Loading story…
DEVCORE researchers published offensive research describing a remote-code-execution chain affecting Pulse Secure SSL VPN appliances, using Twitter as a case study. The work highlighted how chained vulnerabilities in internet-facing VPN infrastructure can provide a path from unauthenticated access to execution on the appliance, placing internal networks and authentication systems at risk.
Researcher Orange Tsai also disclosed flaws in roughly 250,000 internet-exposed Taiwanese home modems, largely associated with Chunghwa Telecom. An ISP configuration exposed an unauthenticated management and debugging service on TCP port 3097; arbitrary file reading and an unauthenticated RCE path could enable modem compromise and access to subscriber home networks. The issues were tracked as CVE-2019-13411, CVE-2019-13412, CVE-2019-15064, CVE-2019-15065, and CVE-2019-15066, with firmware remediation reported before disclosure.
Map this exposure pattern across your cloud, code, and identities.
6 events from the most recent confirmed update back to the earliest known activity.
DEVCORE and TWCERT/CC confirmed that public disclosure of the modem vulnerability chain could proceed.
Chunghwa Telecom reported that some customers still required on-site technician updates, delaying public disclosure of the vulnerabilities.
Chunghwa Telecom stated that firmware updates for affected modem devices had been completed.
Chunghwa Telecom stated that it was investigating the reported issues and patching affected equipment.
DEVCORE reported vulnerabilities affecting Chunghwa Telecom GPON broadband modems, including the exposed TCP/3097 management service, to Chunghwa Telecom through TWCERT/CC.
DEVCORE published research describing an internet-exposed TCP/3097 modem-management service affecting an estimated 250,000 Taiwanese modems, primarily Chunghwa Telecom devices. The disclosed flaws, assigned CVE-2019-13411, CVE-2019-13412, CVE-2019-15064, CVE-2019-15065, and CVE-2019-15066, enabled arbitrary file reading and unauthenticated remote code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Pulse Secure SSL VPN appliances were affected by seven vulnerabilities, led by the critical pre-authentication arbitrary file-read flaw **CVE-2019-11510** and authenticated administrative command injection **CVE-2019-11539**. The defects affected multiple Pulse Connect Secure and Pulse Policy Secure releases; Pulse Secure issued fixes on April 24, 2019, following private disclosure by DEVCORE researchers. Public exploit availability prompted broad Internet scanning, and more than 14,500 Pulse Secure VPN endpoints were reported vulnerable to CVE-2019-11510. Researchers cited intelligence linking exploitation to a China-associated APT group and demonstrated that chaining the flaws with session-management weaknesses, SSRF, and compromised administrator credentials could yield remote code execution; organizations should urgently apply vendor patches, identify exposed appliances, rotate potentially exposed credentials, enforce MFA and client certificates where feasible, and centralize audit logging.
Sep 3, 2026
CISA and Mandiant reported that attackers exploited **Pulse Connect Secure** VPN vulnerabilities—including `CVE-2019-11510` and the later zero-day `CVE-2021-22893`—to gain initial access to government and other high-value networks, bypass authentication controls, and steal credentials. In one CISA incident response case, a federal civilian agency was compromised after the actor used valid **Office 365** and domain administrator credentials, likely obtained in part through Pulse Secure exploitation, to access email and SharePoint data, enumerate **Active Directory**, move laterally, and stage files for likely exfiltration. The intrusion was detected through **EINSTEIN**, and CISA said the actor maintained command and control with scheduled tasks, SSH tunneling, reverse SOCKS proxies, mounted remote shares, PowerShell proxy tooling, and custom malware including `inetinfo.exe`. Mandiant said multiple intrusions involved compromised Pulse Secure appliances that retained persistence even after upgrades, with attackers deploying web shells and malware families such as **SLOWPULSE**, **RADIALPULSE**, **PULSECHECK**, **SLIGHTPULSE**, **ATRIUM**, and **STEADYPULSE**, while **THINBLOOD** was used to wipe logs. The activity was linked to clusters **UNC2630** and **UNC2717**, which targeted the U.S. defense industrial base and global government agencies, respectively, and in some cases used trojanized components to log credentials or bypass LDAP, RADIUS, and other MFA flows with a backdoor password. CISA’s alert `AA21-110A`, Emergency Directive `21-03`, and vendor guidance urged organizations to patch affected appliances, apply mitigations, enable unauthenticated request logging, run integrity checks, and hunt for published indicators of compromise across VPN and authentication logs.
Aug 15, 2026
Several critical vulnerabilities have been disclosed affecting a range of widely used software frameworks and hardware platforms. Notable issues include a critical flaw in the Apache bRPC framework (CVE-2025-59789) that exposes high-performance systems to crash risks, a high-severity unauthenticated XXE vulnerability in GeoServer (CVE-2025-58360) enabling file theft and SSRF, and a critical SQL injection vulnerability in Devolutions Server (CVE-2025-13757) that allows authenticated attackers to steal all stored passwords. Additional disclosures include a proof-of-concept exploit for a Windows Administrator Protection elevation of privilege vulnerability (CVE-2025-60718), a critical boot process compromise in Snapdragon 8 Gen 3 and 5G modems (CVE-2025-47372), and a flaw in Apache Kvrocks that allows privilege escalation via the 'RESET' command. A separate high-severity vulnerability (CVE-2025-61618) was identified in Unisoc T8100/T9100/T8200/T8300 chipsets, affecting Android devices and allowing remote denial of service through improper input validation in the NR modem. These vulnerabilities collectively highlight the ongoing risk posed by both software and hardware flaws, with several enabling remote code execution, privilege escalation, or denial of service. Organizations using affected products should prioritize patching and mitigation efforts to reduce exposure to these critical threats.
Jun 29, 2026