Genians Warns of PHP Vulnerability: 96% of Internal Network Devices Exposed to Risk
IT DAILY ·
✦ AI Summary
After the disclosure of PHP2Shell, a risk assessment found that latent threats in internal network devices are more serious than those facing external web servers.
Genians urged caution for network devices in internal networks, including NAS devices and routers, and said attackers' entry paths are shifting from web servers to internal network devices.
Genians said 96% of internal-network PHP-running devices were exposed to the vulnerability, and 89% of the identified devices were in private IP ranges invisible from outside.
After the recent disclosure of the high-risk security vulnerability PHP2Shell, a risk assessment was carried out, and it found that latent threats in internal network devices are more serious than those facing external web servers.
Security measures are currently focused on public web servers identified through external scans, but internal network devices have been singled out as likely targets of cyberattacks.
On the 30th, Genians urged caution for network devices in internal networks, including NAS devices and routers.
Genians expressed concern that attackers' entry paths are shifting beyond web servers to internal network devices.
PHP2Shell was added on the 26th to the U.S. Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities (KEV) catalog, indicating that real-world exploitation has been detected.
Genians warned that, based on an analysis of device identification data linked with its cloud NAC platform, 96% of PHP-running devices in internal networks were exposed to the PHP2Shell vulnerability. It also said 89% of the identified devices are located in private IP ranges that cannot be accessed by external internet scanners, meaning vulnerable devices in internal private IP ranges that are invisible from outside could be seized and used as a beachhead or abused to spread ransomware.
Looking at the version distribution of vulnerable devices, 78% were older versions at 8.1 or below that had reached end of support, and 48% were using versions 5.x or earlier, for which support ended in 2018. Genians said it confirmed the heavy reliance on older PHP versions.
By device composition, traditional servers accounted for 24%, while CTV, video storage devices, and security solutions made up 20%, and IoT devices such as RFID readers accounted for 17%. Unidentified assets whose device types could not be determined also accounted for 27%.
Based on this distribution, Genians concluded that there are many devices in security management blind spots. It also analyzed that in some cases administrators left devices unattended without realizing PHP was installed on them, creating management gaps.
Genians stressed that external scanning tools cannot identify blind spots hidden inside internal networks, so securing visibility across all internal assets should be the priority. It said external scans alone cannot fully determine the exposure status of internal network assets to vulnerabilities.
Kim Gye-yeon, head of Genians' U.S. subsidiary and chief technology officer (CTO), said whether managed devices in internal networks are running PHP can be determined only by checking web console response data and embedded components. He added that older devices with no official patch because manufacturer support has ended, or devices still in the pre-patch deployment stage, need to have network access immediately blocked and be isolated until they are replaced.
Source: IT DAILY · Kim Ho-jun
Original: https://www.itdaily.kr/news/articleView.html?idxno=242583
References
This article was produced with the help of an automated content generation algorithm.
Source: IT DAILY
View originalThis article was summarized and organized by BizCrush based on the original article from IT DAILY. For exact quotations and full details, please refer to the original article.