Flaws added in December 2024
From Exploited flaws, HARD’s guide to the flaws being used in attacks
This article lists the flaws CISA added in December 2024. For the newest, see Exploited flaws.
In December 2024, CISA added 16 flaws to its list of vulnerabilities being used in attacks, 3 of them in things people have at home; 4 have been used by ransomware gangs. Most came from NUUO (2), Reolink (2) and Cleo (2).[1]
Most let an attacker take over the product, running their own code or taking full control.
List of flaws
Every flaw CISA added in December 2024, newest first, in plain English, each with an article of its own.[2] marks the ones used in ransomware.
Show
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-3393At work |
Palo Alto Networks PAN-OS. Attackers can crash Palo Alto Networks PAN-OS or stop it working from anywhere, without logging in. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2021-44207At work |
Acclaim Systems USAHERDS. Attackers can run their own code on Acclaim Systems USAHERDS. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-12356At work |
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS). Attackers can run commands on BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) from anywhere, without logging in. | At work |
4 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2022-23227At work |
NUUO NVRmini2 Devices. Attackers can run their own code on NUUO NVRmini2 Devices from anywhere, without logging in. | At work |
CVE-2021-40407At work |
Reolink RLC-410W IP Camera. Attackers can run commands on Reolink RLC-410W IP Camera. | At work |
CVE-2019-11001At work |
Reolink Multiple IP Cameras. Attackers can run commands on Reolink Multiple IP Cameras. | At work |
CVE-2018-14933At work |
NUUO NVRmini Devices. Attackers can run commands on NUUO NVRmini Devices. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-55956† Used in ransomwareAt work |
Cleo products. Attackers can upload a file to Cleo products from anywhere, without logging in and make it run. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-35250At home |
Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. | At home |
CVE-2024-20767At work |
Adobe ColdFusion. Attackers can reach parts of Adobe ColdFusion that should be locked to them. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-50623† Used in ransomwareAt work |
Cleo products. Attackers can run their own code on Cleo products. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-49138At home |
Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. | At home |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-51378† Used in ransomwareAt work |
CyberPersons CyberPanel. Attackers can run commands on CyberPersons CyberPanel. | At work |
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-11680At work |
ProjectSend. Attackers can get into ProjectSend without a valid password. | At work |
CVE-2024-11667† Used in ransomwareAt home |
Zyxel Multiple Firewalls. Attackers can read files on Zyxel Multiple Firewalls that should be out of reach. | At home |
CVE-2023-45727At work |
North Grid Proself. Attackers can read files on North Grid Proself that should be out of reach from anywhere, without logging in. | At work |
Companies
The flaws were in twelve companies’ products; the most were in Cleo’s (2).
| Company | Flaws | Ransomware |
|---|---|---|
| Cleo | 2 | 2 |
| Microsoft | 2 | – |
| NUUO | 2 | – |
| Reolink | 2 | – |
| Acclaim Systems | 1 | – |
| Adobe | 1 | – |
| BeyondTrust | 1 | – |
| CyberPersons | 1 | 1 |
| North Grid | 1 | – |
| Palo Alto Networks | 1 | – |
| ProjectSend | 1 | – |
| Zyxel | 1 | 1 |
Other months
Every month since CISA started the list; December 2024 is outlined.
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2026 | 17 | 28 | 26 | 31 | 21 | 23 | 26 | 31 | 43 | 36 | 282 | ||
| 2025 | 14 | 27 | 32 | 15 | 24 | 20 | 20 | 15 | 16 | 31 | 11 | 20 | 245 |
| 2024 | 21 | 9 | 10 | 10 | 14 | 9 | 14 | 19 | 25 | 17 | 22 | 16 | 186 |
| 2023 | 5 | 14 | 18 | 17 | 19 | 24 | 16 | 8 | 19 | 18 | 18 | 11 | 187 |
| 2022 | 40 | 32 | 226 | 45 | 83 | 48 | 3 | 23 | 24 | 12 | 10 | 9 | 555 |
| 2021 | 291 | 20 | 311 |
References
- ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
- ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.
See also Exploited flaws, Companies, and Search for any app or company.