Description:

CVE-2024-1853 is an Arbitrary Process Termination vulnerability in Zemana AntiLogger v2.74.204.664. It allows an attacker to terminate arbitrary processes by triggering the 0x80002048 IOCTL code of the zam64.sys and zamguard64.sys drivers. The SVRS of 30 indicates a moderate risk, requiring attention but not immediate action.

Key Insights:

• Exploitation: Active exploits have been published, making this vulnerability a potential threat to organizations using Zemana AntiLogger.
• Impact: Successful exploitation could allow attackers to terminate critical processes, leading to system instability or data loss.
• Affected Systems: The vulnerability affects Zemana AntiLogger v2.74.204.664 and earlier versions.
• Threat Actors: No specific threat actors or APT groups have been identified as actively exploiting this vulnerability.

Mitigation Strategies:

• Update Software: Install the latest version of Zemana AntiLogger (v2.74.204.665 or later) to patch the vulnerability.
• Disable Vulnerable Drivers: Temporarily disable the zam64.sys and zamguard64.sys drivers until a patch is available.
• Monitor Systems: Implement security monitoring tools to detect any suspicious activity or unauthorized process terminations.
• Educate Users: Inform users about the vulnerability and advise them to be cautious of suspicious emails or attachments.

Additional Information:

• The Cybersecurity and Infrastructure Security Agency (CISA) has not issued a warning for this vulnerability.
• The vulnerability is not currently being actively exploited in the wild.

If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.