🧵 November mini-digest of vulnerabilities: Windows, Redis, XWiki and evil shortcuts
💥 1. WSUS on Windows Server: RCE with SYSTEM without login
A critical hole was found in Windows Server Update Services (WSUS) (CVE-2025-59287, CVSS 9.8): a remote unauthenticated attacker can execute code with SYSTEM privileges on a server where the WSUS role is enabled. It’s enough to flood the server with special POST requests — a bug in deserialization of untrusted data does the rest.
An exploit is already publicly available, and real-world exploitation attempts have been observed at companies; the vulnerability is listed in the CISA KEV catalog as actively exploited.
Why it matters
WSUS often runs at the very heart of the infrastructure and has access to a lot of hosts.
What to do
— Check whether you have WSUS deployed at all — in some networks people simply forgot about it.
— Install the October patches and the additional updates from October 24, then reboot the server.
— Restrict network access to WSUS (VPN, segmentation, ACLs), don’t expose it to the public internet.
— Watch for anomalies: suspicious POST requests to WSUS and unusual “updates” on clients.
🔴 2. Redis: critical RCE and tens of thousands of exposed instances
A near-maximum severity RCE was found in Redis (CVE-2025-49844, CVSS 9.9). An authenticated attacker can run arbitrary code via a specially crafted Lua script. Formally, authentication is required, but in Redis it is disabled by default and in many deployments simply isn’t used.
According to researchers, around 330,000 Redis instances are exposed to the internet, and about 60,000 of them have no password at all. There is already a public PoC and a working exploit for the vulnerability. A patch was released in early October, but that doesn’t mean everyone has updated.
Why it matters
Redis is a cache, a message broker, and often a “concentration point” for sensitive data. A single vulnerable internet-facing instance — and the attacker doesn’t need to break your web app, they can go straight into the infrastructure.
What to do
— Immediately check whether Redis is exposed to the internet: external perimeter scans, searches for your assets in Shodan/Censys.
— Enable authentication and restrict network access (e.g., via Planet VPN).
— Update to one of the fixed versions: 6.2.20, 7.2.11, 7.4.6, 8.0.4 or 8.2.2.
📁 3. LNK 0-day in Windows: a shortcut as a full-fledged exploit
A vulnerability was discovered in the Windows shortcut handling mechanism (. LNK) (CVE-2025-9491, CVSS 7.8), which allows malicious command-line arguments to be hidden in the Target field using whitespace characters. Visually, the shortcut looks normal, but when launched it executes arbitrary code.
The catch is that the vulnerability was reported back in 2024 but wasn’t fixed. Later it became known that at least eleven different groups used it — from well-known cybercriminals to APTs, including Mustang Panda, as well as in attacks on diplomatic missions in Europe to deliver PlugX.
Why it matters
LNK is a perfect format for phishing: archives, USB sticks, shared folders inside a company. Users are used to “just clicking a shortcut”, not expecting a full payload behind it.
What to do
— Tighten policies for handling attachments and USB media: block/limit execution of .lnk files from untrusted locations.
— Use EDR/antivirus with behavioral analysis. Launching command interpreters from LNK should be a clear trigger.
— Keep an eye on Windows security updates: at the time of this digest, there is still no dedicated fix for CVE-2025-9491.
Stay safe,
🌍 Planet VPN
#vpn #infosec #cybersecurity #windows #redis #xwiki #security #censorship
