podcast - #セキュリティのアレ - ゆるーいセキュリティのポッドキャストですよ。

事件、事故

ＴＯＫＡＩコミュニケーションズのメールサービス OneOffice Mail Solution において、外部からの不正アクセスによる情報漏洩の可能性

(12/19) OneOffice メールソリューションにおける不正アクセスによる個人情報漏洩の可能性についてのお知らせとお詫び

2025 年 12 月 3 日、「OneOffice Mail Solution」のスパムメール隔離サービス「OneOffice SPAM Filtering」のサーバ機器において、不正アクセスの疑いを検知いたしました。直ちに当該サービスを構成する機器のベンダーである、シスコシステムズ合同会社（以下、Cisco 社）と連携しながら調査を進め、監督官庁へも相談の上、二次被害防止の観点にも配慮しながら慎重に対応を進めてまいりました。

調査の結果、Cisco 社製品の脆弱性*を悪用され「OneOffice Mail Solution」の一部のサービスで利用している、スパムメールを隔離するサーバ、およびアカウント情報等を管理するサーバ（LDAP）に不正アクセスの形跡が認められ、一部の情報が外部へ漏洩した可能性があることが判明いたしました。

なお、現時点では情報漏洩の事実は確認されておりません。

*Cisco 社製品の脆弱性

https://www.cisco.com/c/ja_jp/support/docs/csa/2025/cisco-sa-sma-attack-N9bf4.html

攻撃、脅威

脆弱性

Fortinet の複数の製品に認証バイパスの脆弱性。すでに悪用が確認されている

(12/9) Multiple Fortinet Products' FortiCloud SSO Login Authentication Bypass | PSIRT | FortiGuard Labs

(12/15) Arctic Wolf Observes Malicious SSO Logins on FortiGate Devices Following Disclosure of CVE-2025-59718 and CVE-2025-59719 - Arctic Wolf

On December 12, 2025, Arctic Wolf began observing intrusions involving malicious SSO logins on FortiGate appliances. Fortinet had previously released an advisory for two critical authentication bypass vulnerabilities (CVE-2025-59718 and CVE-2025-59719) on December 9, 2025. Arctic Wolf had also sent out a security bulletin for the vulnerabilities shortly thereafter.

Fortinet社製品の管理画面でFortiCloudSSOが有効時に影響有る脆弱性CVE-2025-59718/59719に関しArcticWolfが悪用観測し本日KEV追加。攻撃観測は情報公開から僅か3日の出来事。管理画面露出Forti機器を調査するとWWで19万台を発見し内16%/3万台で同SSO機能が有効。日本はなぜか1%/19台と極端に少ない https://t.co/D6u16LOmS3 pic.twitter.com/tsTJFrJiVn
— nekono_nanomotoni (@nekono_naha) December 16, 2025

We added fingerprinting of Fortinet devices with FortiCloud SSO enabled to our Device Identification reporting (at least 25K IPs seen globally). While not necessarily vulnerable to CVE-2025-59718/CVE-2025-59719 if you get a report from us regarding exposure, please verify/patch! pic.twitter.com/u0ts0vFMBa
— The Shadowserver Foundation (@Shadowserver) December 19, 2025

CISA が Known Exploited Vulnerabilities (KEV) カタログに 2+1+3+1 個の脆弱性を追加

(12/15) CISA Adds Two Known Exploited Vulnerabilities to Catalog | CISA

CVE-2025-14611 Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability

CVE-2025-43529 Apple Multiple Products Use-After-Free WebKit Vulnerability

(12/16) CISA Adds One Known Exploited Vulnerability to Catalog | CISA

CVE-2025-59718 Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability

(12/17) CISA Adds Three Known Exploited Vulnerabilities to Catalog | CISA

CVE-2025-20393 Cisco Multiple Products Improper Input Validation Vulnerability

CVE-2025-40602 SonicWall SMA1000 Missing Authorization Vulnerability

CVE-2025-59374 ASUS Live Update Embedded Malicious Code Vulnerability

(12/19) CISA Adds One Known Exploited Vulnerability to Catalog | CISA

CVE-2025-14733 WatchGuard Firebox Out-of-Bounds Write Vulnerability

Cisco Secure Email Gateway に任意のコマンド実行が可能な脆弱性。すでに悪用が確認されている

(12/17) Reports About Cyberattacks Against Cisco Secure Email Gateway And Cisco Secure Email and Web Manager

On December 10, Cisco became aware of a new cyberattack campaign targeting a limited subset of appliances with certain ports open to the internet that are running Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager. This attack allows the threat actors to execute arbitrary commands with root privileges on the underlying operating system of an affected appliance. The ongoing investigation has revealed evidence of a persistence mechanism planted by the threat actors to maintain a degree of control over compromised appliances.

(12/17) UAT-9686 actively targets Cisco Secure Email Gateway and Secure Email and Web Manager

We have identified 120 Cisco Secure Email Gateway/ Cisco Secure Email and Web Manager likely vulnerable to CVE-2025-20393 (over 650 fingerprinted exposed). CVE-2025-20393 is exploited in the wild, with no patch available. Follow Cisco recommendations at https://t.co/0mB8XKuXBO pic.twitter.com/RKORDZbJT8
— The Shadowserver Foundation (@Shadowserver) December 20, 2025

SonicWall SMA1000 に権限昇格の脆弱性。すでに悪用が確認されている

(12/17) SonicWall SMA1000 appliance local privilege escalation vulnerability | Security Advisory

IMPORTANT: This vulnerability was reported to be leveraged in combination with CVE-2025-23006 (CVSS score 9.8) to achieve unauthenticated remote code execution with root privileges. CVE-2025-23006 was remediated in build version 12.4.3-02854 (platform-hotfix) and higher versions (released on Jan 22, 2025).