Oruga

**Name of the Vulnerable Software and Affected Versions** Microsoft Scripting Engine (affected versions not specified) **Description** The issue is related to a type confusion vulnerability in the Microsoft Scripting Engine, which allows an unauthorized attacker to execute code over a network. This can be achieved by exploiting the vulnerability when a user visits a malicious webpage, particularly in Microsoft Edge or Internet Explorer mode. The vulnerability has been actively exploited in the wild. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows versions prior to February 2025 Patchday **Description** A flaw exists in the Windows Update Stack related to improper link resolution before file access. Successful exploitation of this issue, identified as CVE-2025-21204, allows an attacker with low privileges to elevate their permissions and potentially gain SYSTEM-level access. The vulnerability stems from the Windows Update Stack incorrectly handling symbolic links on unpatched systems, enabling attackers to manipulate file access. A researcher discovered that even non-administrative users could exploit this issue to block Windows updates by creating a junction between C:inetpub and any system file. Microsoft created the C:inetpub folder as part of a security update to mitigate this vulnerability, and users are advised not to delete it. The creation of this folder has been observed even on systems without Internet Information Services (IIS) installed. A proof-of-concept exploit has been published. **Recommendations** Do not delete the C:inetpub folder, regardless of whether IIS is enabled. If the C:inetpub folder was deleted, restore it by installing Internet Information Services from the Windows Features control panel. Monitor for the creation of junctions or changes to system files. Ensure systems are updated regularly.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows versions prior to April 2025 Patch Tuesday **Description** A use-after-free vulnerability exists in the Windows Common Log File System (CLFS) driver. Successful exploitation of this vulnerability allows an authorized attacker to elevate privileges to the SYSTEM level. This vulnerability (CVE-2025-29824) has been actively exploited by multiple threat actors, including the Play ransomware group and the Storm-2460 group, who have used it in conjunction with the PipeMagic malware. Attackers have leveraged this vulnerability to gain initial access, deploy information stealers, and achieve lateral movement within compromised networks. The exploitation has been observed across various sectors, including IT, finance, real estate, and government, in countries such as the United States, Venezuela, Saudi Arabia, and Brazil. The PipeMagic malware has been observed disguising itself as legitimate software, such as a ChatGPT desktop application, to evade detection. **Recommendations** Apply the April 2025 Patch Tuesday updates to address this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows Fast FAT Driver (affected versions not specified) **Description** The issue is related to an integer overflow or wraparound in the Windows Fast FAT Driver, which allows an unauthorized attacker to execute code locally. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Windows Telephony Service (affected versions not specified) Description: The issue allows remote attackers to execute arbitrary code and affect the system. It is a remote code execution vulnerability in the Windows Telephony Service. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Microsoft Message Queuing (MSMQ) (affected versions not specified) Description: The issue is related to an uncontrolled consumption of resources in Microsoft Message Queuing (MSMQ) in Microsoft Windows operating systems. This can be exploited by a remote attacker to cause a denial of service. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows Hyper-V NT Kernel Integration VSP versions are affected, but specific versions are not provided in the input data. **Description** The issue is related to an elevation of privilege vulnerability in Windows Hyper-V NT Kernel Integration VSP, which could allow attackers to gain full system control. It is mentioned that hackers could exploit this to elevate privileges to the SYSTEM level. There are reports of this vulnerability being exploited in real-world incidents. The estimated number of potentially affected devices worldwide is not specified. Technical details about exploitation include a heap-based buffer overflow. **Recommendations** Since specific affected versions are not provided, a general recommendation cannot be accurately tailored to each version. However, for Windows Hyper-V NT Kernel Integration VSP, updating to a version that includes a fix for the elevation of privilege vulnerability is recommended. Each user should check the official Microsoft website for the latest updates and patches for their specific version of Windows Hyper-V NT Kernel Integration VSP.

**Name of the Vulnerable Software and Affected Versions** Windows Line Printer Daemon (LPD) Service (affected versions not specified) **Description** The issue is related to a use-after-free memory vulnerability in the Windows Line Printer Daemon (LPD) service. This vulnerability can be exploited by a remote attacker to execute arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Edge (Chromium-based) (affected versions not specified) **Description** The issue concerns an elevation of privilege vulnerability in Microsoft Edge. This vulnerability may allow an attacker to elevate their privileges, potentially leading to unauthorized actions on the system, exposure of sensitive information, and system compromise. No specific details about affected devices or real-world incidents are provided. Technical details about exploitation are not mentioned. **Recommendations** Update Microsoft Edge: Immediately apply the latest security patches from Microsoft. Monitor Your Systems: Keep an eye on system logs for any signs of suspicious activity. Strengthen Security Configurations: Ensure your browser's security settings are optimized to fend off threats.

**Name of the Vulnerable Software and Affected Versions** Microsoft Exchange Server (affected versions not specified) **Description** A vulnerability in Microsoft Exchange Server is related to errors in code generation management. Exploitation of this issue may allow a remote attacker to execute arbitrary code. The vulnerability affects the system and allows remote attackers to execute arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.