Week of January 6, 2025

A new open-source tool named Nyx-BlindEdr has been published on GitHub, designed to blind Endpoint Detection and Response (EDR) systems by clearing kernel callbacks. The project is intended for educational purposes and demonstrates a technique to disable security product functionality on Windows.

CVE-2025-0282 is a stack-based buffer overflow in the IF-T/TLS protocol handler of Ivanti Connect Secure, Policy Secure, and Neurons for ZTA gateways. It allows remote unauthenticated attackers to achieve code execution as a non-root user. The vulnerability has been exploited in the wild by a state-sponsored actor, and a public proof-of-concept exists.

IBM disclosed multiple vulnerabilities in QRadar EDR 3.12, including ReDoS, resource exhaustion, path traversal, and denial of service in third-party libraries like cross-spawn, Starlette, Werkzeug, OpenSSL, and axios. These flaws could allow remote attackers to cause denial of service or, in one case, potential unauthorized data access on Windows. IBM released version 3.12.14 to address all issues.