Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies

The US Cybersecurity and Infrastructure Security Agency has added five security flaws to its Known Exploited Vulnerabilities catalog due to their exploitation by the China-linked threat actor Flax Typhoon. One of the vulnerabilities is an improper access control issue in ProFTPD, identified as CVE-2015-3306, which has a CVSS score of 10.0. CISA has set a deadline of October 11 for federal agencies to address these vulnerabilities. The flaws are being exploited by Flax Typhoon, a threat actor linked to China. CISA's action indicates the urgency of patching these vulnerabilities to prevent further exploitation. The agency's deadline applies to federal agencies, which must take action to remediate the vulnerabilities by the specified date.