Cyble tracked 717 new vulnerabilities from July 30–Aug 5, 2025, including 222 with public PoCs, 17 in EOL products, one zero-day, and multiple exploits traded on underground forums. High-impact flaws affect vendors and products such as Trend Micro Apex One, D-Link, Microsoft SharePoint, Adobe AEM, SonicWall SMA, and Google/Apple browser engines. #TrendMicroApexOne #D-Link #CVE-2025-53770 #CVE-2025-54253
Keypoints
- Cyble recorded 717 new vulnerabilities in one week, with 222 having public Proof-of-Concept exploits.
- Seventeen vulnerabilities impact End-of-Life (EOL) products from vendors like Linksys, Netgear, D-Link, PHP Charts, and WP-Property.
- One zero-day was disclosed and five vulnerabilities were actively traded on underground cybercrime forums.
- CISA added three D-Link vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog due to active exploitation.
- 114 vulnerabilities scored critical under CVSS v3.1 and 39 under CVSS v4.0, including RCEs in Trend Micro Apex One and Dell KACE K1000.
- Trending exploited flaws include CVE-2025-53770 (SharePoint), CVE-2025-54253 (Adobe AEM), CVE-2025-40599 (SonicWall SMA), and CVE-2025-6558 (Chrome/WebKit).
- IoT and Linux ecosystems remain targeted by Mirai, Gafgyt, CoinMiner, WannaCry, and other malware; phishing campaigns produced over 52,900 new malicious email addresses.
MITRE Techniques
- [T1190] Exploit Public-Facing Application – Used for unauthenticated RCEs and exploitation of network devices (e.g., “a deserialization flaw in Microsoft SharePoint Server enables unauthenticated remote code execution”).
- [T1203] Exploitation for Client Execution – Browser engine flaws (CVE-2025-6558) enable remote attacks via ANGLE/WebKit vulnerabilities (“a critical input validation bug impacting Google Chrome’s ANGLE and Apple’s WebKit browser engine threatens millions of users with potential remote attacks”).
- [T1068] Exploitation of Remote Services – Vulnerabilities in VPN/WebVPN interfaces and network appliances (Cisco ASA, D-Link, SonicWall) allow remote compromise (“CISA expanded its KEV catalog by adding three new D-Link device vulnerabilities that are currently being exploited in the wild”).
- [T1210] Exploitation of Vulnerability – Underground trading and active exploitation of critical CVEs like NVIDIA container escape and SMBGhost zero-day (“NVIDIA Container Toolkit container escape vulnerability (CVE-2025-23266)… offered on an underground forum; SMBGhost… was also offered on an underground forum”).
- [T1105] Ingress Tool Transfer – Attackers upload and execute malicious code via unrestricted file upload vulnerabilities (Trend Micro Apex One RCE and Dell KACE unrestricted file upload) (“remote code execution vulnerabilities… permit attackers to upload and execute malicious code without authentication”).
- [T1059] Command and Scripting Interpreter – Command injection flaws in devices (QNAP, Telesquare TLR-2005Ksh) enable arbitrary command execution (“Command injection in Telesquare TLR-2005Ksh devices allows arbitrary system command execution”).
- [T1496] Resource Hijacking – CoinMiner Linux and Monero miners deployed on compromised hosts to mine cryptocurrency (“CoinMiner Linux silently mines cryptocurrency… Monero cryptocurrency miners… activated remotely via Firebase Cloud Messaging”).
Indicators of Compromise
- [File Hashes] PoC/exploit artifacts and malware samples – examples include hashes for exploits trading in underground forums (example hashes not provided in article) and 2 more hashes referenced in Cyble sensors.
- [CVE Identifiers] Vulnerability references – CVE-2025-54948, CVE-2025-54987 (Trend Micro Apex One), CVE-2025-53770 (SharePoint), CVE-2025-54253 (Adobe AEM), CVE-2025-40599 (SonicWall SMA), and others listed.
- [Software/Firmware Names] Affected products and firmware – Trend Micro Apex One on-prem management console; Dell KACE K1000; Synology TC500 firmware 1.1.2-0416 (patched in 1.1.3-0442); QNAP QTS firmware; and Dasan GPON routers (CVE-2018-10561/CVE-2018-10562).
- [Email Addresses] Phishing infrastructure – over 52,900 new phishing-related email addresses identified this week (example addresses not listed), used in credential theft campaigns.
- [IP/Network Indicators] Source IP infrastructure and exploited network ports – scanning and exploitation attempts against Cisco ASA WebVPN and IoT devices (specific IPs not disclosed in article).
Read more: https://cyble.com/blog/cyble-vulnerability-intelligence/