Week of September 29, 2025

CVE-2025-27237 is a local privilege escalation vulnerability in Zabbix Agent and Agent 2 on Windows. The agents load OpenSSL configuration from a world-writable directory, allowing a low-privileged attacker to inject a malicious DLL via a crafted openssl.cnf file. The DLL executes with the privileges of the Zabbix Agent service, typically LocalSystem, leading to full system compromise.

A security researcher demonstrates a simple method to evade Windows Defender detection by encrypting a msfvenom-generated payload with AES-256-CBC. The technique involves generating a random key and IV, encrypting the shellcode, and then decrypting it at runtime before injection. This bypasses static signature-based detection without requiring advanced evasion like indirect syscalls or IAT obfuscation.

CVE-2025-61932 is a critical remote code execution vulnerability in Motex Lanscope Endpoint Manager (On-Premises) affecting the Client program (MR) and Detection agent (DA) components. The flaw stems from improper verification of request origins, allowing unauthenticated attackers to execute arbitrary code via specially crafted network packets. Active exploitation has been observed, and the vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.

Cybercriminals are deploying malicious Windows Defender Application Control (WDAC) policies to block EDR executables, drivers, and services, effectively disabling endpoint detection. The technique, previously a proof-of-concept called Krueger, is now used in active malware like DreamDemon, targeting EDR products including CrowdStrike and Microsoft Defender for Endpoint. This bypass undermines the detect-and-respond model by blinding sensors before they initialize.