16526
  },
16189
16527
  "compliance_exposure_score": {
16190
- "percent_audit_passing_orgs_still_exposed": 55,
16191
- "basis": "KEV-listed but not yet ransomware-attributed; exposure concentrated in orgs whose patch SLA defaults to NIST 30 days.",
16528
+ "percent_audit_passing_orgs_still_exposed": 70,
16529
+ "basis": "Internet-facing Cisco Identity Services Engine (ISE) is routinely run by audited organizations on a standard 30-day patch SLA, which was active exposure for this KEV-listed, actively-exploited flaw.",
16192
16530
  "theater_pattern": "patch_management"
16193
16531
  },
16194
16532
  "ai_discovered_zeroday": false,
16195
- "ai_discovery_source": "unknown",
16196
- "ai_assist_factor": "none",
16197
- "_auto_imported": true,
16198
- "_intake_method": "v0.13.17-bulk-cisa-kev-import"
16533
+ "ai_discovery_source": "vendor_research",
16534
+ "ai_assist_factor": "none"
16199
16535
  },
16200
16536
  "CVE-2025-2775": {
16201
16537
  "name": "SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability",
@@ -17598,68 +17934,124 @@
17598
17934
  "_intake_method": "v0.13.17-bulk-cisa-kev-import"
17599
17935
  },
17600
17936
  "CVE-2025-4428": {
17601
- "name": "Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability",
17602
- "lesson_date": "2026-05-18",
17937
+ "name": "Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability (variant: CVE-2025-4428)",
17938
+ "lesson_date": "2026-05-29",
17603
17939
  "attack_vector": {
17604
- "description": "Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability in the API component that allows an authenticated attacker to remotely execute arbitrary code via crafted API requests. This vulnerability results from an insecure implementation of the Hibernate Validator open-source library, as represented by CVE-2025-35036.",
17605
- "privileges_required": "network attacker (no authentication required)",
17606
- "complexity": "moderate (bulk-import default)",
17607
- "ai_factor": "Bulk-imported — AI-discovery provenance not surfaced in KEV. Detection method that surfaces this class: ADVISORIES_SOURCE (12 primary-source feeds) + CISA-KEV poller. Refine when researcher writeup publishes."
17940
+ "description": "code injection (CWE-94) yielding unauthenticated remote code execution on the EPMM management surface (chained with the authentication bypass). CISA KEV-listed 2025-05-19 with confirmed in-the-wild exploitation.",
17941
+ "privileges_required": "none (unauthenticated network reach to the device/service)",
17942
+ "complexity": "low — KEV-listed, actively exploited; treat as weaponized",
17943
+ "ai_factor": "No AI involvement documented in discovery or weaponization."
17944
+ },
17945
+ "defense_chain": {
17946
+ "prevention": {
17947
+ "what_would_have_worked": "Apply the Ivanti EPMM patch from the advisory; EPMM is a recurring exploited target — restrict its management surface and hunt for post-exploitation persistence.",
17948
+ "was_this_required": true,
17949
+ "framework_requiring_it": "CISA BOD 22-01 (KEV remediation)",
17950
+ "adequacy": "Patch/replace is definitive; the gap is that the affected class is internet-exposed by function and (for consumer/EoL devices) often unpatchable, so network isolation is the load-bearing control."
17951
+ },
17952
+ "detection": {
17953
+ "what_would_have_worked": "Monitoring for the EPMM management surface: exploit-shaped requests, device crashes/reboots, malicious firmware, and outbound botnet/C2 traffic from the device.",
17954
+ "was_this_required": false,
17955
+ "framework_requiring_it": null,
17956
+ "adequacy": "Necessary to catch exploitation of devices not yet patched/replaced; edge devices are frequently recruited into botnets."
17957
+ },
17958
+ "response": {
17959
+ "what_would_have_worked": "Patch or replace the device, isolate it from untrusted networks, and rotate any credentials reachable from it; reflash firmware on indicators of a malicious-update compromise.",
17960
+ "was_this_required": true,
17961
+ "framework_requiring_it": "NIST 800-53 IR-4",
17962
+ "adequacy": "Mandatory for a KEV-listed unauthenticated device flaw; firmware implants survive a reboot without a reflash."
