Threat actors are exploiting two vulnerabilities in the popular file-sharing server FileZen, tracked as CVE-2020-5639 and CVE-2021-20655, to steal sensitive data from businesses and government organizations.
FileZen servers allow users to share data according to their needs, overcoming problems with file size limits, content filters, and potential loss.
The CVE-2020-5639 vulnerability is a Directory traversal issue that could be exploited by remote attackers to upload an arbitrary file in a specific directory via unspecified vectors, potentially leading to arbitrary OS command execution.
The CVE-2021-20655 vulnerability could be exploited by a remote attacker with administrator rights to execute arbitrary OS commands via unspecified vectors.
Soliton addressed both flaws in FileZen solutions with the release of firmware versions V4.2.8 and V5.0.3.
The attacks are part of a large-scale campaign that also resulted in unauthorized access to a Soliton file shared storage used by the Japanese Prime Minister’s Cabinet Office staff.
Experts pointed out that the attacks begun before the vendor has fixed the issues, this means that we cannot exclude that threat actors have compromised organizations using the popular file-sharing servers
The vendor recommended changing system administrator account, reset access control, and installing the latest available version.
If you want to receive the weekly Security Affairs Newsletter for free subscribe here.
(SecurityAffairs – hacking, FileZen)
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.