CVE-2024-28000Active Exploitation(litespeedtech / litespeed_cache)

MEDIUMCVSS 9.8 · CRITICAL

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Patch litespeedtech litespeed_cache systems immediately
Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache.This issue affects LiteSpeed Cache: from n/a through <= 6.3.0.1.

litespeedtech CVEs Back to dashboard

4.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-266

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

litespeed_cache

Threat summary

Active exploitation appears in 3 classified signals
Patch or workaround signal is available
3 mentions across 3 observed days
Momentum state: stable

What's happening

Active exploitation reported across 3 signals
Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
Peaked 2d ago at 1 mentions (2026-08-27); latest day: 1
3 total mentions across 3 days

Affected systems

Vendors

litespeedtech

Products

litespeed_cache

Deep dive

Activity timeline3 mentions / 3d

Signal classification1 categories

Active Exploitation

3100.0%

Referenced assets2 URLs

By indicator

Full discourse3 posts

Divinmentis@Divinmentis44d
Active Exploitation
https://Hunt.io says the nuclear target’s ownCloud was accessed through CVE-2023-49105 and the naval supplier’s WordPress through CVE-2024-28000 plus password attacks. A CSV referenced roughly 9 GB from the nuclear body; 372 MB was visible. https://t.co/TeC0nALYWD
Post summary
Hunt.io reports that a nuclear target’s ownCloud and a naval supplier’s WordPress were compromised via CVE-2023-49105 and CVE-2024-28000, respectively, with significant data exposure, indicating active exploitation.
1000039
54 followersView on X
BT Haberler@BTHaberler41d
Active Exploitation
Çin Bağlantılı Hackerlar, Filipinler'in Nükleer Araştırma Kurumunu ownCloud Açığıyla Hedef Aldı! Çin kökenli bir tehdit aktörü, dosya paylaşım platformu ownCloud'daki CVE-2023-49105 (CVSS 9.8) kimlik doğrulama atlatma açığını kullanarak Filipinler'in nükleer araştırma kurumunu ve bir denizcilik mühendisliği şirketini hedef aldı. • Açık, ownCloud'un WebDAV API'sinde önceden imzalanmış URL'ler aracılığıyla çalışıyor; kullanıcı adı biliniyorsa ve imzalama anahtarı yapılandırılmamışsa (bu varsayılan durum), saldırganlar kimlik doğrulaması olmadan dosyalara erişebiliyor. • Kampanyada ayrıca eski bir WordPress açığı (CVE-2024-28000) da kullanıldı. Yıllar önce açıklanmış bir açığın hâlâ nükleer araştırma gibi son derece hassas bir kurumu hedef almak için kullanılabilmesi, kritik bilimsel kurumların bile temel yama yönetiminde geride kalabildiğini gösteriyor. #SiberGüvenlik #Çin #KritikAltyapı
Post summary
Chinese threat actors leveraged ownCloud CVE‑2023‑49105 to gain unauthorized access to a Philippine nuclear research facility and a maritime engineering company, detailing the exploitation vector but providing no PoC or patch information.
0000033
41 followersView on X
The Daily Tech Feed@dailytechonx46d
Active Exploitation
Serious breach: Chinese-speaking hackers exploited CVE-2023-49105 in ownCloud and CVE-2024-28000 in WordPress to steal reactor files, employee data, and full archives from a Philippine nuclear agency and naval contractor. Patch ownCloud 10.13.3+, update LiteSpeed Cache to 6.4+, disable XML-RPC when not needed, enforce MFA, monitor WebDAV activity. #SecurityNews #CyberAttack #ownCloud #WordPress #Vulnerability #Philippines https://thedailytechfeed.com/chinese-speaking-hackers-exfiltrate-philippine-nuclear-naval-data-via-owncloud-wordpress-flaws/
Post summary
The article reports Chinese-speaking hackers actively exploiting CVE‑2023‑49105 in ownCloud and CVE‑2024‑28000 in WordPress to steal sensitive files from a Philippine nuclear agency, and it advises specific patches and mitigations.
0000076
663 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	litespeedtech	litespeed_cache	-	wordpress	-

Explore more

Back to dashboard litespeedtech CVEs litespeed_cache vulnerabilities

What researchers are saying

CVE-2024-28000

Divinmentis[verified]@DivinmentisActive Exploitation

Hunt.io reports that a nuclear target’s ownCloud and a naval supplier’s WordPress were compromised via CVE-2023-49105 and CVE-2024-28000, respectively, with significant data exposure, indicating active exploitation.

BT Haberler[verified]@BTHaberlerActive Exploitation

Chinese threat actors leveraged ownCloud CVE‑2023‑49105 to gain unauthorized access to a Philippine nuclear research facility and a maritime engineering company, detailing the exploitation vector but providing no PoC or patch information.

The Daily Tech Feed[verified]@dailytechonxActive Exploitation

The article reports Chinese-speaking hackers actively exploiting CVE‑2023‑49105 in ownCloud and CVE‑2024‑28000 in WordPress to steal sensitive files from a Philippine nuclear agency, and it advises specific patches and mitigations.