The 10 vulnerabilities can affect specialized IT units of ministries, branches and localities; state-owned economic groups and general corporations, banks and financial institutions. These are included on the April 2023 list of patches issued by Microsoft.

These include CVE-2023-21554 in Microsoft Message Queuing, holes CVE-2023-23384, CVE-2023-23375 and CVE-2023- 28304 on Microsoft SQL Server and holes CVE-2023-28287 and CVE-2023-28295 on Microsoft Publisher which all allow hackers to conduct remote code execution (RCE) attacks.

Meanwhile, CVE-2023-28309 and CVE-2023-28314 on Microsoft 2 Dynamics 365 allow hackers to conduct Cross Site Scripting (XSS) attacks. This is a technique that exploits websites’ holes to run attack codes on users' machines in order to steal data.

As for CVE-2023-28252 in Windows Common Log File System Driver, experts said the hackers can carry out privilege escalation attacks.

The new flaw has been used in supply chain attacks in software of 3CX.

Microsoft has provided a patch for verifying the authenticity of signatures under the on/off option. In this update, Microsoft has added the affected operating system versions. 

Users can enable this check option to improve information security for devices using the Windows operating system.

To ensure safety of information systems, AIS has recommended that organizations need to check the computers using Windows operating systems which may be affected, and update patches to avoid the risk of being attacked.

“The best solution is updating patches for these vulnerabilities as instructed by Microsoft,” AIS said.

Agencies, organizations and businesses have also been requested to strengthen supervision and take actions as soon as they see signs of being attacked. At the same time, they need to keep close watch over warnings by agencies and large institutions on information security to discover cyber-attack risks.

Vu Ngoc Son from Vietnam National Cyber Security Technology Corporation said vulnerabilities in software are the path for hackers to carry out advanced persistent threat (APT) attacks in Vietnam.

Hackers may begin attacks by exploiting holes from less important computers, from branches and partners which have connections with major systems, and use them as the jumping board to collect information and seek opportunities to attack major systems.

“Therefore, the updating of patches is very important which helps protect networks from a distance and avoid APT risks,” he said.

Trong Dat