The UK National Cyber Security Centre (NCSC) issued an alert yesterday, prompting all organizations to patch the critical CVE-2020-15505 remote code execution (RCE) vulnerability in MobileIron mobile device management (MDM) systems.
An MDM is a software platform that allows administrators to remotely manage mobile devices in their organization, including the pushing out of apps, updates, and the ability to change settings. This management is all done from a central location, such as an admin console running on the organization's server, making it a prime target for attackers.
NCSC is warning that they are aware of hacking groups actively using the MobileIron CVE-2020-1550 vulnerability to compromise the networks in the healthcare, local government, logistics, and legal sectors.
"The NCSC is aware that Advanced Persistent Threat (APT) nation-state groups and cyber criminals are now actively attempting to exploit this vulnerability [T1190] to compromise the networks of UK organisations," the advisory reads.
The US Cybersecurity and Infrastructure Agency (CISA) has also warned that APT hacking groups are actively utilizing this vulnerability to gain access to networks. The US National Security Agency (NSA) states that CVE-2020-15505 is in the top 25 vulnerabilities used by Chinese state-sponsored hackers.
Proof-of-concept exploits available
The MobileIron CVE-2020-15505 vulnerability allows an attacker to remotely execute commands on an MDM server without needing to authenticate.
As MDM servers need to be publicly accessible to remotely manage mobile devices, it makes them a juicy target for threat actors.
Discovered and responsibly disclosed by security researcher Orange Tsai in March, MobileIron released patches and an advisory in June. Orange Tsai also published a video demonstrating how the vulnerability was used to gain access to a Facebook MDM server, as shown below.
Soon after, researchers released a proof-of-concept (PoC) exploit for the vulnerability that allows remote attackers to execute commands on vulnerable devices.
APT groups and state-sponsored hacking groups soon began utilizing the vulnerability to compromise networks, including one used by US election support systems.
Due to this, UK NCSC is strongly urging all organization's using vulnerable software to apply the patches immediately.
MobileIron versions vulnerable to CVE-2020-15505 are:
- 10.3.0.3 and earlier
- 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0
- Sentry versions 9.7.2 and earlier
- 9.8.0
- Monitor and Reporting Database (RDB) version 2.0.0.1 and earlier
Information on the available patches can be found in MobileIron's advisory.
Post a Comment Community Rules
You need to login in order to post a comment
Not a member yet? Register Now