17963
+ }
17608
17964
  },
17609
17965
  "framework_coverage": {
17610
17966
  "NIST-800-53-SI-2": {
17611
17967
  "covered": true,
17612
17968
  "adequate": false,
17613
- "gap": "30-day SLA inadequate for KEV-listed actively-exploited CVE; KEV due date is the operational clock."
17969
+ "gap": "The 30-day flaw-remediation SLA is far longer than the observed exploitation window for a KEV-listed unauthenticated network-device/service flaw; CISA KEV due dates are days."
17614
17970
  },
17615
17971
  "ISO-27001-2022-A.8.8": {
17616
17972
  "covered": true,
17617
17973
  "adequate": false,
17618
- "gap": "Standard does not differentiate routinely-disclosed CVE from KEV-listed actively-exploited CVE."
17974
+ "gap": "'Appropriate timescales' is undefined; the standard 30-day reading is unsafe for an unauthenticated, actively-exploited flaw on an internet-facing device — and end-of-life consumer devices have no patch at all, so the only control is replacement/isolation."
17975
+ },
17976
+ "NIS2-Art21-network-security": {
17977
+ "covered": true,
17978
+ "adequate": false,
17979
+ "gap": "Treats the class as essential-function infrastructure but lacks a compressed remediation SLA; consumer/edge devices in particular are routinely internet-exposed and unpatched."
17980
+ },
17981
+ "PCI-DSS-4.0-6.3.3": {
17982
+ "covered": true,
17983
+ "adequate": false,
17984
+ "gap": "The 30-day critical-patch window is exploitation acceptance for an unauthenticated flaw on an internet-facing device in or adjacent to the CDE."
17619
17985
  }
17620
17986
  },
17621
17987
  "compliance_exposure_score": {
17622
- "percent_audit_passing_orgs_still_exposed": 55,
17623
- "basis": "KEV-listed but not yet ransomware-attributed; exposure concentrated in orgs whose patch SLA defaults to NIST 30 days.",
17988
+ "percent_audit_passing_orgs_still_exposed": 72,
17989
+ "basis": "Internet-facing Ivanti Endpoint Manager Mobile (EPMM) is routinely run on a standard patch SLA — or, for consumer/EoL devices, not patched at all — which was active exposure for this KEV-listed, actively-exploited flaw.",
17624
17990
  "theater_pattern": "patch_management"
17625
17991
  },
17626
17992
  "ai_discovered_zeroday": false,
17627
- "ai_discovery_source": "unknown",
17628
- "ai_assist_factor": "none",
17629
- "_auto_imported": true,
17630
- "_intake_method": "v0.13.17-bulk-cisa-kev-import"
17993
+ "ai_discovery_source": "vendor_research",
17994
+ "ai_assist_factor": "none"
17631
17995
  },
17632
17996
  "CVE-2025-4427": {
17633
17997
  "name": "Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability",
17634
- "lesson_date": "2026-05-18",
17998
+ "lesson_date": "2026-05-29",
17635
17999
  "attack_vector": {
17636
- "description": "Ivanti Endpoint Manager Mobile (EPMM) contains an authentication bypass vulnerability in the API component that allows an attacker to access protected resources without proper credentials via crafted API requests. This vulnerability results from an insecure implementation of the Spring Framework open-source library.",
17637
- "privileges_required": "network attacker (no authentication required)",
17638
- "complexity": "moderate (bulk-import default)",
17639
- "ai_factor": "Bulk-imported — AI-discovery provenance not surfaced in KEV. Detection method that surfaces this class: ADVISORIES_SOURCE (12 primary-source feeds) + CISA-KEV poller. Refine when researcher writeup publishes."
18000
+ "description": "an authentication bypass (CWE-288) on EPMM that, chained with the code-injection flaw, yields unauthenticated remote code execution. CISA KEV-listed 2025-05-19 with confirmed in-the-wild exploitation.",
18001
+ "privileges_required": "none (unauthenticated network reach to the device/service)",
18002
+ "complexity": "low — KEV-listed, actively exploited; treat as weaponized",
18003
+ "ai_factor": "No AI involvement documented in discovery or weaponization."
