Exploitation of patchable external vulnerabilities has prompted 82% of cyberattacks against U.S. organizations during the first quarter of 2022, reports Threatpost.
Cyberattacks stemming from unpatched systems have yielded 54% higher costs for impacted organizations, compared with human error-related cyber incidents, a study from Tetra Defense revealed. Moreover, 57% of organizational losses from cyber incidents were brought by risky external exposure.
Meanwhile, the ProxyShell vulnerability was the most exploited external exposure during the first three months of the year, with Log4Shell exploits minimized by widespread awareness of the security flaw.
The findings should prompt increased urgency for organizations to adopt better patching practices, according to researchers.
"To best prevent exploitation of external vulnerabilities, organizations need to understand their attack surface and prioritize patching based on risk, all while ensuring they have the defenses in place to protect their systems knowing that that will have obstacles that will prevent them from immediately patching vulnerable systems," said Tetra Defense.
Included in the exposed dataset labeled "PDL" were individuals' full names, email addresses, phone numbers, location data, professional summaries, and skills, as well as education and employment histories.
Attackers could leverage the issue — which impacts Nexus 3000, 7000, and 9000 series switches with vulnerable NX-OS versions with DHCPv6 activated and are in standalone NX-OS mode — to facilitate continuous crashes of the dhcp_snoop process and a denial-of-service condition.
Higher rewards of up to $250,000 will be given by Google for the discovery of memory corruption flaws in the Chrome browser shown to achieve remote code execution using a non-sandboxed process as part of a more robust vulnerability reward program.