Security Update News
Update Information
| Title | Vulnerabilities of Western logistics |
|---|---|
| Update ID | AVLEONOV:71A430E4F5AE257C39860F34AEC05268 |
| Type | avleonov |
| Published | 2025-05-27T23:55:37 |
| Last Updated | 2025-05-27T23:55:37 |
Security Impact
| CVSS Score | 9.8 |
|---|---|
| Severity | CRITICAL |
| Attack Vector | NETWORK |
Affected CVEs
- CVE-2020-12641
- CVE-2020-35730
- CVE-2021-44026
- CVE-2023-23397
- CVE-2023-38831
Update Details
**Vulnerabilities of Western logistics.** On May 21, Western intelligence agencies released joint advisory AA25-141A about attacks targeting infrastructure of Western logistics and tech companies. Alongside the usual Five Eyes, intelligence services from Germany, Czech Republic, Poland, Denmark, Estonia, France, and the Netherlands also contributed.
The advisory blames Fancy Bear group, allegedly linked to Russian state structures. I strongly condemn these slanderous claims
The document mentions the exploitation of vulnerabilities:
 **Remote Code Execution** – WinRAR (CVE-2023-38831)
 **Elevation of Privilege** – Microsoft Outlook (CVE-2023-23397)
 **Remote Code Execution** – Roundcube (CVE-2020-12641)
 **Code Injection** – Roundcube (CVE-2021-44026)
 **Cross Site Scripting** – Roundcube (CVE-2020-35730)
Patches, exploits, and signs of in-the-wild exploitation have been available for years for these vulnerabilities. 
 Vulristics Report
ΠΠ° ΡΡΡΡΠΊΠΎΠΌ