Focus Friday: Fortifying TPRM Against Kernel Compromise, Buffer Overflow, and Directory Traversal Vulnerabilities
Written by: Ferdi Gül
Welcome to this week’s Focus Friday, where we delve into the critical realm of Third-Party Risk Management (TPRM) in the face of emerging cyber threats. This edition addresses three significant vulnerabilities that demand immediate attention from TPRM professionals: a kernel compromise in Juniper Junos OS, a buffer overflow in the MongoDB C driver, and a directory traversal vulnerability in SAP NetWeaver AS Java. Each of these vulnerabilities presents unique challenges and risks, and we’ll explore how Black Kite’s FocusTags? can empower organizations to effectively mitigate these threats.
CVE-2025-21590: Juniper Junos OS Kernel Compromise
What is the Juniper Junos OS Kernel Compromise?
CVE-2025-21590 is a medium-severity improper isolation or compartmentalization vulnerability within the Juniper Junos OS kernel. This flaw allows an attacker with shell access to inject malicious code silently, thereby compromising the integrity and persistence of Juniper MX routers. The vulnerability has a CVSS score of 6.7 and an EPSS score of 5.75%. This issue was first published in March 2025 and has been actively exploited in the wild by the Chinese nation-state threat group UNC3886. CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on March 13, 2025. Juniper has released an out-of-cycle security bulletin, JSA93446, addressing this issue.
View the IoC Table for Juniper Junos OS Vulnerability on our blog.
Why Should TPRM Professionals Care?
Compromised Juniper MX routers, often found in critical infrastructure like telecom and ISP networks, pose a significant risk. These devices, when compromised, can lead to substantial data breaches, service disruptions, and the potential for persistent backdoors. Given that these routers manage critical network traffic, a successful attack could result in the exfiltration of sensitive data, manipulation of network traffic, and potential disruption of essential services. The fact that threat actors have replaced critical binaries, such as TACACS+, and bypassed security protections demonstrates the sophistication and potential impact of this vulnerability.
What Questions Should TPRM Professionals Ask Vendors About the Vulnerability?
To assess the risk posed by CVE-2025-21590, TPRM professionals should ask vendors:
Remediation Recommendations for Vendors Subject to This Risk
Vendors should take the following actions to mitigate the risk:
How TPRM Professionals Can Leverage Black Kite for This Vulnerability
Black Kite released the “Juniper Junos OS – Mar2025” FocusTag to help organizations identify vendors potentially exposed to CVE-2025-21590. This tag, published in March 2025, allows TPRM professionals to quickly identify vendors using vulnerable Juniper MX routers. Black Kite provides asset information, including IP addresses and subdomains, that may be affected, enabling targeted remediation efforts. By leveraging this FocusTag, organizations can efficiently prioritize vendor outreach and mitigation efforts, reducing the time and resources required for risk assessment. Black Kite’s ability to pinpoint specific vulnerable assets within a vendor’s infrastructure is a key differentiator, providing actionable intelligence for effective TPRM.
CVE-2017-12637: SAP NetWeaver AS Java Directory Traversal
What is the SAP NetWeaver AS Java Directory Traversal Vulnerability?
CVE-2017-12637 is a high-severity directory traversal vulnerability found in the scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS component of SAP NetWeaver Application Server Java 7.5. This flaw allows remote attackers to read arbitrary files on the server by exploiting a “.. (dot dot)” sequence in the query string. The vulnerability has been actively exploited in the wild since August 2017. Although systems might have applied the initial patch from SAP Security Note 2486657, the vulnerability can still be triggered through specific URLs. This issue affects SAP NetWeaver AS for JAVA, version ADSSSAP 7.50. The vulnerability was added to CISA’s Known Exploited Vulnerabilities catalog on March 19, 2025. The CVSS score for the vulnerability is 7.5, and the EPSS score is 80.11%.
Why Should TPRM Professionals Care?
A directory traversal vulnerability in SAP NetWeaver AS Java can lead to the unauthorized disclosure of sensitive files, potentially exposing critical business data. Given that SAP NetWeaver is widely used in enterprise environments, a successful exploit could result in significant data breaches and compromise sensitive information. The ability of attackers to read arbitrary files on the server poses a substantial risk to data confidentiality. Therefore, TPRM professionals must ensure that vendors using SAP NetWeaver AS Java have implemented the necessary security measures to mitigate this vulnerability.
What Questions Should TPRM Professionals Ask Vendors About the Vulnerability?
