Log4J is a free and open-source logging library widely used by companies large and small. Officially designated CVE-2021-44228, the 0-day vulnerability was first publicly disclosed on December 9th, 2021. Bitdefender researchers stated that exploitation of the bug allows cybercriminals to “download and run scripts on targeted servers, leaving them open to complete remote control.” Meaning that attackers can remotely exploit it without any input from the victim, and it doesn’t require high-level technical expertise to pull off. For these reasons, the Log4J Vulnerability has received the highest severity rating on the Common Vulnerability Scoring System Scale – a 10/10.
While emergency patches and updates started being issued almost immediately, experts fear that this is just the beginning as a second vulnerability (CVE-2021-45046) has already been discovered. So what is SWICKtech doing to help mitigate risks?
- SWICKtech reviewed managed FortiGate firewalls for all contracted agreement clients. Where necessary, security patches that were released by manufacturers were updated. The patches allow for the firewalls to scan for the vulnerability and help stop them at the network level. Applications and ERP systems that use Log4j are being reviewed by many vendors in response. It is critical organizations keep a watchful eye out for any correspondence for direction from software vendors to update software versions or suggestions to limit exposure to the vulnerability. Should you or your employees receive notes from a software vendor in response to Log4j, please forward to helpdesk@SWICKtech.com and our SWICKtech Security and Operations Center (SOC) will review.
- SWICKtech SOC has reviewed all SWICKtech software on customer systems for this vulnerability to ensure there are no issues. In addition, our detection and prevention systems are already updated to detect any issues if they arise.
As we learn more about the vulnerability, we will be diligently staying on top of this for our clients. Thank you for placing your trust in SWICKtech. Your security and data are important to us. You can learn more about this vulnerability here. If you have any questions regarding your systems or this vulnerability, please contact us at 414-527-9266, option 1 or Helpdesk@SWICKtech.com.