18004
+ },
18005
+ "defense_chain": {
18006
+ "prevention": {
18007
+ "what_would_have_worked": "Apply the Ivanti EPMM patch from the advisory; the two flaws are chained for full preauth compromise, so restrict the management surface and review for unauthorized access.",
18008
+ "was_this_required": true,
18009
+ "framework_requiring_it": "CISA BOD 22-01 (KEV remediation)",
18010
+ "adequacy": "Patch/replace is definitive; the gap is that the affected class is internet-exposed by function and (for consumer/EoL devices) often unpatchable, so network isolation is the load-bearing control."
18011
+ },
18012
+ "detection": {
18013
+ "what_would_have_worked": "Monitoring for the EPMM management surface: exploit-shaped requests, device crashes/reboots, malicious firmware, and outbound botnet/C2 traffic from the device.",
18014
+ "was_this_required": false,
18015
+ "framework_requiring_it": null,
18016
+ "adequacy": "Necessary to catch exploitation of devices not yet patched/replaced; edge devices are frequently recruited into botnets."
18017
+ },
18018
+ "response": {
18019
+ "what_would_have_worked": "Patch or replace the device, isolate it from untrusted networks, and rotate any credentials reachable from it; reflash firmware on indicators of a malicious-update compromise.",
18020
+ "was_this_required": true,
18021
+ "framework_requiring_it": "NIST 800-53 IR-4",
18022
+ "adequacy": "Mandatory for a KEV-listed unauthenticated device flaw; firmware implants survive a reboot without a reflash."
18023
+ }
17640
18024
  },
17641
18025
  "framework_coverage": {
17642
18026
  "NIST-800-53-SI-2": {
17643
18027
  "covered": true,
17644
18028
  "adequate": false,
17645
- "gap": "30-day SLA inadequate for KEV-listed actively-exploited CVE; KEV due date is the operational clock."
18029
+ "gap": "The 30-day flaw-remediation SLA is far longer than the observed exploitation window for a KEV-listed unauthenticated network-device/service flaw; CISA KEV due dates are days."
17646
18030
  },
17647
18031
  "ISO-27001-2022-A.8.8": {
17648
18032
  "covered": true,
17649
18033
  "adequate": false,
17650
- "gap": "Standard does not differentiate routinely-disclosed CVE from KEV-listed actively-exploited CVE."
18034
+ "gap": "'Appropriate timescales' is undefined; the standard 30-day reading is unsafe for an unauthenticated, actively-exploited flaw on an internet-facing device — and end-of-life consumer devices have no patch at all, so the only control is replacement/isolation."
18035
+ },
18036
+ "NIS2-Art21-network-security": {
18037
+ "covered": true,
18038
+ "adequate": false,
18039
+ "gap": "Treats the class as essential-function infrastructure but lacks a compressed remediation SLA; consumer/edge devices in particular are routinely internet-exposed and unpatched."
18040
+ },
18041
+ "PCI-DSS-4.0-6.3.3": {
18042
+ "covered": true,
18043
+ "adequate": false,
18044
+ "gap": "The 30-day critical-patch window is exploitation acceptance for an unauthenticated flaw on an internet-facing device in or adjacent to the CDE."
17651
18045
  }
17652
18046
  },
17653
18047
  "compliance_exposure_score": {
17654
- "percent_audit_passing_orgs_still_exposed": 55,
17655
- "basis": "KEV-listed but not yet ransomware-attributed; exposure concentrated in orgs whose patch SLA defaults to NIST 30 days.",
18048
+ "percent_audit_passing_orgs_still_exposed": 72,
18049
+ "basis": "Internet-facing Ivanti Endpoint Manager Mobile (EPMM) is routinely run on a standard patch SLA — or, for consumer/EoL devices, not patched at all — which was active exposure for this KEV-listed, actively-exploited flaw.",
17656
18050
  "theater_pattern": "patch_management"
17657
18051
  },
17658
18052
  "ai_discovered_zeroday": false,
17659
- "ai_discovery_source": "unknown",
17660
- "ai_assist_factor": "none",
17661
- "_auto_imported": true,
17662
- "_intake_method": "v0.13.17-bulk-cisa-kev-import"
18053
+ "ai_discovery_source": "vendor_research",
18054
+ "ai_assist_factor": "none"
17663
18055
  },
17664
18056
  "CVE-2025-42999": {
17665
18057
  "name": "SAP NetWeaver Deserialization Vulnerability",