433 Central Ave., 4th Floor, St. Petersburg, FL 33701 | info@poseidon-us.com | Office: (813) 563-2652

Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability

Update August 20, 2025: Cisco is aware of continued exploitation activity of the vulnerability that is described in this advisory and strongly recommends that customers assess their systems and upgrade to a fixed software release as soon as possible. A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition, or to execute arbitrary code on an affected device. The vulnerability is due to improper validation of packet data. An attacker could exploit this vulnerability by sending a crafted Smart Install message to an affected device on TCP port 4786. A successful exploit could allow the attacker to cause a buffer overflow on the affected device, which could have the following impacts: * Triggering a reload of the device * Allowing the attacker to execute arbitrary code on the device * Causing an indefinite loop on the affected device that triggers a watchdog crash Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. Smart Install client functionality is enabled by default on switches that are running Cisco IOS Software releases that have not been updated to address Cisco bug ID CSCvd36820. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2 This advisory is part of the March 28, 2018, release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication, which includes 20 Cisco Security Advisories that describe 22 vulnerabilities. For a complete list of the advisories and links to them, see Cisco Event Response: March 2018 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication. Security Impact Rating: Critical CVE: CVE-2018-0171
http://news.poseidon-us.com/TMbLP3

LastPass now supports passkeys

LastPass announced passkey support, giving users and businesses a simpler, more secure way to log in across a variety of devices, browsers, and operating systems. Starting now, passkeys can be created, stored, and managed directly in the LastPass vault, alongside passwords, making secure access easier than ever. This release marks a major step in LastPass’s Secure Access Experiences strategy, designed to help users and businesses move beyond password fatigue, phishing risks, and ecosystem lock-in. “Passkeys … More → The post LastPass now supports passkeys appeared first on Help Net Security.
http://news.poseidon-us.com/TMbJYc

Password crisis in healthcare: Meeting and exceeding HIPAA requirements

In 2025, healthcare organizations are facing a new wave of password security risks. Recent data from the HIMSS Cybersecurity Survey reveals that 74% experienced at least one significant security incident over the last year. More than half of responders (52%) expect their IT budgets to grow in 2025. Notably, 55% of health systems plan to invest specifically in cybersecurity: strengthening tools, updating policies, and expanding IT teams. The root causes are mostly the same: poor … More → The post Password crisis in healthcare: Meeting and exceeding HIPAA requirements appeared first on Help Net Security.
http://news.poseidon-us.com/TMbJXW

Behind the Curtain: How Lumma Affiliates Operate

Explore a groundbreaking investigation into Lumma affiliates: uncover their tools, tactics, scams, and integration in the cybercriminal ecosystem. Essential reading for defenders.
http://news.poseidon-us.com/TMbGw6

Immature data strategies threaten enterprise AI plans

Executives rate their organization’s data maturity 12% higher than those working in the environment daily, according to an Actian survey.
http://news.poseidon-us.com/TMb5RD

Exploit for critical SAP Netweaver flaws released (CVE-2025-31324, CVE-2025-42999)

A working exploit concatenating two critical SAP Netweaver vulnerabilities (CVE-2025-31324, CVE-2025-42999) that have been previously exploited in the wild has been made public by VX Underground, Onapsis security researchers have warned. The exploit has allegedly been released on a Telegram channel that claimed to represent a collective of three established cybercrime groups: Scattered Spider, ShinyHunters, and LAPSUS$. Historical exploitation of CVE-2025-31324 Earlier this year, a suspected initial access broker group abused CVE-2025-31324 – a missing … More → The post Exploit for critical SAP Netweaver flaws released (CVE-2025-31324, CVE-2025-42999) appeared first on Help Net Security.
http://news.poseidon-us.com/TMb4xx

Javelin MCP Security protects agentic systems and AI‑enabled applications

Javelin announced MCP Security, a defense-in-depth solution for the Model Context Protocol (MCP), the connective tissue between AI assistants, tools, and enterprise data. The release combines Javelin Ramparts, an MCP scanner, with Javelin MCP Runtime Guardrails for real-time policy enforcement at the tool and data boundary. As enterprises accelerate agentic AI, adversaries are shifting to agent hijacking and indirect prompt injection—malicious instructions hidden in business content or third-party data that drive unintended actions. Recent demonstrations … More → The post Javelin MCP Security protects agentic systems and AI‑enabled applications appeared first on Help Net Security.
http://news.poseidon-us.com/TMZy4G

The 6 challenges your business will face in implementing MLSecOps

Organizations that don’t adapt their security programs as they implement AI run the risk of being exposed to a variety of threats, both old and emerging ones. MLSecOps addresses this critical gap in security perimeters by combining AI and ML development with rigorous security guidelines. Establishing a robust MLSecOps foundation is essential for both proactively mitigating vulnerabilities and simplifying the remediation of previously undiscovered flaws. AI/ML systems must remain trustworthy, resilient, and secure. MLSecOps can … More → The post The 6 challenges your business will face in implementing MLSecOps appeared first on Help Net Security.
http://news.poseidon-us.com/TMZv1Q

LudusHound: Open-source tool brings BloodHound data to life

LudusHound is an open-source tool that takes BloodHound data and uses it to set up a working Ludus Range for safe testing. It creates a copy of an Active Directory environment using previously gathered BloodHound data. Red teams can use this lab to map attack paths and test ways to exploit misconfigurations before trying them on real systems. Blue teams can use it to practice defense strategies and strengthen AD security, testing configuration changes in … More → The post LudusHound: Open-source tool brings BloodHound data to life appeared first on Help Net Security.
http://news.poseidon-us.com/TMZtzg