June 16, 2025

about 1 month ago

Four new fingerprints and two Rapid Response bulletins.

Rapid Response

The Censys Rapid Response team published information about and queries for the following issues and vulnerabilities.

Wazuh RCE Vulnerability Exploited to Deploy Mirai Botnets
- Use the following queries to identify exposed Wazuh servers, but they are not necessarily vulnerable to the exploit.
  - Platform query
  - Legacy Search query
  - ASM query
  - ASM risk query
    - This query can be used to find instances of Wazuh server that are vulnerable to the exploit.
Roundcube Webmail Vulnerable to Authenticated RCE [CVE-2025-49113]
- Use the following queries to find Roundcube Webmail instances. Not all of these are necessarily vulnerable to the exploit described in the bulletin.
  - Platform query
  - Legacy Search query
  - ASM query
  - ASM risk query
    - This query can be used to find instances of Roundcube Webmail that are vulnerable to the exploit.

New fingerprints

Added the following fingerprints.

Type	Name	Description	Query
software	Synology VPN Plus Server	This is a Synology VPN Plus Server.	Platform query
software	3CX Web Client	The 3CX Web Client is a browser-based application that provides users with tools for communication and collaboration, including call management, video conferencing, live chat, and integration with messaging platforms such as WhatsApp, Facebook, and SMS/MMS.	Platform query
risk	Vulnerable Wazuh [CVE-2025-24016]	An unsafe deserialization vulnerability allows for remote code execution on Wazuh servers. The vulnerability can be triggered by anybody with API access (compromised dashboard or Wazuh servers in the cluster) or, in certain configurations, even by a compromised agent.	ASM query: risks.name: `Vulnerable Wazuh [CVE-2025-24016]`
risk	Vulnerable Roundcube [CVE-2025-49113]	This is a Roundcube server running a version of Roundcube that is vulnerable to CVE-2025-49113. Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.	ASM query: risks.name: `Vulnerable Roundcube [CVE-2025-49113]`