To assess the risk posed by CVE-2017-12637, TPRM professionals should ask vendors:
Remediation Recommendations for Vendors Subject to This Risk
Vendors should take the following actions to mitigate the risk:
How TPRM Professionals Can Leverage Black Kite for This Vulnerability
Black Kite released the “SAP NetWeaver JAVA – Mar2025” FocusTag to help organizations identify vendors potentially exposed to CVE-2017-12637. This tag, published on March 20, 2025, allows TPRM professionals to quickly identify vendors using vulnerable versions of SAP NetWeaver AS Java 7.5. Black Kite provides asset information, including IP addresses and subdomains, that may be affected. By leveraging this FocusTag, organizations can efficiently prioritize vendor outreach and mitigation efforts, reducing the time and resources required for risk assessment. Black Kite’s ability to pinpoint specific vulnerable assets within a vendor’s infrastructure is a key differentiator, providing actionable intelligence for effective TPRM.
CVE-2025-0755: MongoDB C Driver Buffer Overflow
What is the MongoDB C Driver Buffer Overflow?
CVE-2025-0755 is a high-severity buffer overflow vulnerability found in the bson_append functions of the MongoDB C driver library (libbson). This vulnerability arises from inadequate memory overflow protection when creating BSON documents that exceed the maximum allowable size (INT32_MAX). Exploitation of this flaw can lead to application crashes. The vulnerability has a CVSS score of 8.4 and an EPSS score of 0.01%. This vulnerability was first disclosed on July 21, 2024. Currently, there is no public proof-of-concept (PoC) exploit code available, and CVE-2025-0755 has not been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog. Affected versions include libbson prior to 1.27.5, MongoDB Server versions prior to 8.0.1 (8.0 line), and MongoDB Server versions prior to 7.0.16 (7.0 line).
Why Should TPRM Professionals Care?
A buffer overflow within the MongoDB C driver can lead to application instability and potential service disruptions. Given that MongoDB is widely used for data storage in various applications, a crash could impact critical business operations. The vulnerability’s presence in the underlying libbson library means that numerous applications relying on MongoDB are potentially at risk. This can lead to data integrity issues and potential denial-of-service scenarios. Therefore, TPRM professionals should ensure that vendors using MongoDB have applied the necessary patches to mitigate this risk.
What Questions Should TPRM Professionals Ask Vendors About the Vulnerability?
To assess the risk posed by CVE-2025-0755, TPRM professionals should ask vendors:
Remediation Recommendations for Vendors Subject to This Risk
Vendors should take the following actions to mitigate the risk:
How TPRM Professionals Can Leverage Black Kite for This Vulnerability
Black Kite released the “SAP NetWeaver JAVA – Mar2025” FocusTag to assist organizations in identifying vendors potentially exposed to CVE-2025-0755. This tag, published on July 21, 2024, enables TPRM professionals to quickly identify vendors using vulnerable versions of MongoDB. Black Kite provides asset information, including IP addresses and subdomains, that may be affected. By leveraging this FocusTag, organizations can efficiently prioritize vendor outreach and mitigation efforts, reducing the time and resources required for risk assessment. Black Kite’s ability to pinpoint specific vulnerable assets within a vendor’s infrastructure is a key differentiator, providing actionable intelligence for effective TPRM.
Streamlining TPRM with Black Kite’s FocusTags?
In the dynamic landscape of cybersecurity, maintaining robust Third-Party Risk Management (TPRM) strategies is paramount. Black Kite’s FocusTags? serve as an essential tool, offering real-time insights and actionable data to effectively manage emerging threats. This week’s vulnerabilities in Juniper Junos OS, MongoDB, and SAP NetWeaver highlight the necessity of proactive risk assessment and mitigation.
Here’s how Black Kite’s FocusTags? enhance TPRM:
Black Kite’s FocusTags? transform complex cybersecurity data into actionable intelligence, enabling TPRM professionals to proactively address vulnerabilities and strengthen their defense against evolving cyber threats. By providing specific asset information, including IP addresses and subdomains, Black Kite enables precision in risk mitigation, a critical advantage in today’s threat landscape.
Want to take a closer look at FocusTags??
Take our platform for a test drive and request a demo today.
About Focus Friday
Every week, we delve into the realms of critical vulnerabilities and their implications from a Third-Party Risk Management (TPRM) perspective. This series is dedicated to shedding light on pressing cybersecurity threats, offering in-depth analyses, and providing actionable insights.
FocusTagsTM in the Last 30 Days: