Phalanx

Detailed View

CRITICAL PHX-001 — SQL Injection (Error-Based)

Remediation: Use parameterized queries or prepared statements. Never concatenate user input into SQL strings. Apply least-privilege DB accounts. Deploy a WAF with SQLi rules.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A03:2021 – Injection

OWASP API: API3:2023 – Injection

MITRE ATT&CK: T1190 (Initial Access), T1059 (Execution)

NIST 800-53: SI-10, SA-11, RA-5

PCI DSS 4: 6.2.4, 6.3.2

HIGH PHX-002 — Reflected Cross-Site Scripting (XSS)

Remediation: Encode all output in the appropriate context (HTML, JS, CSS, URL). Use Content Security Policy headers. Validate and sanitize input server-side.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

OWASP Web: A03:2021 – Injection

OWASP API: API3:2023 – Injection

MITRE ATT&CK: T1189 (Initial Access), T1059.007 (Execution)

NIST 800-53: SI-10, SC-18

PCI DSS 4: 6.2.4

HIGH PHX-003 — XML External Entity Injection (XXE)

Remediation: Disable XML external entity processing in all XML parsers. Use less complex data formats such as JSON. Patch or upgrade all XML processors and libraries.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

OWASP Web: A05:2021 – Security Misconfiguration

OWASP API: API3:2023 – Injection

MITRE ATT&CK: T1190 (Initial Access), T1083 (Discovery)

NIST 800-53: SI-10, CM-6

PCI DSS 4: 6.2.4

CRITICAL PHX-004 — Server-Side Template Injection (SSTI)

Remediation: Never allow user-controlled input to be passed directly to template engines. Use logic-less templates. Sandbox template execution environments.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A03:2021 – Injection

OWASP API: API3:2023 – Injection

MITRE ATT&CK: T1190 (Initial Access), T1059 (Execution)

NIST 800-53: SI-10, SA-11

PCI DSS 4: 6.2.4

HIGH PHX-005 — LDAP Injection

Remediation: Escape all special characters in LDAP queries. Use parameterized LDAP APIs. Validate input against a strict allowlist before passing to directory queries.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A03:2021 – Injection

MITRE ATT&CK: T1190 (Initial Access), T1110 (Credential Access)

NIST 800-53: SI-10

PCI DSS 4: 6.2.4

CRITICAL PHX-006 — OS Command Injection

Remediation: Avoid passing user input to OS commands. Use safe APIs that do not invoke shells. If shell is unavoidable, validate against a strict allowlist and escape all metacharacters.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A03:2021 – Injection

OWASP API: API3:2023 – Injection

MITRE ATT&CK: T1190 (Initial Access), T1059 (Execution)

NIST 800-53: SI-10, CM-6, SA-11

PCI DSS 4: 6.2.4

CISA KEV

HIGH PHX-007 — NoSQL Injection

Remediation: Sanitize and validate all input before passing to NoSQL query constructors. Use ODM libraries that enforce typed queries. Restrict MongoDB operators ($where, $regex) in user-supplied data.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

OWASP Web: A03:2021 – Injection

OWASP API: API3:2023 – Injection

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: SI-10

PCI DSS 4: 6.2.4

HIGH PHX-008 — Broken Authentication – No Account Lockout

Remediation: Implement account lockout after 5–10 failed attempts with progressive delays. Use CAPTCHA for public-facing login. Enforce MFA for all user accounts.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A07:2021 – Identification and Authentication Failures

OWASP API: API2:2023 – Broken Authentication

MITRE ATT&CK: T1110 (Credential Access), T1110.003 (Credential Access)

NIST 800-53: AC-7, IA-5

PCI DSS 4: 8.3.4

HIGH PHX-009 — Session Fixation

Remediation: Invalidate and regenerate session tokens immediately after successful authentication. Set Secure, HttpOnly, and SameSite flags on session cookies.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

OWASP Web: A07:2021 – Identification and Authentication Failures

OWASP API: API2:2023 – Broken Authentication

MITRE ATT&CK: T1563 (Lateral Movement), T1550.004 (Defense Evasion)

NIST 800-53: AC-12, IA-5

PCI DSS 4: 8.3.6

CRITICAL PHX-010 — JWT None Algorithm Accepted

Remediation: Reject JWTs with 'none' algorithm. Explicitly whitelist accepted algorithms (HS256 or RS256). Validate the 'alg' header server-side before verifying the signature.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A07:2021 – Identification and Authentication Failures

OWASP API: API2:2023 – Broken Authentication

MITRE ATT&CK: T1550.001 (Defense Evasion)

NIST 800-53: IA-5, SC-8

PCI DSS 4: 4.2.1, 8.3.6

HIGH PHX-011 — OAuth Misconfiguration – Open Redirect in Redirect URI

Remediation: Enforce strict redirect_uri validation — exact string match against a pre-registered whitelist. Reject wildcard or partial-match redirect URIs. Use state parameter to prevent CSRF.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

OWASP Web: A07:2021 – Identification and Authentication Failures

OWASP API: API2:2023 – Broken Authentication

MITRE ATT&CK: T1550.001 (Defense Evasion), T1189 (Initial Access)

NIST 800-53: IA-5, SC-8

PCI DSS 4: 8.3.6

HIGH PHX-012 — Insecure Direct Object Reference (IDOR)

Remediation: Enforce authorization checks on every object access server-side. Use indirect reference maps (GUIDs instead of sequential IDs). Never rely on obscurity of object identifiers.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A01:2021 – Broken Access Control

OWASP API: API1:2023 – Broken Object Level Authorization

MITRE ATT&CK: T1078 (Defense Evasion)

NIST 800-53: AC-3, AC-4

PCI DSS 4: 6.2.4, 7.2.1

MEDIUM PHX-013 — Weak Password Policy

Remediation: Enforce a minimum password length of 12 characters with complexity requirements. Check passwords against known-breached password lists (HIBP). Encourage passphrases.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A07:2021 – Identification and Authentication Failures

OWASP API: API2:2023 – Broken Authentication

MITRE ATT&CK: T1110.001 (Credential Access)

NIST 800-53: IA-5

PCI DSS 4: 8.3.6

HIGH PHX-014 — Broken Object Level Authorization (BOLA)

Remediation: Enforce per-request object ownership validation. Do not trust client-supplied object IDs without authorization checks. Use UUIDs and validate ownership against the authenticated user's context.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

OWASP API: API1:2023 – Broken Object Level Authorization

MITRE ATT&CK: T1078 (Defense Evasion)

NIST 800-53: AC-3

PCI DSS 4: 7.2.1

HIGH PHX-015 — Broken Function Level Authorization (BFLA)

Remediation: Implement role-based access control for every API endpoint. Deny by default — explicitly grant access to admin/sensitive functions. Audit all sensitive function calls.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A01:2021 – Broken Access Control

OWASP API: API5:2023 – Broken Function Level Authorization

MITRE ATT&CK: T1078 (Privilege Escalation), T1068 (Privilege Escalation)

NIST 800-53: AC-3, AC-6

PCI DSS 4: 7.2.1

HIGH PHX-016 — Mass Assignment Vulnerability

Remediation: Use explicit allowlists (DTOs) to control which fields can be bound from requests. Never bind internal/privileged fields (isAdmin, role, credit) from user input directly.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A01:2021 – Broken Access Control

OWASP API: API6:2023 – Unrestricted Access to Sensitive Business Flows

MITRE ATT&CK: T1078 (Privilege Escalation)

NIST 800-53: AC-3, SI-10

PCI DSS 4: 6.2.4

CRITICAL PHX-017 — Privilege Escalation – Vertical

Remediation: Enforce strict role checks server-side before executing privileged operations. Audit role assignment logic. Apply principle of least privilege across all user roles.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

OWASP Web: A01:2021 – Broken Access Control

OWASP API: API5:2023 – Broken Function Level Authorization

MITRE ATT&CK: T1068 (Privilege Escalation)

NIST 800-53: AC-6, AC-3

PCI DSS 4: 7.2.1

HIGH PHX-018 — Path Traversal

Remediation: Canonicalize file paths and validate against an allowed base directory. Use chroot jails. Never allow user input to determine file paths directly.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A01:2021 – Broken Access Control

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1083 (Discovery), T1190 (Initial Access)

NIST 800-53: AC-3, SI-10

PCI DSS 4: 6.2.4

CISA KEV

MEDIUM PHX-019 — Weak TLS Configuration

Remediation: Disable TLS 1.0 and TLS 1.1. Enforce TLS 1.2 as minimum with TLS 1.3 preferred. Disable SSLv2/SSLv3. Configure strong cipher suites only.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A02:2021 – Cryptographic Failures

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1557 (Collection)

NIST 800-53: SC-8, SC-28, IA-5

PCI DSS 4: 4.2.1

MEDIUM PHX-020 — SSL Certificate Expired or Self-Signed

Remediation: Replace expired or self-signed certificates with CA-signed certificates. Implement certificate lifecycle management with automated renewal (e.g., Let's Encrypt with ACME).

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

OWASP Web: A02:2021 – Cryptographic Failures

OWASP API: API8:2023 – Security Misconfiguration

NIST 800-53: SC-8, IA-3

PCI DSS 4: 4.2.1

MEDIUM PHX-021 — Weak Cipher Suite Enabled

Remediation: Disable all EXPORT, NULL, RC4, and DES ciphers. Configure a strong cipher suite order (ECDHE+AESGCM preferred). Use tools like Mozilla SSL Config Generator.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A02:2021 – Cryptographic Failures

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1557 (Collection)

NIST 800-53: SC-8, SC-28

PCI DSS 4: 4.2.1

HIGH PHX-022 — Cleartext Transmission of Sensitive Data

Remediation: Enforce HTTPS for all communications. Implement HSTS with a long max-age. Redirect all HTTP traffic to HTTPS. Never transmit credentials, tokens, or PII over unencrypted channels.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A02:2021 – Cryptographic Failures

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1557 (Collection), T1040 (Credential Access)

NIST 800-53: SC-8, SC-28

PCI DSS 4: 4.2.1, 4.2.2

HIGH PHX-023 — Insecure Password Hashing (MD5/SHA1)

Remediation: Replace MD5/SHA1 password hashing with bcrypt, scrypt, or Argon2. Add unique per-user salts. Migrate existing hashes on next login.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A02:2021 – Cryptographic Failures

MITRE ATT&CK: T1110.002 (Credential Access)

NIST 800-53: IA-5, SC-28

PCI DSS 4: 8.3.2

CRITICAL PHX-024 — Default Credentials in Use

Remediation: Change all default credentials immediately on deployment. Enforce password change on first login. Maintain an asset inventory to track devices/services with known default credentials.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A05:2021 – Security Misconfiguration

OWASP API: API2:2023 – Broken Authentication

MITRE ATT&CK: T1078.001 (Initial Access)

NIST 800-53: IA-5, CM-6

PCI DSS 4: 8.3.1, 2.2.1

CISA KEV

HIGH PHX-025 — Debug Endpoint Exposed

Remediation: Disable or restrict all debug endpoints in production. Remove phpinfo() calls. Restrict Spring Boot Actuator endpoints to internal IPs only. Use environment-specific configuration.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A05:2021 – Security Misconfiguration

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1595 (Reconnaissance), T1592 (Reconnaissance)

NIST 800-53: CM-6, CM-7

PCI DSS 4: 6.2.4, 2.2.1

MEDIUM PHX-026 — Verbose Error Messages Exposing Internals

Remediation: Configure generic error pages for production. Log detailed errors server-side only. Never expose stack traces, SQL errors, or framework details to users.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 – Security Misconfiguration

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1592 (Reconnaissance)

NIST 800-53: CM-6, SI-11

PCI DSS 4: 6.2.4

HIGH PHX-027 — CORS Misconfiguration – Wildcard Origin Allowed

Remediation: Restrict CORS to explicitly defined, trusted origins. Never use wildcard (*) with credentials. Validate the Origin header against a server-side allowlist.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

OWASP Web: A05:2021 – Security Misconfiguration

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1189 (Initial Access)

NIST 800-53: CM-6, SC-8

PCI DSS 4: 6.2.4

MEDIUM PHX-028 — Missing HTTP Security Headers

Remediation: Add Content-Security-Policy, Strict-Transport-Security, X-Frame-Options (DENY), X-Content-Type-Options (nosniff), and Referrer-Policy headers to all responses.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

OWASP Web: A05:2021 – Security Misconfiguration

NIST 800-53: CM-6, SC-18

PCI DSS 4: 6.2.4

MEDIUM PHX-029 — Open Port – Unnecessary Service Exposed

Remediation: Close or firewall all ports not required for business operations. Review and document all listening services. Apply network segmentation and default-deny firewall rules.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

MITRE ATT&CK: T1046 (Discovery)

NIST 800-53: CM-7, SA-9

PCI DSS 4: 1.3.1

HIGH PHX-030 — SMB Signing Disabled

Remediation: Enable and require SMB signing on all Windows hosts via Group Policy. This prevents NTLM relay attacks that exploit unsigned SMB traffic.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

MITRE ATT&CK: T1557.001 (Collection)

NIST 800-53: SC-8, IA-3

PCI DSS 4: 4.2.1

CRITICAL PHX-031 — EternalBlue (MS17-010) Vulnerability

Remediation: Apply MS17-010 security update immediately. Disable SMBv1 on all hosts. Block inbound SMB (port 445) at network perimeter.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

MITRE ATT&CK: T1210 (Lateral Movement)

NIST 800-53: SI-2, CM-7

PCI DSS 4: 6.3.3

CISA KEV

HIGH PHX-032 — RDP Exposed to Internet

Remediation: Restrict RDP access to internal networks only. Require VPN for remote access. Enable NLA (Network Level Authentication). Apply all RDP-related security patches.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

MITRE ATT&CK: T1133 (Initial Access), T1021.001 (Lateral Movement)

NIST 800-53: CM-7, AC-17

PCI DSS 4: 1.3.1

CISA KEV

MEDIUM PHX-033 — SSH Weak Configuration

Remediation: Disable password authentication; enforce key-based auth. Disable root login. Restrict SSH to strong key exchange algorithms (curve25519). Limit access by IP/group.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

MITRE ATT&CK: T1110 (Credential Access), T1021.004 (Lateral Movement)

NIST 800-53: AC-17, IA-5, CM-6

PCI DSS 4: 8.3.6, 2.2.7

MEDIUM PHX-034 — DNS Zone Transfer Allowed

Remediation: Restrict zone transfers to authorized secondary name servers only. Configure TSIG (transaction signatures) for zone transfer authentication.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

MITRE ATT&CK: T1590.002 (Reconnaissance)

NIST 800-53: CM-7, SC-20

PCI DSS 4: 1.3.1

CRITICAL PHX-035 — Exposed Credentials in Public GitHub Repository

Remediation: Immediately rotate all exposed credentials. Remove secrets from repository history using git-filter-repo. Implement pre-commit hooks (truffleHog, gitleaks) to prevent future leaks. Use a secrets manager.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A02:2021 – Cryptographic Failures

MITRE ATT&CK: T1552.001 (Credential Access), T1213 (Collection)

NIST 800-53: IA-5, CM-12

PCI DSS 4: 3.4.1, 8.3.2

INFO PHX-036 — Subdomain Enumeration – Internal Subdomains Discovered

Remediation: Review discovered subdomains for unintended exposure. Decommission unused subdomains. Ensure internal services are not reachable from the public internet.

Effort: Moderate

MITRE ATT&CK: T1590.001 (Reconnaissance)

NIST 800-53: CM-8

HIGH PHX-037 — Data Leak – Sensitive Information in Public Paste Site

Remediation: Immediately rotate all exposed credentials. Engage with paste site to remove content. Implement DLP controls and monitor for future exposure via threat intelligence feeds.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A02:2021 – Cryptographic Failures

MITRE ATT&CK: T1589.001 (Reconnaissance)

NIST 800-53: IR-6, IA-5

PCI DSS 4: 3.4.1

CRITICAL PHX-038 — Hardcoded Credentials in Source Code

Remediation: Remove all hardcoded credentials from source code immediately. Rotate exposed secrets. Use a secrets manager (Vault, AWS Secrets Manager). Add pre-commit scanning hooks.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A02:2021 – Cryptographic Failures

OWASP API: API2:2023 – Broken Authentication

MITRE ATT&CK: T1552.001 (Credential Access)

NIST 800-53: IA-5, SA-11

PCI DSS 4: 3.4.1, 8.3.2

CISA KEV

CRITICAL PHX-039 — Insecure Deserialization

Remediation: Do not deserialize untrusted data. Implement integrity checks before deserialization. Use type-safe serialization formats. Apply deserialization allowlists where unavoidable.

Effort: High

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A08:2021 – Software and Data Integrity Failures

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: SI-10, SA-11

PCI DSS 4: 6.2.4

CRITICAL PHX-040 — Unsafe File Upload – Arbitrary File Write

Remediation: Validate file type by content (magic bytes), not extension. Store uploads outside web root. Rename files with random names. Scan uploaded files with antivirus. Never execute uploaded content.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A04:2021 – Insecure Design

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1105 (Command and Control), T1190 (Initial Access)

NIST 800-53: SI-10, CM-6

PCI DSS 4: 6.2.4

HIGH PHX-041 — Vulnerable Third-Party Dependency

Remediation: Update vulnerable dependency to a patched version. Subscribe to security advisories. Integrate SCA scanning into CI/CD pipelines.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A06:2021 – Vulnerable and Outdated Components

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1195.001 (Initial Access)

NIST 800-53: SI-2, SA-12, RA-5

PCI DSS 4: 6.3.3

MEDIUM PHX-042 — API Rate Limiting Absent

Remediation: Implement per-user and per-IP rate limiting on all API endpoints. Apply exponential backoff for authentication endpoints. Return 429 Too Many Requests with Retry-After headers.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

OWASP API: API4:2023 – Unrestricted Resource Consumption

MITRE ATT&CK: T1499 (Impact)

NIST 800-53: SC-5, CM-6

PCI DSS 4: 6.2.4

LOW PHX-043 — API Version Disclosure

Remediation: Maintain an API version inventory. Decommission deprecated API versions. Do not expose internal version strings in responses or error messages.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP API: API9:2023 – Improper Inventory Management

MITRE ATT&CK: T1592 (Reconnaissance)

NIST 800-53: CM-8

MEDIUM PHX-044 — GraphQL Introspection Enabled in Production

Remediation: Disable GraphQL introspection in production environments. Implement query depth limiting and query cost analysis to prevent abuse.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 – Security Misconfiguration

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1592 (Reconnaissance)

NIST 800-53: CM-6, CM-7

PCI DSS 4: 6.2.4

MEDIUM PHX-045 — SOAP Action Spoofing

Remediation: Validate the SOAPAction header against the actual WSDL definition. Reject requests where SOAPAction does not match the endpoint's expected operations.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

OWASP Web: A03:2021 – Injection

OWASP API: API8:2023 – Security Misconfiguration

NIST 800-53: SI-10

PCI DSS 4: 6.2.4

HIGH PHX-046 — Parameter Tampering – Price Manipulation

Remediation: Never trust client-supplied pricing or financial data. Recalculate prices server-side from the product catalog on every transaction. Validate all order parameters against authoritative backend data.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

OWASP Web: A04:2021 – Insecure Design

OWASP API: API6:2023 – Unrestricted Access to Sensitive Business Flows

MITRE ATT&CK: T1565 (Impact)

NIST 800-53: SI-10, AC-3

PCI DSS 4: 6.2.4

HIGH PHX-047 — Race Condition – Time-of-Check to Time-of-Use (TOCTOU)

Remediation: Use atomic operations and database-level locking for critical state transitions. Implement idempotency keys for financial transactions. Apply optimistic locking patterns.

Effort: High

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A04:2021 – Insecure Design

OWASP API: API6:2023 – Unrestricted Access to Sensitive Business Flows

NIST 800-53: SI-10

PCI DSS 4: 6.2.4

MEDIUM PHX-048 — Account Enumeration via Login Response

Remediation: Return identical error messages for invalid username and invalid password. Apply consistent response timing to prevent timing-based enumeration. Use CAPTCHA after repeated failures.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A07:2021 – Identification and Authentication Failures

OWASP API: API2:2023 – Broken Authentication

MITRE ATT&CK: T1589.001 (Reconnaissance)

NIST 800-53: IA-5, SI-11

PCI DSS 4: 8.3.4

HIGH PHX-049 — Cross-Site Request Forgery (CSRF)

Remediation: Implement CSRF tokens on all state-changing requests. Use SameSite=Strict or Lax cookie attribute. Validate Origin and Referer headers for sensitive operations.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

OWASP Web: A01:2021 – Broken Access Control

MITRE ATT&CK: T1189 (Initial Access)

NIST 800-53: SI-10, SC-8

PCI DSS 4: 6.2.4

CRITICAL PHX-050 — Server-Side Request Forgery (SSRF)

Remediation: Validate and sanitize all URLs provided by users. Use an allowlist for permitted destinations. Disable unnecessary URL scheme handlers. Block cloud metadata IP ranges (169.254.169.254).

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

OWASP Web: A10:2021 – Server-Side Request Forgery

OWASP API: API7:2023 – Server Side Request Forgery

MITRE ATT&CK: T1190 (Initial Access), T1552.005 (Credential Access)

NIST 800-53: SI-10, SC-7

PCI DSS 4: 6.2.4

MEDIUM PHX-051 — Open Redirect

Remediation: Validate redirect destinations against a server-side allowlist. Avoid using user-supplied values as redirect targets. Use indirect mapping for permitted redirect targets.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

OWASP Web: A01:2021 – Broken Access Control

MITRE ATT&CK: T1566.002 (Initial Access)

NIST 800-53: SI-10

PCI DSS 4: 6.2.4

MEDIUM PHX-052 — Clickjacking – Missing X-Frame-Options

Remediation: Add X-Frame-Options: DENY or SAMEORIGIN header. Use Content-Security-Policy frame-ancestors directive as the modern equivalent.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

OWASP Web: A05:2021 – Security Misconfiguration

NIST 800-53: SC-18, CM-6

PCI DSS 4: 6.2.4

MEDIUM PHX-053 — HTTP Method Tampering

Remediation: Restrict HTTP methods to only those required by the application (GET, POST). Disable PUT, DELETE, TRACE, and OPTIONS where not needed. Validate method at the authorization layer.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

OWASP Web: A05:2021 – Security Misconfiguration

OWASP API: API8:2023 – Security Misconfiguration

NIST 800-53: CM-6, CM-7

PCI DSS 4: 6.2.4

MEDIUM PHX-054 — Missing Logging and Monitoring

Remediation: Log all authentication events, access control failures, and administrative actions. Centralize logs to a SIEM. Configure alerts for anomalous patterns. Retain logs per compliance requirements.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

OWASP Web: A09:2021 – Security Logging and Monitoring Failures

OWASP API: API10:2023 – Unsafe Consumption of APIs

NIST 800-53: AU-2, AU-3, AU-12, IR-4

PCI DSS 4: 10.2.1, 10.3.1

HIGH PHX-055 — Broken Object Property Level Authorization (BOPLA)

Remediation: Filter API responses to return only fields the requesting user is authorized to see. Use response schemas/DTOs to explicitly whitelist returned fields. Apply property-level access control.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP API: API3:2023 – Broken Object Property Level Authorization

NIST 800-53: AC-3, AC-4

PCI DSS 4: 3.4.1

CRITICAL PHX-056 — JWT Weak Secret

Remediation: Use a cryptographically random secret of at least 256 bits for HS256. Prefer RS256/ES256 with properly managed key pairs. Rotate secrets regularly.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A07:2021 – Identification and Authentication Failures

OWASP API: API2:2023 – Broken Authentication

MITRE ATT&CK: T1550.001 (Defense Evasion)

NIST 800-53: IA-5, SC-28

PCI DSS 4: 8.3.6

HIGH PHX-057 — Sensitive Data Exposed in URL Parameters

Remediation: Never pass sensitive data (passwords, tokens, API keys) in URL query parameters. Use request bodies (POST) or headers. Ensure server logs do not capture sensitive query parameters.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A02:2021 – Cryptographic Failures

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1552 (Credential Access)

NIST 800-53: SC-8, SI-12

PCI DSS 4: 4.2.1

HIGH PHX-058 — XPath Injection

Remediation: Use parameterized XPath queries. Escape special XPath/XML characters in user input. Use XML schema validation to reject malformed documents.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A03:2021 – Injection

OWASP API: API8:2023 – Security Misconfiguration

NIST 800-53: SI-10

PCI DSS 4: 6.2.4

HIGH PHX-059 — Missing Multi-Factor Authentication

Remediation: Enforce MFA for all user accounts, especially administrative accounts. Use TOTP or hardware tokens. Apply adaptive MFA based on risk signals.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A07:2021 – Identification and Authentication Failures

OWASP API: API2:2023 – Broken Authentication

MITRE ATT&CK: T1078 (Defense Evasion)

NIST 800-53: IA-2, IA-5

PCI DSS 4: 8.4.2

HIGH PHX-060 — FTP Service Exposed

Remediation: Disable anonymous FTP access. Replace FTP with SFTP or FTPS. Restrict FTP access to internal networks. If FTP is required, enforce authentication and encryption.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

MITRE ATT&CK: T1048 (Exfiltration)

NIST 800-53: CM-7, SC-8

PCI DSS 4: 4.2.1, 2.2.1

HIGH PHX-061 — Telnet Service Enabled

Remediation: Disable Telnet. Replace with SSH for all remote management. Block port 23 at the network perimeter.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

MITRE ATT&CK: T1021 (Lateral Movement)

NIST 800-53: CM-7, SC-8

PCI DSS 4: 2.2.1, 4.2.1

HIGH PHX-062 — SNMP Default Community String

Remediation: Change default SNMP community strings immediately. Upgrade to SNMPv3 with authentication and encryption. Restrict SNMP access to management networks only.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

MITRE ATT&CK: T1602.001 (Collection)

NIST 800-53: CM-6, IA-5

PCI DSS 4: 2.2.1

MEDIUM PHX-063 — HTTP Methods: Unsafe Methods Enabled

Remediation: Disable the HTTP TRACE method on all web servers. In Apache: TraceEnable Off. In Nginx: return 405 for TRACE requests.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 – Security Misconfiguration

NIST 800-53: CM-6, CM-7

PCI DSS 4: 6.2.4

MEDIUM PHX-064 — Cookie Without Secure Flag

Remediation: Set the Secure flag on all cookies to prevent transmission over non-HTTPS connections. Also set HttpOnly and SameSite flags appropriately.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

OWASP Web: A05:2021 – Security Misconfiguration

MITRE ATT&CK: T1557 (Collection)

NIST 800-53: SC-8

PCI DSS 4: 4.2.1

MEDIUM PHX-065 — Cookie Without HttpOnly Flag

Remediation: Set HttpOnly flag on all session and authentication cookies to prevent JavaScript access and mitigate XSS-based session theft.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N

OWASP Web: A05:2021 – Security Misconfiguration

MITRE ATT&CK: T1059.007 (Execution)

NIST 800-53: SC-18, CM-6

PCI DSS 4: 6.2.4

HIGH PHX-066 — Stored Cross-Site Scripting (XSS)

Remediation: Sanitize input on storage and encode output on render. Apply strict CSP. Treat stored user content as untrusted and encode at each output context.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

OWASP Web: A03:2021 – Injection

MITRE ATT&CK: T1059.007 (Execution)

NIST 800-53: SI-10, SC-18

PCI DSS 4: 6.2.4

HIGH PHX-067 — Insecure Direct Object Reference – File Access

Remediation: Validate that the authenticated user owns or has explicit access to each requested file. Use access control lists per file resource. Store files with non-guessable names.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A01:2021 – Broken Access Control

OWASP API: API1:2023 – Broken Object Level Authorization

MITRE ATT&CK: T1083 (Discovery)

NIST 800-53: AC-3

PCI DSS 4: 7.2.1

HIGH PHX-068 — Business Logic Flaw – Negative Quantity Accepted

Remediation: Enforce server-side validation that quantities, prices, and counts are within acceptable positive ranges. Reject or sanitize negative or zero values for business-critical numeric fields.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

OWASP Web: A04:2021 – Insecure Design

OWASP API: API6:2023 – Unrestricted Access to Sensitive Business Flows

NIST 800-53: SI-10

PCI DSS 4: 6.2.4

LOW PHX-069 — Information Disclosure – Server Version Banner

Remediation: Suppress or remove version information from Server, X-Powered-By, and X-AspNet-Version headers. Configure web server to return generic or no version strings.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 – Security Misconfiguration

MITRE ATT&CK: T1592.002 (Reconnaissance)

NIST 800-53: CM-6, SI-11

CRITICAL PHX-070 — Unprotected Admin Interface

Remediation: Restrict admin interfaces to internal networks via IP allowlisting. Require MFA for all admin access. Do not expose administrative panels on public-facing hosts.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A01:2021 – Broken Access Control

OWASP API: API5:2023 – Broken Function Level Authorization

MITRE ATT&CK: T1078.001 (Initial Access)

NIST 800-53: AC-3, AC-17

PCI DSS 4: 7.2.1

CRITICAL PHX-071 — BlueKeep – RDP Pre-Auth RCE (CVE-2019-0708)

Remediation: Apply Microsoft security update for CVE-2019-0708 immediately. Enable NLA. Block RDP from public internet. Isolate unpatched systems behind a VPN.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

MITRE ATT&CK: T1210 (Lateral Movement)

NIST 800-53: SI-2, CM-7

PCI DSS 4: 6.3.3

CISA KEV

CRITICAL PHX-072 — Log4Shell (CVE-2021-44228)

Remediation: Upgrade Log4j to 2.17.1 or later. Apply JVM mitigation (log4j2.formatMsgNoLookups=true) as a temporary measure. Block outbound LDAP/RMI at the network layer.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

OWASP Web: A06:2021 – Vulnerable and Outdated Components

MITRE ATT&CK: T1190 (Initial Access), T1059 (Execution)

NIST 800-53: SI-2, RA-5

PCI DSS 4: 6.3.3

CISA KEV

CRITICAL PHX-073 — Spring4Shell (CVE-2022-22965)

Remediation: Upgrade Spring Framework to 5.3.18+ or 5.2.20+. Upgrade Spring Boot to 2.6.6+ or 2.5.12+. Ensure JDK is 9 or higher with the fix applied.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A06:2021 – Vulnerable and Outdated Components

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: SI-2, RA-5

PCI DSS 4: 6.3.3

CISA KEV

CRITICAL PHX-074 — ProxyShell – Microsoft Exchange RCE

Remediation: Apply Microsoft Cumulative Update for Exchange Server. Restrict EWS and OWA access. Audit web shells and malicious files in Exchange directories.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

MITRE ATT&CK: T1190 (Initial Access), T1505.003 (Persistence)

NIST 800-53: SI-2, RA-5

PCI DSS 4: 6.3.3

CISA KEV

MEDIUM PHX-075 — Credential Exposure via OSINT – LinkedIn Employee Data

Remediation: Educate employees on minimal professional social media exposure. Implement phishing-resistant MFA. Monitor for use of corporate email addresses on breach databases.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

MITRE ATT&CK: T1589.003 (Reconnaissance)

NIST 800-53: AT-2, PL-4

CRITICAL PHX-076 — Exposed .git Directory

Remediation: Block access to .git directories via web server configuration. Remove .git directories from web roots. Audit deployment pipelines to prevent future exposure.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A05:2021 – Security Misconfiguration

MITRE ATT&CK: T1552.001 (Credential Access)

NIST 800-53: CM-6, CM-7

PCI DSS 4: 6.2.4

HIGH PHX-077 — Subdomain Takeover

Remediation: Audit DNS records for CNAME or A records pointing to decommissioned or unclaimed third-party services. Remove dangling DNS entries. Claim or delete associated cloud resources.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

OWASP Web: A05:2021 – Security Misconfiguration

MITRE ATT&CK: T1584.001 (Resource Development)

NIST 800-53: CM-8, CM-6

CRITICAL PHX-078 — Exposed Environment File (.env)

Remediation: Block public access to .env and similar configuration files via web server rules. Never deploy .env files to web-accessible directories. Rotate all exposed credentials immediately.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A05:2021 – Security Misconfiguration

MITRE ATT&CK: T1552.001 (Credential Access)

NIST 800-53: CM-6, IA-5

PCI DSS 4: 3.4.1

HIGH PHX-079 — Broken Access Control – Horizontal Privilege Escalation

Remediation: Enforce strict ownership checks for every data access operation. Bind resources to authenticated user context. Never rely on client-supplied user IDs for authorization decisions.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A01:2021 – Broken Access Control

OWASP API: API1:2023 – Broken Object Level Authorization

MITRE ATT&CK: T1078 (Defense Evasion)

NIST 800-53: AC-3, AC-4

PCI DSS 4: 7.2.1

HIGH PHX-080 — Unencrypted Database Connection

Remediation: Enable TLS/SSL for all database connections. Enforce certificate validation. Use strong cipher suites and rotate DB credentials regularly.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A02:2021 – Cryptographic Failures

MITRE ATT&CK: T1040 (Credential Access)

NIST 800-53: SC-8, SC-28

PCI DSS 4: 4.2.1

CRITICAL PHX-081 — Database Accessible from Internet

Remediation: Move database services behind a firewall or VPC. Never bind databases to 0.0.0.0 in production. Use security groups to restrict DB access to application servers only.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: CM-7, SC-7

PCI DSS 4: 1.3.1

CRITICAL PHX-082 — SQL Injection – Stored Procedure Abuse

Remediation: Disable xp_cmdshell and other dangerous stored procedures. Apply least-privilege database accounts. Use parameterized queries and input validation throughout.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A03:2021 – Injection

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1190 (Initial Access), T1059 (Execution)

NIST 800-53: SI-10, CM-6

PCI DSS 4: 6.2.4

HIGH PHX-083 — Insecure Cloud Storage – S3 Bucket Publicly Readable

Remediation: Set S3 bucket policies to deny public access. Enable S3 Block Public Access settings. Audit all cloud storage for publicly exposed sensitive data. Enable bucket access logging.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A05:2021 – Security Misconfiguration

MITRE ATT&CK: T1530 (Collection)

NIST 800-53: AC-3, CM-6

PCI DSS 4: 3.4.1

HIGH PHX-084 — Cloud Instance Metadata Service (IMDS) Accessible

Remediation: Enforce IMDSv2 (token-required) on all EC2 instances. Block access to 169.254.169.254 at the application layer. Restrict IAM roles to minimum required permissions.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A10:2021 – Server-Side Request Forgery

OWASP API: API7:2023 – Server Side Request Forgery

MITRE ATT&CK: T1552.005 (Credential Access)

NIST 800-53: SC-7, IA-5

PCI DSS 4: 6.2.4

MEDIUM PHX-085 — Inadequate Input Validation – HTTP Header Injection

Remediation: Validate and sanitize all data used in HTTP response headers. Strip or reject CR (\r) and LF (\n) characters from user-supplied input included in headers.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

OWASP Web: A03:2021 – Injection

NIST 800-53: SI-10

PCI DSS 4: 6.2.4

HIGH PHX-086 — Weak Password Reset Mechanism

Remediation: Generate cryptographically random, short-lived (< 15 min) one-time password reset tokens. Invalidate tokens after single use. Rate limit password reset requests.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A07:2021 – Identification and Authentication Failures

OWASP API: API2:2023 – Broken Authentication

MITRE ATT&CK: T1078 (Defense Evasion)

NIST 800-53: IA-5

PCI DSS 4: 8.3.6

MEDIUM PHX-087 — Insecure Token Storage – Tokens in localStorage

Remediation: Store authentication tokens in HttpOnly cookies, not localStorage. If localStorage is unavoidable, apply strong CSP to mitigate XSS risk. Use short-lived access tokens.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

OWASP Web: A02:2021 – Cryptographic Failures

MITRE ATT&CK: T1059.007 (Execution)

NIST 800-53: SC-28

PCI DSS 4: 3.4.1

HIGH PHX-088 — Nginx Off-By-Slash Path Traversal Misconfiguration

Remediation: Ensure Nginx location and alias directives both end with a trailing slash or both lack one. Use 'nginx -T' and audit all alias configurations with a linting tool.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A05:2021 – Security Misconfiguration

MITRE ATT&CK: T1083 (Discovery)

NIST 800-53: CM-6

PCI DSS 4: 6.2.4

HIGH PHX-089 — Prototype Pollution

Remediation: Sanitize user-controlled keys to reject __proto__, constructor, and prototype. Use Object.create(null) for dictionaries. Update affected libraries (lodash, jQuery).

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

OWASP Web: A03:2021 – Injection

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: SI-10, SA-11

PCI DSS 4: 6.2.4

MEDIUM PHX-090 — Weak Encryption – DES/3DES in Use

Remediation: Replace DES and 3DES with AES-128 or AES-256. Update TLS configurations to remove 3DES cipher suites. Ensure SSH configurations exclude arcfour and DES-based ciphers.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A02:2021 – Cryptographic Failures

NIST 800-53: SC-8, SC-28

PCI DSS 4: 4.2.1

CRITICAL PHX-091 — Heap Overflow / Buffer Overflow in Network Service

Remediation: Apply vendor security patches. Enable ASLR, DEP/NX, and stack canaries. Upgrade affected service to a patched version. Restrict network access to the vulnerable service.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

MITRE ATT&CK: T1203 (Execution), T1210 (Lateral Movement)

NIST 800-53: SI-2, SA-11

PCI DSS 4: 6.3.3

CRITICAL PHX-092 — Zerologon (CVE-2020-1472)

Remediation: Apply August 2020 and February 2021 Microsoft security updates for all domain controllers. Enable enforcement mode for secure channel. Monitor for Netlogon authentication anomalies.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

MITRE ATT&CK: T1210 (Lateral Movement), T1068 (Privilege Escalation)

NIST 800-53: SI-2, RA-5

PCI DSS 4: 6.3.3

CISA KEV

CRITICAL PHX-093 — PrintNightmare (CVE-2021-34527)

Remediation: Apply Microsoft patch for CVE-2021-34527. Disable Print Spooler service on non-printing hosts, especially Domain Controllers. Restrict who can install printer drivers.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

MITRE ATT&CK: T1547.012 (Persistence), T1068 (Privilege Escalation)

NIST 800-53: SI-2

PCI DSS 4: 6.3.3

CISA KEV

HIGH PHX-094 — API Key Exposed in JavaScript Source

Remediation: Never embed API keys or secrets in client-side JavaScript. Proxy API calls through a backend service that holds credentials securely. Rotate all exposed keys immediately.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A02:2021 – Cryptographic Failures

OWASP API: API2:2023 – Broken Authentication

MITRE ATT&CK: T1552.001 (Credential Access)

NIST 800-53: IA-5

PCI DSS 4: 3.4.1

MEDIUM PHX-095 — Improper Error Handling – Stack Trace in API Response

Remediation: Return generic error responses to API clients. Log detailed errors server-side only. Use a centralized exception handler that strips sensitive information before responding.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 – Security Misconfiguration

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1592 (Reconnaissance)

NIST 800-53: SI-11, CM-6

PCI DSS 4: 6.2.4

HIGH PHX-096 — Unvalidated Webhook – Spoofable Source

Remediation: Validate webhook HMAC signatures on every inbound request. Reject payloads that fail signature verification. Use a secret per webhook source and rotate it periodically.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1565 (Impact)

NIST 800-53: SI-10, IA-3

PCI DSS 4: 6.2.4

MEDIUM PHX-097 — HSTS Not Enabled

Remediation: Add 'Strict-Transport-Security: max-age=31536000; includeSubDomains; preload' header to all HTTPS responses. Submit domain to HSTS preload list.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

OWASP Web: A05:2021 – Security Misconfiguration

MITRE ATT&CK: T1557 (Collection)

NIST 800-53: SC-8

PCI DSS 4: 4.2.1

MEDIUM PHX-098 — Reflected File Download (RFD)

Remediation: Set a strict Content-Disposition header for all API responses. Ensure Content-Type headers accurately reflect response content. Add X-Content-Type-Options: nosniff.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

OWASP Web: A05:2021 – Security Misconfiguration

NIST 800-53: SC-18, CM-6

PCI DSS 4: 6.2.4

HIGH PHX-099 — Exposed Backup File

Remediation: Remove all backup, archive, and dump files from web-accessible directories. Configure web server to deny access to .bak, .sql, .tar.gz, and similar extensions.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A05:2021 – Security Misconfiguration

MITRE ATT&CK: T1552.001 (Credential Access)

NIST 800-53: CM-6, CM-7

PCI DSS 4: 3.4.1

MEDIUM PHX-100 — Unsafe Redirect After Authentication

Remediation: Validate post-login redirect URLs against a server-side allowlist. Reject external or relative redirect targets. Use a state parameter in OAuth flows to prevent CSRF and redirect abuse.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

OWASP Web: A07:2021 – Identification and Authentication Failures

OWASP API: API2:2023 – Broken Authentication

MITRE ATT&CK: T1566.002 (Initial Access)

NIST 800-53: IA-5, SI-10

PCI DSS 4: 6.2.4

HIGH PHX-101 — Dependency Confusion Attack Surface

Remediation: Register all internal package names on public registries to prevent squatting. Use scoped package names. Pin package versions and use lock files. Verify package provenance in CI/CD.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

OWASP Web: A06:2021 – Vulnerable and Outdated Components

MITRE ATT&CK: T1195.001 (Initial Access)

NIST 800-53: SA-12, SI-2

PCI DSS 4: 6.3.2

CRITICAL PHX-102 — IDOR – Account Takeover via Password Change

Remediation: Enforce server-side ownership validation on all account modification endpoints. Require current password confirmation before allowing password changes. Never allow user_id substitution.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A01:2021 – Broken Access Control

OWASP API: API1:2023 – Broken Object Level Authorization

MITRE ATT&CK: T1078 (Defense Evasion)

NIST 800-53: AC-3, IA-5

PCI DSS 4: 7.2.1, 8.3.6

HIGH PHX-103 — Sensitive PII Exposed in API Response

Remediation: Mask or exclude sensitive PII (SSN, credit card, full DOB) from API responses. Apply field-level access control. Use data minimization principles — return only what the client needs.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A02:2021 – Cryptographic Failures

OWASP API: API3:2023 – Broken Object Property Level Authorization

NIST 800-53: AC-3, SC-28

PCI DSS 4: 3.4.1, 3.5.1

HIGH PHX-104 — Insufficient Transport Layer Security – API Over HTTP

Remediation: Force all API traffic over HTTPS. Configure HSTS. Reject HTTP connections at the load balancer or API gateway level with a 301 redirect to HTTPS.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A02:2021 – Cryptographic Failures

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1040 (Credential Access)

NIST 800-53: SC-8, SC-28

PCI DSS 4: 4.2.1, 4.2.2

MEDIUM PHX-105 — Broken Authentication – No Credential Rotation Policy

Remediation: Establish a credential rotation policy (90 days for service accounts, 30 days for API keys). Automate rotation using a secrets manager. Audit for long-lived tokens in CI/CD pipelines.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A07:2021 – Identification and Authentication Failures

OWASP API: API2:2023 – Broken Authentication

MITRE ATT&CK: T1078 (Defense Evasion)

NIST 800-53: IA-5

PCI DSS 4: 8.3.9

INFO PHX-106 — WordPress CMS Plugin Detected

Remediation: Keep all WordPress plugins updated to their latest release. Remove readme.txt files from plugin directories on production servers. Uninstall unused or unmaintained plugins to reduce attack surface.

Effort: Low

OWASP Web: A06:2021 – Vulnerable and Outdated Components

MITRE ATT&CK: T1592.002 (Reconnaissance)

NIST 800-53: CM-8, SI-2

PCI DSS 4: 6.3.2

LOW PHX-107 — Cookie Security Attribute Misconfiguration

Remediation: Set HttpOnly, Secure, and SameSite=Lax (or Strict) attributes on all cookies containing session tokens or sensitive values. For SameSite=None (cross-site use cases), always pair with the Secure flag. Review all Set-Cookie directives in application responses systematically.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 – Security Misconfiguration

MITRE ATT&CK: T1539 (Collection), T1185 (Collection)

NIST 800-53: SC-8, IA-5, SC-23

PCI DSS 4: 6.4.1, 6.5.10

MEDIUM PHX-109 — HTTP Methods: Unsafe Methods Enabled

Remediation: Disable the HTTP TRACE and TRACK methods in the web server configuration. In Apache, set 'TraceEnable Off'; in Nginx, add an explicit deny rule in the server block for TRACE requests. Verify remediation with a direct TRACE request and confirm a 405 or 501 response is returned.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

OWASP Web: A05:2021 – Security Misconfiguration

MITRE ATT&CK: T1185 (Collection), T1539 (Collection)

NIST 800-53: CM-7, SC-8

PCI DSS 4: 6.2.4, 6.5.1

LOW PHX-110 — Missing DNS CAA Record

Remediation: Add a DNS CAA record for the domain restricting certificate issuance to your approved CAs. Include an iodef entry to receive notifications of unauthorised issuance attempts. Propagate the record to all DNS zones including subdomains that have independent certificate requirements.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

OWASP Web: A05:2021 – Security Misconfiguration

MITRE ATT&CK: T1588.004 (Resource Development)

NIST 800-53: SC-20, SC-23

PCI DSS 4: 4.2.1

HIGH PHX-111 — DNS Zone Transfer Permitted (AXFR)

Remediation: Restrict AXFR zone transfers to explicitly authorised secondary name servers only using ACLs in your DNS server configuration. In BIND9, use the 'allow-transfer' directive with specific secondary IP addresses. Verify by attempting an AXFR query from an unauthorised host and confirming a REFUSED response.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A05:2021 – Security Misconfiguration

MITRE ATT&CK: T1590.002 (Reconnaissance), T1018 (Discovery)

NIST 800-53: SC-20, CM-7, AC-3

PCI DSS 4: 1.3.2, 6.5.1

MEDIUM PHX-112 — CRLF Injection

Remediation: Strip or encode carriage return (\r, %0d) and line feed (\n, %0a) characters from all user-supplied data before it is written into HTTP response headers. Use framework-provided header APIs rather than manual string construction. Apply input validation as a secondary layer.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

OWASP Web: A03:2021 – Injection

MITRE ATT&CK: T1190 (Initial Access), T1539 (Collection)

NIST 800-53: SI-10, SC-8

PCI DSS 4: 6.2.4, 6.5.1

MEDIUM PHX-113 — CSV / Formula Injection

Remediation: Sanitise all data included in CSV exports by prepending a single quote to cells beginning with =, +, -, @, |, or tab characters. Enclose all fields in double quotes and escape embedded quotes. Apply this sanitisation at the export layer regardless of where the data originated.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

OWASP Web: A03:2021 – Injection

MITRE ATT&CK: T1059 (Execution), T1566.002 (Initial Access)

NIST 800-53: SI-10, SI-7

PCI DSS 4: 6.2.4

MEDIUM PHX-114 — Log Injection

Remediation: Sanitise all user-supplied values written to application logs by stripping or encoding newline characters. Adopt structured logging (JSON or key-value format) which is inherently resistant to log injection. Ensure log integrity monitoring detects unexpected formatting anomalies.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

OWASP Web: A09:2021 – Security Logging and Monitoring Failures

MITRE ATT&CK: T1562.006 (Defense Evasion), T1070 (Defense Evasion)

NIST 800-53: AU-9, SI-10, AU-12

PCI DSS 4: 10.3.1, 6.2.4

MEDIUM PHX-115 — JSONP Endpoint Cross-Origin Data Leakage

Remediation: Replace JSONP endpoints with CORS-enabled JSON APIs using restrictive Access-Control-Allow-Origin policies. If JSONP must be retained, validate the callback parameter strictly against an alphanumeric whitelist and ensure no sensitive or authenticated data is returned via JSONP.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

OWASP Web: A05:2021 – Security Misconfiguration

OWASP API: API7:2023 – Server Side Request Forgery

MITRE ATT&CK: T1185 (Collection), T1530 (Collection)

NIST 800-53: AC-4, SC-8

PCI DSS 4: 6.4.1, 6.5.1

CRITICAL PHX-116 — Remote Code Execution via Code Injection

Remediation: Immediately eliminate all use of dynamic code evaluation functions (eval, exec, and language equivalents) on user-supplied input. Refactor the affected functionality to use safe, static alternatives. Apply WAF rules as a temporary mitigating control while code changes are deployed.

Effort: High

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A03:2021 – Injection

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1190 (Initial Access), T1059 (Execution), T1499 (Impact)

NIST 800-53: SI-10, AC-3, CM-7

PCI DSS 4: 6.2.4, 6.5.1

INFO PHX-117 — Password Reset Endpoint Exposed

Remediation: Ensure the password reset flow uses CSPRNG-generated single-use tokens of at least 128 bits entropy with a short expiry (15–30 minutes). Enforce rate limiting, invalidate tokens immediately upon use, and avoid username enumeration through differential responses.

Effort: Moderate

OWASP Web: A07:2021 – Identification and Authentication Failures

MITRE ATT&CK: T1078 (Initial Access), T1110 (Credential Access)

NIST 800-53: IA-5, AC-2

PCI DSS 4: 8.3.6

MEDIUM PHX-118 — JWT Missing Expiry Claim

Remediation: Include an 'exp' claim in all issued JWTs with an appropriate short lifetime (e.g., 15 minutes for access tokens). Implement refresh token rotation to allow session continuation without long-lived access tokens. Validate the exp claim on every request server-side and reject expired tokens.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A07:2021 – Identification and Authentication Failures

OWASP API: API2:2023 – Broken Authentication

MITRE ATT&CK: T1550.001 (Defense Evasion), T1539 (Collection)

NIST 800-53: IA-5, SC-23, AC-12

PCI DSS 4: 8.2.4, 8.3.9

MEDIUM PHX-119 — Timing Attack – Non-Constant-Time Authentication

Remediation: Replace all security-sensitive string comparisons with constant-time equivalents (e.g., hmac.compare_digest() in Python, crypto.timingSafeEqual() in Node.js). This applies to password verification, token comparison, HMAC validation, and any other authentication comparison. Never use == or === operators for secret comparison.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A07:2021 – Identification and Authentication Failures

OWASP API: API2:2023 – Broken Authentication

MITRE ATT&CK: T1110 (Credential Access), T1522 (Credential Access)

NIST 800-53: IA-3, SC-8

PCI DSS 4: 8.3.1

HIGH PHX-120 — Weak or Predictable Session Token

Remediation: Generate all session tokens using a CSPRNG with at least 128 bits of entropy. Tokens must be statistically independent, uniformly distributed, and free of any derivation from predictable values such as timestamps, user IDs, or sequential counters. Use framework-provided session management rather than custom implementations.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A07:2021 – Identification and Authentication Failures

OWASP API: API2:2023 – Broken Authentication

MITRE ATT&CK: T1539 (Collection), T1110.001 (Credential Access)

NIST 800-53: IA-5, SC-23

PCI DSS 4: 8.2.1, 8.3.6

LOW PHX-121 — Debug / Diagnostic Header Data Leakage

Remediation: Remove all debug, trace, and internal diagnostic headers from production HTTP responses. Configure reverse proxies to strip headers added by backend services before returning responses to clients. Maintain a header whitelist for production environments.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 – Security Misconfiguration

MITRE ATT&CK: T1592.002 (Reconnaissance)

NIST 800-53: CM-7, SI-12

PCI DSS 4: 6.5.1

HIGH PHX-122 — Exposed Metrics or Actuator Endpoint

Remediation: Restrict access to all metrics, health-check, and actuator endpoints using IP allowlisting or authentication. Disable sensitive endpoints that are not required in production (e.g., Spring Boot /actuator/env, /actuator/heapdump). Ensure no credentials, internal hostnames, or configuration data is exposed in metric output.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A05:2021 – Security Misconfiguration

OWASP API: API7:2023 – Server Side Request Forgery

MITRE ATT&CK: T1592.002 (Reconnaissance), T1552.001 (Credential Access)

NIST 800-53: CM-7, AC-3, SI-12

PCI DSS 4: 6.5.1, 1.3.2

MEDIUM PHX-123 — Sensitive Information in Page Source

Remediation: Remove all developer comments, internal URLs, environment references, and configuration hints from production HTML and JavaScript. Implement a build pipeline step to strip comments from production assets. Conduct regular automated scanning of page sources for sensitive pattern matches.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 – Security Misconfiguration

MITRE ATT&CK: T1592 (Reconnaissance), T1083 (Discovery)

NIST 800-53: SI-12, CM-7

PCI DSS 4: 6.5.1

HIGH PHX-124 — API Returns Same Data for All Users (Missing Object-Level Auth)

Remediation: Implement per-user data scoping on all API endpoints by verifying that the authenticated user has ownership or explicit permission for each returned object. Enforce object-level authorisation checks in a centralised layer and test all endpoints across multiple user accounts to confirm isolation.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A01:2021 – Broken Access Control

OWASP API: API1:2023 – Broken Object Level Authorization

MITRE ATT&CK: T1530 (Collection), T1213 (Collection)

NIST 800-53: AC-3, AC-4

PCI DSS 4: 7.2.1

HIGH PHX-125 — Unauthenticated Access to Protected Path

Remediation: Implement server-side authentication enforcement on every protected route via a centralised middleware or decorator pattern. Ensure the check cannot be bypassed through client-side manipulation, request parameter modification, or direct URL access. Test all protected paths in an explicitly unauthenticated state as part of the QA process.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A01:2021 – Broken Access Control

OWASP API: API5:2023 – Broken Function Level Authorization

MITRE ATT&CK: T1190 (Initial Access), T1078 (Initial Access)

NIST 800-53: AC-3, AC-2

PCI DSS 4: 7.2.1, 8.2.1

CRITICAL PHX-126 — WordPress wp-config.php Exposed

Remediation: Immediately rotate all credentials in wp-config.php (database password, secret keys, salts). Move wp-config.php one directory level above the web root, or configure the web server to deny HTTP access to it. Remove any backup copies (.bak, .old, ~) from the web root.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A05:2021 – Security Misconfiguration

MITRE ATT&CK: T1552.001 (Credential Access), T1190 (Initial Access)

NIST 800-53: CM-6, AC-3, IA-5

PCI DSS 4: 6.5.1, 8.3.2

MEDIUM PHX-127 — WordPress Administrative / Sensitive Path Exposed

Remediation: Restrict access to WordPress administrative, installation, and cron scripts via web server ACLs. Disable the built-in WP-Cron and replace with a real system cron job. Apply WordPress hardening guidelines and block direct HTTP access to sensitive PHP files not intended for public use.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

OWASP Web: A05:2021 – Security Misconfiguration

MITRE ATT&CK: T1190 (Initial Access), T1499 (Impact)

NIST 800-53: CM-7, AC-3

PCI DSS 4: 6.5.1

MEDIUM PHX-128 — WordPress Information Disclosure

Remediation: Disable directory listing on all WordPress directories, suppress plugin and theme version parameters from enqueued assets, and restrict the REST API user endpoint. For Multisite installations, apply network-level hardening and restrict super-admin access. Keep all components updated and remove unused plugins and themes.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 – Security Misconfiguration

MITRE ATT&CK: T1592.002 (Reconnaissance), T1083 (Discovery)

NIST 800-53: CM-7, CM-8

PCI DSS 4: 6.5.1

HIGH PHX-129 — WordPress Backup/Export File Exposed

Remediation: Immediately remove all backup, export, and archive files from the web root. Configure backup plugins to store exports outside the document root or require authentication for download. Add web server rules blocking access to common backup extensions (.sql, .bak, .tar.gz, .zip) within WordPress directories.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A05:2021 – Security Misconfiguration

MITRE ATT&CK: T1552.001 (Credential Access), T1530 (Collection)

NIST 800-53: CM-6, AC-3, SC-28

PCI DSS 4: 6.5.1, 3.3.1

HIGH PHX-130 — TimThumb Script Detected

Remediation: Remove TimThumb from all themes and plugins and replace with a maintained image processing alternative. If removal is not immediately possible, update to version 2.8.14 or later and restrict the ALLOWED_SITES whitelist. Scan the server for webshells that may have been uploaded via prior TimThumb exploitation.

Effort: Moderate

OWASP Web: A06:2021 – Vulnerable and Outdated Components

MITRE ATT&CK: T1190 (Initial Access), T1505.003 (Persistence)

NIST 800-53: SI-2, CM-6

PCI DSS 4: 6.3.3, 6.5.1

INFO PHX-131 — Recon: Application Form / Login Page Identified

Remediation: Informational: ensure identified login endpoints implement rate limiting, CSRF protection, account lockout, and non-differentiating error messages. For forms, ensure CSRF tokens and server-side input validation are in place. This finding seeds further targeted testing.

Effort: Low

OWASP Web: A07:2021 – Identification and Authentication Failures

MITRE ATT&CK: T1078 (Initial Access), T1589 (Reconnaissance)

NIST 800-53: IA-2, AC-2

PCI DSS 4: 8.2.1

INFO PHX-132 — Recon: CMS, Virtual Host, or Technology Identified

Remediation: Keep all identified CMS and framework versions updated and monitor vendor security advisories. Suppress version information from HTTP headers and page source. Audit all virtual hosts discovered to ensure they maintain equivalent security controls to the primary application.

Effort: Low

OWASP Web: A05:2021 – Security Misconfiguration

MITRE ATT&CK: T1592.002 (Reconnaissance), T1595.002 (Reconnaissance)

NIST 800-53: CM-8, SI-2, CM-7

PCI DSS 4: 6.3.3

INFO PHX-133 — Recon: Interesting Endpoint or Path Discovered

Remediation: Review all discovered endpoints and paths to verify they are intentional, authenticated, and not exposing unintended functionality. Apply consistent security headers across all endpoints. Restrict file upload endpoints with strict validation, remove unused paths, and ensure wildcard configurations are scoped appropriately.

Effort: Low

OWASP Web: A05:2021 – Security Misconfiguration

MITRE ATT&CK: T1595.003 (Reconnaissance), T1083 (Discovery)

NIST 800-53: CM-8, CM-7, AC-3

PCI DSS 4: 6.5.1

INFO PHX-134 — Recon: JWT Token or Hidden Parameter Identified

Remediation: Informational: validate all identified JWTs for algorithm, signature, expiry, and issuer. Investigate hidden parameters for access control bypass potential and apply the same validation and authorisation controls as documented parameters. Refer to specific JWT or access control findings for detailed remediation.

Effort: Low

OWASP Web: A07:2021 – Identification and Authentication Failures

OWASP API: API2:2023 – Broken Authentication

MITRE ATT&CK: T1550.001 (Defense Evasion), T1589 (Reconnaissance)

NIST 800-53: IA-5, SI-10

PCI DSS 4: 8.3.1

CRITICAL PHX-135 — LLMNR/NBT-NS Poisoning — NTLM Hash Capture

Remediation: Disable LLMNR and NBT-NS via Group Policy. Require mutual authentication (SMB signing). Enable Extended Protection for Authentication (EPA). Deploy network monitoring to detect Responder activity.

Effort: Low

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

MITRE ATT&CK: T1557.001 (Collection)

NIST 800-53: IA-3, SC-8, CM-7

PCI DSS 4: 1.3.2, 2.2.4

HIGH PHX-136 — NFS Unauthenticated Export

Remediation: Restrict NFS exports to specific trusted IP addresses in /etc/exports. Remove the 'no_root_squash' and 'insecure' options. Use Kerberos authentication (sec=krb5) for NFS v4. Block NFS ports (2049, 111) at the perimeter firewall.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

MITRE ATT&CK: T1083 (Discovery), T1005 (Collection)

NIST 800-53: AC-3, AC-6, CM-7

PCI DSS 4: 1.3.1, 7.2.1

MEDIUM PHX-137 — FTP Bounce Attack

Remediation: Disable FTP altogether in favour of SFTP or FTPS. If FTP is required, configure the server to deny PORT commands to addresses that differ from the client's IP. Restrict passive port ranges and enforce firewall egress controls.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

MITRE ATT&CK: T1090 (Command and Control)

NIST 800-53: CM-7, SC-7

PCI DSS 4: 1.3.1, 2.2.4

MEDIUM PHX-138 — HDMI Physical Attack Surface — CEC/DDC/EDID

Remediation: Disable CEC in display and source device settings where not operationally required. Apply HDCP where content protection is mandated. Restrict physical access to HDMI ports on sensitive systems. Use HDMI signal blockers or port locks in high-security environments.

Effort: Medium

CVSS Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N

MITRE ATT&CK: T1200 (Initial Access), T0821 (Impair Process Control)

NIST 800-53: AC-3, CM-7, PE-3

PCI DSS 4: 9.1.1

CRITICAL PHX-139 — CAN Bus Attack — Frame Injection and Replay

Remediation: Implement CAN bus message authentication (e.g., CANsec or AUTOSAR SecOC) to validate frame integrity and source. Segment the CAN bus network with gateways that enforce allow-list message filtering. Monitor for anomalous frame IDs and rates. Restrict physical access to OBD-II and bus interfaces.

Effort: High

CVSS Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

MITRE ATT&CK: T0855 (Impair Process Control)

NIST 800-53: SC-8, SI-3, CM-7

HIGH PHX-140 — RFID Credential Capture and Replay

Remediation: Replace ISO 14443/15693 UID-only systems with cryptographically authenticated RFID standards (MIFARE DESFire EV2/EV3, SEOS, iCLASS SE). Implement mutual authentication and rolling codes. Layer with PIN or biometric second factor for high-security areas.

Effort: High

CVSS Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

MITRE ATT&CK: T1621 (Credential Access)

NIST 800-53: IA-3, IA-5, PE-3

PCI DSS 4: 8.4.2, 9.1.1

CRITICAL PHX-141 — USB HID Keyboard Injection

Remediation: Enforce USB device allow-listing via endpoint management (e.g., Windows Defender Device Control, USBGuard on Linux). Disable USB ports where not required. Block HID device class enrollment via Group Policy. Deploy endpoint monitoring for new HID device attachment events.

Effort: Medium

CVSS Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

MITRE ATT&CK: T1200 (Initial Access), T1091 (Lateral Movement)

NIST 800-53: SI-3, CM-7, PE-3

PCI DSS 4: 9.1.1, 12.3.2

CRITICAL PHX-142 — Unauthenticated Serial Console Access

Remediation: Require authentication on all serial/UART console interfaces. Where possible, disable or epoxy-fill physical serial headers on production hardware. Log all console access. For networked serial servers (terminal servers), enforce SSH and certificate-based auth.

Effort: Medium

CVSS Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

MITRE ATT&CK: T1078 (Defense Evasion), T1552 (Credential Access)

NIST 800-53: IA-2, AC-3, PE-3

PCI DSS 4: 8.2.1, 9.1.1

HIGH PHX-143 — Industrial/OT Protocol Exposed on Network

Remediation: Segregate OT/ICS networks from corporate IT networks using firewalls or data diodes. Disable any OT protocol services on interfaces reachable from untrusted networks. Implement protocol-aware industrial firewalls (e.g., Claroty, Dragos) where full segmentation is not feasible.

Effort: High

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H

MITRE ATT&CK: T0886 (Initial Access), T0830 (Collection)

NIST 800-53: SC-7, CM-7, SI-4

PCI DSS 4: 1.3.1

CRITICAL PHX-144 — Heartbleed — OpenSSL Memory Disclosure (CVE-2014-0160)

Remediation: Upgrade OpenSSL to 1.0.1g or later (or 1.0.2 branch). Revoke and reissue all TLS certificates that were in use on affected systems. Rotate all credentials (passwords, session tokens, private keys) that may have been exposed. Consider notifying affected users.

Effort: Medium

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A06:2021 – Vulnerable and Outdated Components

MITRE ATT&CK: T1552 (Credential Access), T1040 (Credential Access)

NIST 800-53: SI-2, SC-8, RA-5

PCI DSS 4: 6.3.3

CISA KEV

CRITICAL PHX-145 — IPMI 2.0 Cipher Suite 0 — Authentication Bypass

Remediation: Disable IPMI Cipher Suite 0 in the BMC configuration. Restrict IPMI access to a dedicated out-of-band management VLAN with firewall controls. Update BMC/iDRAC/iLO firmware. Disable IPMI over LAN entirely where out-of-band management is not required.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

MITRE ATT&CK: T1078 (Defense Evasion), T1110 (Credential Access)

NIST 800-53: IA-2, IA-3, CM-7

PCI DSS 4: 8.2.1, 2.2.4

CRITICAL PHX-146 — SMBv1 Enabled — EternalBlue Attack Surface

Remediation: Disable SMBv1 on all Windows hosts via Set-SmbServerConfiguration -EnableSMB1Protocol $false (PowerShell). Remove the SMBv1 Windows feature. Apply MS17-010 patch. Block TCP/445 at the network perimeter. Enforce SMBv3 with signing.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

MITRE ATT&CK: T1021.002 (Lateral Movement)

NIST 800-53: CM-7, SI-2, CM-6

PCI DSS 4: 6.3.3, 2.2.4

CRITICAL PHX-147 — libSSH Authentication Bypass (CVE-2018-10933)

Remediation: Upgrade libSSH to version 0.7.6 or 0.8.4 or later. Replace affected SSH server implementations. Review and patch all embedded devices using libSSH. Restrict SSH access to trusted IP ranges at the firewall.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A07:2021 – Identification and Authentication Failures

MITRE ATT&CK: T1078 (Initial Access)

NIST 800-53: IA-2, CM-7, SI-2

PCI DSS 4: 6.3.3, 8.2.1

HIGH PHX-148 — SSHv1 Protocol Supported

Remediation: Disable SSHv1 in sshd_config by setting 'Protocol 2'. SSHv1 uses outdated cryptographic primitives vulnerable to MITM and session hijacking attacks. All modern SSH implementations support SSHv2.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

MITRE ATT&CK: T1040 (Credential Access)

NIST 800-53: SC-8, CM-7, CM-6

PCI DSS 4: 4.2.1, 2.2.4

MEDIUM PHX-149 — SSH Weak Cryptographic Algorithms

Remediation: Remove CBC mode ciphers, MD5/SHA-1 MACs, and diffie-hellman-group1/14-sha1 key exchange from sshd_config. Enable only strong ciphers (chacha20-poly1305, aes256-gcm), MACs (hmac-sha2-256-etm), and KEX (curve25519-sha256). Apply Terrapin patch (CVE-2023-48795) by upgrading OpenSSH.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

MITRE ATT&CK: T1040 (Credential Access)

NIST 800-53: SC-8, SC-28, CM-6

PCI DSS 4: 4.2.1, 2.2.4

HIGH PHX-150 — RDP Without Network Level Authentication (NLA)

Remediation: Enable Network Level Authentication (NLA) for all RDP connections via Group Policy. Require CredSSP authentication. Apply MS12-020 and all subsequent RDP patches. Restrict RDP access to VPN-connected hosts only.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

MITRE ATT&CK: T1021.001 (Lateral Movement)

NIST 800-53: IA-2, CM-7, AC-17

PCI DSS 4: 8.2.1, 2.2.4

HIGH PHX-151 — SMTP Open Mail Relay

Remediation: Configure SMTP server to reject relaying for unauthenticated external sources. Implement SPF, DKIM, and DMARC to prevent domain abuse. Restrict SMTP relay permissions to authenticated users and known IP ranges only.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

MITRE ATT&CK: T1078 (Defense Evasion), T1566 (Initial Access)

NIST 800-53: CM-7, SC-5, SI-8

PCI DSS 4: 1.3.1, 5.4.1

MEDIUM PHX-152 — SMTP User Enumeration via VRFY/EXPN

Remediation: Disable the VRFY and EXPN commands in the SMTP server configuration. In Postfix: 'disable_vrfy_command = yes'. In Sendmail: add 'O NoRecipientAction=add-apparently-to' and remove VRFY support. This prevents username harvesting through the mail service.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 – Security Misconfiguration

MITRE ATT&CK: T1087 (Discovery)

NIST 800-53: CM-7, SI-12

PCI DSS 4: 2.2.4

MEDIUM PHX-153 — SIP User/Extension Enumeration

Remediation: Configure SIP server to return identical responses for valid and invalid extension REGISTER/OPTIONS requests. Implement rate limiting and account lockout on SIP authentication failures. Use SIP-aware firewall rules to restrict enumeration attempts.

Effort: Medium

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

MITRE ATT&CK: T1087 (Discovery)

NIST 800-53: CM-7, SC-7

PCI DSS 4: 2.2.4

MEDIUM PHX-154 — WebDAV Enabled on Web Server

Remediation: Disable WebDAV if not required for business operations (IIS: remove WebDAV Publishing role feature; Apache: disable mod_dav). If WebDAV must remain, restrict to authenticated users, enforce HTTPS, and limit HTTP methods to the minimum required (deny PUT, DELETE by default).

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

OWASP Web: A05:2021 – Security Misconfiguration

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: CM-7, AC-3

PCI DSS 4: 2.2.4, 6.2.4

MEDIUM PHX-155 — JetDirect / PJL Printer Service Exposed

Remediation: Restrict TCP/9100 (JetDirect/RAW printing) and TCP/515 (LPD) to trusted print server IPs at the firewall. Disable PJL command execution on printer firmware if not required. Update printer firmware. Enable printer administrative authentication and disable unauthenticated PJL access.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

MITRE ATT&CK: T1046 (Discovery)

NIST 800-53: CM-7, AC-3

PCI DSS 4: 1.3.1, 2.2.4

CRITICAL PHX-156 — MySQL Unauthenticated Root Access

Remediation: Immediately set a strong password for the MySQL root account ('ALTER USER root@localhost IDENTIFIED BY ...'). Run 'mysql_secure_installation' to remove anonymous accounts, test databases, and disable remote root login. Restrict MySQL port (3306) to localhost or trusted hosts only.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A07:2021 – Identification and Authentication Failures

MITRE ATT&CK: T1078 (Initial Access)

NIST 800-53: IA-2, IA-5, CM-7

PCI DSS 4: 8.2.1, 8.3.1

HIGH PHX-157 — MySQL CVE-2012-2122 Authentication Bypass

Remediation: Upgrade MySQL to 5.1.63, 5.5.25a, or 5.6.6 or later where this timing vulnerability was patched. Apply vendor security patches. Restrict MySQL network access to trusted hosts only. Enable SSL/TLS for client connections.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A07:2021 – Identification and Authentication Failures

MITRE ATT&CK: T1078 (Initial Access)

NIST 800-53: IA-2, SI-2

PCI DSS 4: 6.3.3, 8.2.1

CRITICAL PHX-158 — VMware ESXi Management Interface Exposed

Remediation: Restrict ESXi management interfaces (TCP/443, 902, 443) to a dedicated management VLAN accessible only via VPN or jump host. Apply all VMware security advisories. Disable unnecessary services (e.g., SLP on port 427). Enable ESXi lockdown mode.

Effort: Medium

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

MITRE ATT&CK: T1210 (Lateral Movement), T1046 (Discovery)

NIST 800-53: CM-7, AC-17, RA-5

PCI DSS 4: 1.3.1, 6.3.3

CISA KEV

CRITICAL PHX-159 — Oracle Database Vulnerability (ODAT)

Remediation: Change all Oracle default credentials immediately. Apply all Oracle Critical Patch Updates. Restrict Oracle listener port (1521) to application servers only. Disable Oracle TNS listener remote administration. Implement Oracle Database Vault to restrict privileged access.

Effort: Medium

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A07:2021 – Identification and Authentication Failures

MITRE ATT&CK: T1078 (Initial Access), T1190 (Initial Access)

NIST 800-53: IA-2, IA-5, CM-7, SI-2

PCI DSS 4: 8.2.1, 8.3.1, 6.3.3

CRITICAL PHX-160 — MSSQL Vulnerability / Default Credentials

Remediation: Disable or rename the SA account; set a strong password if it must remain enabled. Disable xp_cmdshell stored procedure. Restrict MSSQL port (1433/1434) to application servers only. Apply all SQL Server security patches. Enforce Windows Authentication mode where possible.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A07:2021 – Identification and Authentication Failures

MITRE ATT&CK: T1078 (Initial Access)

NIST 800-53: IA-2, IA-5, CM-7

PCI DSS 4: 8.2.1, 8.3.1

HIGH PHX-161 — Active Directory Kerberoasting

Remediation: Audit service accounts with SPNs registered. Rotate passwords for all kerberoastable service accounts to long (25+ char) random passwords. Use Managed Service Accounts (MSA) or Group Managed Service Accounts (gMSA) to eliminate static service account passwords. Enable AES-256 Kerberos encryption and disable RC4.

Effort: Medium

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

MITRE ATT&CK: T1558.003 (Credential Access)

NIST 800-53: IA-5, AC-6, AU-12

PCI DSS 4: 8.3.1, 8.4.2

HIGH PHX-162 — AS-REP Roasting — Pre-Authentication Not Required

Remediation: Enable Kerberos pre-authentication on all user accounts (remove the DONT_REQUIRE_PREAUTH flag). This is the default and should be enforced via Group Policy. Audit AD accounts with pre-auth disabled and rotate their passwords to long random values. Use gMSA for service accounts.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

MITRE ATT&CK: T1558.004 (Credential Access)

NIST 800-53: IA-5, AC-6

PCI DSS 4: 8.3.1

HIGH PHX-163 — BloodHound — Active Directory Attack Path Discovered

Remediation: Review all BloodHound-identified attack paths and remediate shortest paths to Domain Admin. Key actions: remove unnecessary group memberships (AdminTo/GenericAll edges), disable ACL-based privilege escalation paths, implement Protected Users security group, enable Privileged Access Workstations (PAWs), and tier administrative account model.

Effort: High

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

MITRE ATT&CK: T1482 (Discovery), T1087.002 (Discovery), T1069.002 (Discovery)

NIST 800-53: AC-6, AC-2, AU-12

PCI DSS 4: 7.2.1, 8.4.2

HIGH PHX-164 — LDAP Anonymous Bind / Domain User Enumeration

Remediation: Disable LDAP anonymous bind on Active Directory domain controllers. Restrict LDAP/LDAPS (ports 389/636) to authorised application servers and admin systems. Enable LDAP signing and channel binding (KB4520412). Require LDAP authentication for all directory queries.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

MITRE ATT&CK: T1087.002 (Discovery)

NIST 800-53: AC-3, IA-2, CM-7

PCI DSS 4: 7.2.1, 8.2.1

HIGH PHX-165 — Domain Account No Password Required

Remediation: Audit all domain accounts with the PASSWD_NOTREQD flag (userAccountControl attribute) and clear the flag via 'Set-ADUser -PasswordNotRequired $false'. Enforce domain password policy via Group Policy (minimum length 12+, complexity enabled). Disable or delete accounts that genuinely require no password.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A07:2021 – Identification and Authentication Failures

MITRE ATT&CK: T1078.002 (Defense Evasion)

NIST 800-53: IA-5, AC-2

PCI DSS 4: 8.3.1, 8.3.6

HIGH PHX-166 — SMB Null Session Permitted

Remediation: Restrict null sessions via Group Policy: set 'Network access: Restrict anonymous access to Named Pipes and Shares' and 'Network access: Do not allow anonymous enumeration of SAM accounts'. In registry: set HKLM\System\CurrentControlSet\Control\Lsa\RestrictAnonymous = 2.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

MITRE ATT&CK: T1135 (Discovery), T1078 (Defense Evasion)

NIST 800-53: AC-3, CM-7, IA-2

PCI DSS 4: 7.2.1, 2.2.4

HIGH PHX-167 — WordPress Core / Theme / Plugin Vulnerability (WPScan)

Remediation: Update WordPress core, all themes, and all plugins to current versions. Remove unused plugins and themes. Enable auto-updates for minor WordPress versions. Disable XML-RPC if not required. Use a web application firewall (Wordfence or similar). Disable user enumeration via ?author= parameter.

Effort: Medium

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

OWASP Web: A06:2021 – Vulnerable and Outdated Components

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: SI-2, CM-7, RA-5

PCI DSS 4: 6.3.3, 6.3.2

CRITICAL PHX-168 — OS End-of-Life — No Vendor Security Support

Remediation: Plan and execute immediate upgrade or replacement of all end-of-life operating systems to a currently supported version. Where immediate replacement is not feasible, implement compensating controls: network isolation, host-based firewalling, enhanced monitoring, and document risk acceptance. Engage vendor for extended security support options.

Effort: High

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A06:2021 – Vulnerable and Outdated Components

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: SI-2, SA-22, CM-8

PCI DSS 4: 6.3.3, 12.3.4

LOW PHX-169 — SSL/TLS Certificate — Validity Period Concerns

Remediation: Replace certificates with validity exceeding 398 days (Apple/browser-enforced limit). Ensure all certificates include Subject Alternative Names (SANs). Fix incomplete certificate chains by installing intermediate CA certificates. Automate certificate renewal with Let's Encrypt or ACME protocol. Use certificates with RSA-2048+ or ECDSA-256+ keys.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 – Security Misconfiguration

MITRE ATT&CK: T1552.004 (Credential Access)

NIST 800-53: SC-17, IA-5

PCI DSS 4: 4.2.1

MEDIUM PHX-170 — SSL/TLS Session and Cipher Configuration Issues

Remediation: Disable SSLv2, SSLv3, TLS 1.0, and TLS 1.1. Remove NULL, EXPORT, RC4, DES, 3DES, and ANON cipher suites. Enable server cipher order preference. Configure TLS session tickets securely or disable. Use testssl.sh or SSLLabs to validate. Require TLS 1.2 as minimum with TLS 1.3 preferred.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A02:2021 – Cryptographic Failures

MITRE ATT&CK: T1040 (Credential Access)

NIST 800-53: SC-8, SC-28, CM-6

PCI DSS 4: 4.2.1, 2.2.4

INFO PHX-171 — SSL Certificate Issuer Transparency

Remediation: Informational: review the certificate issuer chain to confirm only trusted, internal or public CAs are authorised to issue certificates for this domain. Enrol the domain in Certificate Transparency monitoring (e.g., crt.sh alerts) to detect unauthorised issuance. Verify serial number entropy meets CABF Baseline Requirements (>= 64 bits).

Effort: Low

MITRE ATT&CK: T1596.003 (Reconnaissance)

NIST 800-53: SC-17

PCI DSS 4: 4.2.1

HIGH PHX-172 — Public Exploit or Metasploit Module Available

Remediation: Prioritise patching of any vulnerability with a public exploit or Metasploit module — these represent near-zero barrier-to-exploitation. Apply the relevant vendor patch immediately. If patching is not immediately possible, implement compensating controls (WAF rules, network segmentation). Cross-reference against CISA KEV catalogue.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A06:2021 – Vulnerable and Outdated Components

MITRE ATT&CK: T1190 (Initial Access), T1203 (Execution)

NIST 800-53: SI-2, RA-5, RA-3

PCI DSS 4: 6.3.3

CRITICAL PHX-173 — Brute-Force Valid Credentials Found

Remediation: Immediately rotate all discovered credentials. Enforce multi-factor authentication on all network-accessible services. Implement account lockout after 5 failed attempts. Replace default credentials across all devices. Disable password-based authentication for SSH in favour of key-based authentication.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A07:2021 – Identification and Authentication Failures

OWASP API: API2:2023 – Broken Authentication

MITRE ATT&CK: T1110 (Credential Access), T1078 (Initial Access)

NIST 800-53: IA-5, AC-7, SI-4

PCI DSS 4: 8.3.1, 8.3.4, 8.3.6

HIGH PHX-174 — Privileged Domain Accounts Discovered

Remediation: Apply least-privilege principles: remove unnecessary administrative group memberships. Implement a tiered administration model (Tier 0/1/2) to restrict Domain Admin usage. Restrict ADMIN$/C$ share access to authorised management hosts only. Enable SMB access auditing. Rotate credentials for all identified privileged accounts.

Effort: Medium

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A01:2021 – Broken Access Control

OWASP API: API1:2023 – Broken Object Level Authorization

MITRE ATT&CK: T1069.002 (Discovery), T1021.002 (Lateral Movement)

NIST 800-53: AC-6, AC-2, IA-5

PCI DSS 4: 7.2.1, 8.4.2

HIGH PHX-175 — Unknown CVE / Vulners Match

Remediation: Investigate each CVE match individually using the CVE identifier. Verify exploitability in context (network position, service version, configuration). Apply the relevant vendor patch or update. Cross-reference with CISA KEV, NVD, and vendor security advisories. Implement a vulnerability management programme to track and remediate identified CVEs within SLA.

Effort: Medium

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A06:2021 – Vulnerable and Outdated Components

MITRE ATT&CK: T1190 (Initial Access), T1210 (Lateral Movement)

NIST 800-53: SI-2, RA-5, CM-8

PCI DSS 4: 6.3.3

MEDIUM PHX-176 — OSINT Email Address Exposure

Remediation: Audit public-facing sources (websites, WHOIS, job postings, breach databases) for exposed employee email addresses. Implement email address format obfuscation on public pages. Train staff on phishing risks arising from harvested email addresses.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

MITRE ATT&CK: T1598.003 (Reconnaissance), T1589.002 (Reconnaissance)

NIST 800-53: PM-5, PL-4, RA-2

PCI DSS 4: 12.5.1

INFO PHX-177 — OSINT IP Address Mapping

Remediation: Maintain an accurate asset inventory of all public-facing IP addresses and ASN blocks. Review cloud provider configurations to avoid unnecessarily exposing internal IP ranges. Use private IP addressing and NAT/PAT for internal services wherever possible.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

MITRE ATT&CK: T1590.005 (Reconnaissance)

NIST 800-53: CM-8, RA-2

PCI DSS 4: 12.5.1

MEDIUM PHX-178 — Internal Server Path/Directory Structure Disclosed

Remediation: Audit archived web snapshots (Wayback Machine, CommonCrawl) for pages revealing internal paths, admin directories, or sensitive file locations. Submit removal requests to archive services where applicable. Ensure web server error pages do not leak directory structures.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 – Security Misconfiguration

MITRE ATT&CK: T1083 (Discovery)

NIST 800-53: CM-7, SI-12

PCI DSS 4: 6.2.4

LOW PHX-179 — OSINT PII Exposure — Phone Number

Remediation: Review publicly accessible pages, metadata, and contact forms for inadvertent phone number exposure. Apply data minimisation principles — only publish contact numbers that need to be public. Monitor external sources with OSINT tooling for leaked PII on a periodic basis.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

MITRE ATT&CK: T1589.001 (Reconnaissance)

NIST 800-53: PM-5, PL-4, SC-28

PCI DSS 4: 12.5.1

HIGH PHX-180 — OSINT PII Exposure — Social Security Number Pattern

Remediation: Immediately investigate any SSN-pattern strings discovered via OSINT to determine if real data has been exposed. If confirmed, invoke the incident response process, notify affected individuals, and report to relevant data protection authorities under applicable breach notification requirements. Implement DLP controls and audit document stores for improperly shared sensitive identifiers.

Effort: High

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

MITRE ATT&CK: T1589 (Reconnaissance)

NIST 800-53: SC-28, PM-5, PL-4

PCI DSS 4: 12.5.1

MEDIUM PHX-181 — MTA-STS / Email Transport Security Missing

Remediation: Publish a valid SPF record that restricts authorised sending IP ranges. Configure DKIM signing for all outbound mail. Set a DMARC policy of at least 'p=quarantine' with aggregate reporting. Deploy MTA-STS to enforce TLS on inbound mail flows and publish a TLSRPT record for delivery failure monitoring.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

MITRE ATT&CK: T1566 (Initial Access), T1036 (Defense Evasion)

NIST 800-53: SC-5, SI-8, SC-8

PCI DSS 4: 12.5.1

MEDIUM PHX-182 — DNSSEC Not Configured

Remediation: Enable DNSSEC for all authoritative zones to cryptographically validate DNS responses. Sign all zone records with an appropriate algorithm (ECDSA P-256 recommended). Ensure registrar support for DS record publication. Review wildcard DNS records and remove or scope them appropriately to prevent subdomain takeover risk.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

NIST 800-53: SC-20, SC-21

PCI DSS 4: 1.3.3

MEDIUM PHX-183 — Third-Party / Supply Chain Domain Risk

Remediation: Maintain a current inventory of all third-party domains and packages integrated into applications. Monitor for expired or unclaimed third-party domains that could be registered by an adversary. Implement private package registries and scope-locked dependency resolution to mitigate dependency confusion attacks. Conduct periodic third-party risk assessments.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

OWASP Web: A08:2021 – Software and Data Integrity Failures

MITRE ATT&CK: T1195 (Initial Access)

NIST 800-53: SA-12, SR-3

PCI DSS 4: 12.8.1, 12.8.4

MEDIUM PHX-184 — WSDL / SOAP Service Definition Exposed

Remediation: Restrict WSDL access to authorised consumers only — require authentication or restrict by IP. Remove or redact internal operation details from publicly accessible WSDLs. Apply the principle of least privilege to SOAP endpoint exposure and disable auto-generation of service documentation in production.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 – Security Misconfiguration

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1046 (Discovery)

NIST 800-53: CM-7, CM-6, RA-5

PCI DSS 4: 6.2.4

CRITICAL PHX-185 — WS-Security Authentication Bypass

Remediation: Enforce strict WS-Security UsernameToken validation — reject empty or blank PasswordDigest values. Enforce timestamp freshness with a maximum clock skew of 5 minutes and reject replay tokens. Use transport-level TLS in addition to message-level WS-Security. Upgrade legacy SOAP stacks to supported versions with known-secure WS-Security implementations.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A07:2021 – Identification and Authentication Failures

OWASP API: API2:2023 – Broken Authentication

MITRE ATT&CK: T1078 (Defense Evasion), T1556 (Credential Access)

NIST 800-53: IA-5, SC-8, AC-17

PCI DSS 4: 8.3.6, 4.2.1

HIGH PHX-186 — WS-Addressing SSRF via ReplyTo/FaultTo

Remediation: Validate and restrict WS-Addressing ReplyTo and FaultTo header values to an allowlist of trusted internal endpoints. Do not route SOAP replies to attacker-supplied URLs. Disable WS-Addressing support entirely if the application does not require it. Apply egress filtering to prevent the SOAP service from making outbound requests to arbitrary hosts.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

OWASP Web: A10:2021 – Server-Side Request Forgery

OWASP API: API7:2023 – Server Side Request Forgery

MITRE ATT&CK: T1090 (Command and Control)

NIST 800-53: SI-10, CA-9, SC-7

PCI DSS 4: 6.2.4

HIGH PHX-187 — Serialization Marker in API Response (Deserialization Risk)

Remediation: Do not deserialize data from third-party API responses without type validation. Avoid consuming Java serialized objects or pickle streams from external sources. If serialized data must be processed, implement integrity checks, use allowlist-based deserializers, and run deserialization in sandboxed environments with restricted class loading.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A08:2021 – Software and Data Integrity Failures

OWASP API: API10:2023 – Unsafe Consumption of APIs

MITRE ATT&CK: T1059 (Execution)

NIST 800-53: SI-10, SA-11

PCI DSS 4: 6.2.4

HIGH PHX-188 — Unsafe Webhook URL Consumption (SSRF)

Remediation: Validate webhook callback URLs against an allowlist of permitted domains before accepting. Block private, loopback, link-local, and cloud metadata IP ranges (169.254.169.254, 10.0.0.0/8, etc.) at the application layer. Enforce egress firewall rules on servers that process webhook registrations. Require HTTPS and verify TLS certificates for all outbound webhook deliveries.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

OWASP Web: A10:2021 – Server-Side Request Forgery

OWASP API: API7:2023 – Server Side Request Forgery

MITRE ATT&CK: T1090.002 (Command and Control)

NIST 800-53: SI-10, SC-7, CA-9

PCI DSS 4: 6.2.4

HIGH PHX-189 — Deprecated Protocol — Cleartext Service in Use

Remediation: Replace all cleartext protocols (HTTP, FTP, Telnet, SMTP without STARTTLS) with their encrypted equivalents (HTTPS, SFTP/FTPS, SSH, SMTPS). Enforce HTTPS with HSTS. Capture and remediate any credentials transmitted over unencrypted channels. Apply egress filtering to block cleartext service connections from internal hosts.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A02:2021 – Cryptographic Failures

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1040 (Credential Access)

NIST 800-53: SC-8, SC-28, CM-7

PCI DSS 4: 4.2.1, 4.2.2

LOW PHX-190 — Service/Application Version Disclosure — Reconnaissance

Remediation: Remove or genericise Server, X-Powered-By, Via, and X-AspNet-Version HTTP response headers. Configure web servers and application frameworks to suppress version strings from banners and error messages. Keep all disclosed components up to date to minimise the value of version information to an attacker.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 – Security Misconfiguration

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1592.002 (Reconnaissance)

NIST 800-53: CM-7, SI-12

PCI DSS 4: 6.2.4

INFO PHX-191 — Recon: Web Application or API Identified

Remediation: Informational finding — no immediate remediation required. Use this discovery to ensure the identified application is included in the asset inventory, kept patched, and covered by periodic security assessments. Replace default web server pages with custom content and remove default applications that are not in use.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

MITRE ATT&CK: T1590 (Reconnaissance)

NIST 800-53: CM-8, RA-2

PCI DSS 4: 12.5.1

LOW PHX-192 — Robots.txt Sensitive Path Disclosure

Remediation: Review robots.txt for entries referencing admin panels, internal APIs, backup directories, or other sensitive paths. Remove or genericise disallow entries that reveal security-relevant path structures. Rely on server-side access controls rather than robots.txt to protect sensitive paths — robots.txt provides no access restriction.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 – Security Misconfiguration

MITRE ATT&CK: T1083 (Discovery)

NIST 800-53: CM-7, SI-12

PCI DSS 4: 6.2.4

INFO PHX-193 — Hostname / DNS Reverse Lookup Information

Remediation: Informational finding — no immediate remediation required. Ensure discovered hostnames and subdomains are included in the asset inventory and covered by patch management and security scanning. Decommission or remove DNS records for unused or orphaned subdomains to prevent subdomain takeover.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

MITRE ATT&CK: T1590.001 (Reconnaissance)

NIST 800-53: CM-8, RA-2

PCI DSS 4: 12.5.1

CRITICAL PHX-216 — WPA/WPA2 Pre-Shared Key Capture and Offline Cracking

Remediation: Replace PSK with a strong random passphrase of 20+ characters not found in wordlists. Enforce WPA3-SAE where hardware supports it. Rotate the PSK immediately after discovery. Consider WPA3-Enterprise with certificate-based authentication.

Effort: Low

CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

MITRE ATT&CK: T1110.002 (Credential Access), T1040 (Credential Access)

NIST 800-53: SC-8, IA-5, SC-40, AC-17

PCI DSS 4: 4.2.1, 8.3.6

CRITICAL PHX-217 — WPA-Enterprise (EAP/MSCHAPv2) Credentials Captured

Remediation: Deploy client-side certificate validation against a pinned RADIUS CA certificate. Replace PEAP/MSCHAPv2 with EAP-TLS using mutual certificate authentication. Disable weaker EAP methods. Immediately rotate all credentials captured or potentially exposed.

Effort: High

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

MITRE ATT&CK: T1557 (Credential Access), T1040 (Credential Access), T1110.002 (Credential Access)

NIST 800-53: SC-8, IA-5, IA-3, SC-40

PCI DSS 4: 4.2.1, 8.3.1, 8.6.1

HIGH PHX-218 — WPA3 SAE Dragonblood Vulnerability

Remediation: Apply AP firmware updates addressing CVE-2019-9494 through CVE-2019-9502. Ensure the WPA3 SAE implementation performs strict elliptic-curve point validation and anti-clogging token support. Upgrade to hostapd/wpa_supplicant 2.10+.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

MITRE ATT&CK: T1040 (Credential Access)

NIST 800-53: SC-8, SC-40, SI-2, RA-5

PCI DSS 4: 4.2.1, 6.3.3

HIGH PHX-219 — KRACK — WPA2 Key Reinstallation Attack

Remediation: Apply OS and driver security patches addressing CVE-2017-13077 through CVE-2017-13080 on all wireless clients and APs. Upgrade to wpa_supplicant/hostapd 2.7+. Prioritise patching Android 6.0 devices which reinstall an all-zero key.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

MITRE ATT&CK: T1040 (Credential Access), T1557 (Credential Access)

NIST 800-53: SC-8, SI-2, SC-40, RA-5

PCI DSS 4: 4.2.1, 6.3.3

CRITICAL PHX-220 — WEP Encryption — Broken Protocol in Use

Remediation: Immediately replace WEP with WPA3-Personal or at minimum WPA2-Personal (AES/CCMP). WEP cannot be patched — upgrade or replace the AP. Segment legacy WEP-only devices onto an isolated VLAN with no access to sensitive resources until replaced. Rotate all credentials used on this network.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

MITRE ATT&CK: T1040 (Credential Access)

NIST 800-53: SC-8, SC-40, CM-6, RA-5

PCI DSS 4: 4.2.1, 6.3.3, 12.3.3

CRITICAL PHX-221 — Open Wireless Network — No Encryption

Remediation: Enable WPA3-Personal or WPA2-Personal (AES/CCMP). For intentionally open networks (guest/public), enforce TLS for all services, enable AP client isolation, and display a legal notice. Consider 802.11u Hotspot 2.0 / Passpoint for authenticated open networks.

Effort: Low

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

MITRE ATT&CK: T1040 (Credential Access)

NIST 800-53: SC-8, SC-40, PE-3, AC-17

PCI DSS 4: 4.2.1, 12.3.3

HIGH PHX-222 — WPS Enabled — PIN/Brute-Force Attack Surface

Remediation: Disable WPS on all access points where not operationally required. If WPS must remain enabled, ensure WPS 2.0 with lockout after 3 failed attempts is implemented and apply all vendor firmware patches addressing the Pixie-Dust vulnerability.

Effort: Low

CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

MITRE ATT&CK: T1110 (Credential Access)

NIST 800-53: SC-8, SC-40, CM-6, IA-5

PCI DSS 4: 4.2.1, 6.3.3

HIGH PHX-223 — WPA3 Transition Mode — Downgrade to WPA2

Remediation: Migrate to WPA3-only mode when all clients support WPA3-SAE. In the interim, enforce 802.11w (PMF) as mandatory to prevent deauthentication-based downgrade attacks. Consider a separate SSID for legacy WPA2 clients.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

MITRE ATT&CK: T1040 (Credential Access), T1557 (Credential Access)

NIST 800-53: SC-8, SC-40, CM-6

PCI DSS 4: 4.2.1, 12.3.3

HIGH PHX-224 — KNOB Attack — Bluetooth Encryption Key Entropy Reduction

Remediation: Apply vendor firmware patches enforcing a minimum Bluetooth encryption key entropy of 7 bytes (preferably 16). Prefer BLE with LE Secure Connections (LESC) which is not affected. Disable BR/EDR on devices where only BLE is operationally required.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

MITRE ATT&CK: T1040 (Credential Access)

NIST 800-53: SC-8, SC-40, SI-2, SC-25

PCI DSS 4: 4.2.1, 6.3.3

HIGH PHX-225 — BIAS Attack — Bluetooth Impersonation via Authentication Bypass

Remediation: Apply manufacturer firmware updates addressing CVE-2020-10135. Require Secure Simple Pairing (SSP) with Secure Connections for all BR/EDR sessions and enforce mutual authentication. Disable legacy authentication fallback where supported.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

MITRE ATT&CK: T1557 (Credential Access)

NIST 800-53: SC-8, IA-3, SC-40, SI-2

PCI DSS 4: 4.2.1, 8.6.1, 6.3.3

HIGH PHX-226 — BLUFFS — Bluetooth Forward Secrecy Attack

Remediation: Apply vendor patches implementing session-key diversification and forward-secret key derivation per Bluetooth SIG guidance on CVE-2023-24023. Use application-layer protocols with independent forward secrecy (e.g., TLS 1.3 over Bluetooth RFCOMM) for sensitive communications.

Effort: High

CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

MITRE ATT&CK: T1040 (Credential Access)

NIST 800-53: SC-8, SC-40, SI-2, SC-25

PCI DSS 4: 4.2.1, 6.3.3

HIGH PHX-227 — Bluetooth Low Energy Weak Pairing — Crackable Temporary Key

Remediation: Migrate all BLE devices to LE Secure Connections (LESC/SMP v2) which uses ECDH key exchange and is not vulnerable to passive TK recovery. If legacy pairing cannot be avoided, use Passkey Entry with out-of-band delivery and avoid hardcoded or predictable PINs.

Effort: High

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

MITRE ATT&CK: T1110.002 (Credential Access)

NIST 800-53: SC-8, IA-5, SC-40

PCI DSS 4: 4.2.1, 8.3.6

HIGH PHX-228 — BLE GATT Service — Unauthenticated Read/Write Access

Remediation: Apply ATT permissions requiring authenticated encrypted connections (BLE security mode 1, level 3+) for all GATT characteristics carrying sensitive data or accepting writes. Implement application-layer command authentication (HMAC or signed payloads) as defence-in-depth.

Effort: High

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

OWASP API: API2:2023 – Broken Authentication

MITRE ATT&CK: T1602 (Collection)

NIST 800-53: AC-3, IA-3, SC-40

PCI DSS 4: 8.6.1, 6.2.4

CRITICAL PHX-229 — Bluetooth Stack CVE — Remote Code Execution

Remediation: Immediately apply all available Bluetooth stack firmware updates. Disable Bluetooth discoverable/connectable modes when not in active use. Isolate unpatched devices from untrusted Bluetooth environments. Deploy Bluetooth IDS to detect known exploit signatures.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

MITRE ATT&CK: T1210 (Lateral Movement)

NIST 800-53: SI-2, RA-5, SC-40, IR-4

PCI DSS 4: 6.3.3, 12.10.1

CISA KEV

MEDIUM PHX-230 — Bluetooth SDP Service Discovery — Internal Service Disclosure

Remediation: Restrict SDP browse responses to authenticated connections. Remove or obfuscate unnecessary service attributes from SDP records. Disable profiles and services not operationally required to reduce discoverable attack surface.

Effort: Low

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 – Security Misconfiguration

MITRE ATT&CK: T1592 (Reconnaissance)

NIST 800-53: CM-7, RA-5, SC-40

PCI DSS 4: 6.2.4

HIGH PHX-231 — Bluetooth BR/EDR Cleartext Traffic — Passive Eavesdropping

Remediation: Ensure all BR/EDR sessions use encryption with maximum entropy key negotiation (16 bytes). Apply the KNOB patch. Use application-layer encryption (TLS/DTLS) over RFCOMM for sensitive data streams. Upgrade to BLE with LE Secure Connections where use case allows.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

MITRE ATT&CK: T1040 (Credential Access)

NIST 800-53: SC-8, SC-40, SC-25

PCI DSS 4: 4.2.1

MEDIUM PHX-232 — BLE Static MAC Address — Device Tracking and Weak Pairing

Remediation: Enable Bluetooth resolvable private address (RPA) rotation with an appropriate interval (15 minutes or shorter). Replace Just Works pairing with Numeric Comparison, OOB, or Passkey Entry. Require LE Secure Connections to resist MITM during pairing.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

MITRE ATT&CK: T1557 (Credential Access)

NIST 800-53: SC-25, IA-3, SC-40

PCI DSS 4: 4.2.1

HIGH PHX-233 — BLE MITM Attack via Device Cloning (GATTacker)

Remediation: Enforce authenticated pairing (Numeric Comparison or OOB). Implement application-layer certificate pinning or GATT profile fingerprint validation. Use LE Secure Connections to resist MITM during pairing. Ensure central apps validate full GATT profile against an expected fingerprint.

Effort: High

CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

MITRE ATT&CK: T1557 (Credential Access)

NIST 800-53: SC-8, IA-3, SC-40

PCI DSS 4: 4.2.1, 8.6.1

HIGH PHX-234 — Bluetooth Denial-of-Service and Physical Firmware Extraction

Remediation: Apply Bluetooth stack firmware updates with rate-limiting and malformed-frame rejection. Enable all JTAG/SWD debug port protection (fuse blow, APProtect, RDP level 2). Store cryptographic secrets in secure elements inaccessible from the main MCU. Remove or decap debug headers from production hardware.

Effort: High

CVSS Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

MITRE ATT&CK: T1499 (Impact), T1592 (Reconnaissance)

NIST 800-53: PE-3, PE-6, SC-25, SI-2, IR-4

PCI DSS 4: 9.2.1, 12.10.1

CRITICAL PHX-235 — ZigBee Network Key Exposure — Intercept, Default, or Plaintext

Remediation: Rotate the network key immediately. Configure a unique TCLK per installation. Disable join window after commissioning. Encrypt stored keys using OS-level secret stores. Migrate to ZigBee 3.0 with install-code-based commissioning.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

MITRE ATT&CK: T1040 (Credential Access), T1552.001 (Credential Access)

NIST 800-53: SC-8, SC-25, IA-5, CM-6

PCI DSS 4: 4.2.1, 8.3.6

HIGH PHX-236 — ZigBee Replay Attack

Remediation: Enforce strict ZigBee frame counter validation per specification. Devices must reject frames with counters outside the accepted replay protection window. Apply vendor firmware patches that implement per-device frame counter tracking.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

MITRE ATT&CK: T1550 (Lateral Movement)

NIST 800-53: SC-8, SC-25, CM-6

PCI DSS 4: 4.2.1, 6.2.4

HIGH PHX-237 — ZigBee Cluster Library (ZCL) Command Injection

Remediation: Rotate network key immediately. Implement application-layer authentication for security-critical clusters (Door Lock, IAS Zone, Thermostat). Enforce allow-listed device EUI64s for security-critical command sources at the coordinator level.

Effort: High

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

OWASP Web: A03:2021 – Injection

OWASP API: API3:2023 – Injection

MITRE ATT&CK: T1059 (Execution), T1565.001 (Impact)

NIST 800-53: SC-8, SC-25, AC-3, CM-6

PCI DSS 4: 4.2.1, 6.2.4

HIGH PHX-238 — ZigBee Light Link (ZLL) Touchlink Attack — Device Theft and Factory Reset

Remediation: Disable touchlink commissioning on production devices via coordinator policy. Deploy ZigBee 3.0 with enhanced touchlink security (install-code-based commissioning). Replace ZLL-only devices with ZigBee 3.0 devices. Apply vendor firmware updates restricting touchlink resets to same-network devices.

Effort: High

CVSS Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

MITRE ATT&CK: T1498 (Impact), T1565 (Impact)

NIST 800-53: PE-3, SC-25, CM-6

PCI DSS 4: 9.2.1, 6.3.3

HIGH PHX-239 — ZigBee Network Denial-of-Service

Remediation: Implement RF environment monitoring with anomaly alerting. Deploy ZigBee network with channel agility enabled. Configure coordinator with rate-limiting on association requests. Consider Distributed Trust Center mode to reduce coordinator as a single point of failure.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

MITRE ATT&CK: T1498 (Impact)

NIST 800-53: SC-25, SC-5, IR-4

PCI DSS 4: 12.10.1

CRITICAL PHX-240 — ZigBee Hardcoded Credentials or Key in Firmware

Remediation: Remove hardcoded keys from firmware. Use unique-per-device key provisioning via secure manufacturing. Enable debug port lockdown (JTAG fuse blow). Store cryptographic keys in dedicated hardware security elements or encrypted key stores protected by device-unique keys.

Effort: High

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

OWASP Web: A05:2021 – Security Misconfiguration

MITRE ATT&CK: T1552.001 (Credential Access), T1592 (Reconnaissance)

NIST 800-53: IA-5, SC-25, PE-3, CM-6

PCI DSS 4: 8.3.6, 6.2.4

HIGH PHX-241 — ZigBee Open Join Window and ZDO Enumeration

Remediation: Close join window after commissioning and only open briefly (max 60 seconds) when adding new devices. Implement automated join window closure. Restrict ZDO enumeration to authenticated sessions. Audit all joined devices to verify they are authorised.

Effort: Low

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

OWASP Web: A05:2021 – Security Misconfiguration

OWASP API: API2:2023 – Broken Authentication

MITRE ATT&CK: T1046 (Discovery)

NIST 800-53: AC-3, SC-25, CM-6, IA-3

PCI DSS 4: 6.2.4, 8.6.1

CRITICAL PHX-242 — ZigBee OTA Firmware Update Without Authentication

Remediation: Implement signed OTA firmware updates with public-key verification per the ZigBee OTA Upgrade cluster specification. The device must verify the firmware image signature against a vendor public key embedded in ROM before applying any update. Reject unsigned or incorrectly signed images.

Effort: High

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

OWASP Web: A08:2021 – Software and Data Integrity Failures

MITRE ATT&CK: T1195.002 (Initial Access)

NIST 800-53: SI-7, CM-6, SA-10, SC-25

PCI DSS 4: 6.3.3, 6.2.4

HIGH PHX-243 — ZigBee Protocol Fuzzing Crash and ZLL Master Key Deployment

Remediation: Apply vendor firmware patches with input validation for all received ZigBee frame fields. Implement watchdog timers with automatic recovery. Migrate from ZLL to ZigBee 3.0. Disable touchlink commissioning at coordinator level where ZLL master key exposure is confirmed.

Effort: High

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

MITRE ATT&CK: T1499 (Impact), T1040 (Credential Access)

NIST 800-53: SC-25, SI-2, CM-6, IR-4

PCI DSS 4: 6.3.3, 12.10.1

CRITICAL PHX-244 — Ghost Peak Attack — UWB Distance Reduction Exploit

Remediation: Apply firmware patches enabling STS (Scrambled Timestamp Sequence) integrity checking in IEEE 802.15.4z SP3 mode. Enforce STS on all ranging sessions and reject legacy SP0 sessions. Supplement with additional physical access controls (NFC tap, PIN) for high-security scenarios.

Effort: High

CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

MITRE ATT&CK: T1583 (Resource Development), T1565 (Impact)

NIST 800-53: PE-3, PE-6, SC-25, IA-3

PCI DSS 4: 9.2.1

CRITICAL PHX-245 — RTLS Management Console — Default Credentials

Remediation: Immediately change all default credentials to unique randomly generated passwords of 16+ characters. Implement account lockout after 5 failed attempts, enforce MFA. Restrict management console to a dedicated administrative VLAN with firewall ACLs limiting access to specific workstations.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

OWASP Web: A07:2021 – Identification and Authentication Failures

OWASP API: API2:2023 – Broken Authentication

MITRE ATT&CK: T1078 (Initial Access), T1110.001 (Credential Access)

NIST 800-53: IA-5, AC-2, CM-6

PCI DSS 4: 8.3.6, 8.4.2

CRITICAL PHX-246 — MQTT Broker — Unauthenticated Access and Cleartext Credentials

Remediation: Enable MQTT broker authentication requiring username/password for all clients and disable anonymous access. Migrate all MQTT traffic to TLS-encrypted port 8883. Implement MQTT ACL rules restricting clients to required topics only. Rotate all credentials previously transmitted in cleartext.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

OWASP Web: A07:2021 – Identification and Authentication Failures

OWASP API: API2:2023 – Broken Authentication

MITRE ATT&CK: T1040 (Credential Access), T1078 (Initial Access)

NIST 800-53: AC-3, SC-8, IA-3, CM-6

PCI DSS 4: 4.2.1, 8.3.1, 8.6.1

HIGH PHX-247 — RTLS Position Data Injection via MQTT

Remediation: Require MQTT broker authentication and deploy publisher-side ACLs restricting position-topic publishing to anchor gateways only. Implement message signature validation (HMAC with anchor-specific keys) on the RTLS engine to reject unsigned or invalid position payloads.

Effort: High

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

OWASP Web: A03:2021 – Injection

OWASP API: API3:2023 – Injection

MITRE ATT&CK: T0831 (Impair Process Control), T1565.001 (Impact)

NIST 800-53: AC-3, SI-10, SC-8, CM-6

PCI DSS 4: 6.2.4, 8.6.1

CRITICAL PHX-248 — SQL Injection in RTLS Reporting Module

Remediation: Replace all dynamic SQL string construction with parameterised queries or prepared statements. Apply least-privilege to the RTLS database account (no FILE or SUPER privileges). Conduct a full code review of all user-facing query parameters and implement input validation. Deploy a WAF with SQLi detection rules.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

OWASP Web: A03:2021 – Injection

OWASP API: API3:2023 – Injection

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: SI-10, SA-11, RA-5

PCI DSS 4: 6.2.4, 6.3.2

CRITICAL PHX-249 — RTLS REST API — Unauthenticated Access

Remediation: Implement authentication middleware enforcing a valid API token or session token on all REST API routes; return HTTP 401 for unauthenticated requests. Apply RBAC so read-only tokens cannot invoke configuration-modifying endpoints. Audit the full API surface against the intended access control matrix.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A01:2021 – Broken Access Control

OWASP API: API2:2023 – Broken Authentication

MITRE ATT&CK: T1046 (Discovery)

NIST 800-53: AC-3, IA-3, CM-6

PCI DSS 4: 8.3.1, 8.6.1, 6.2.4

HIGH PHX-250 — UWB Scrambled Timestamp Sequence (STS) Key Weakness

Remediation: Ensure STS keys are derived from a cryptographically random 128-bit seed generated inside a hardware secure element and never exposed via any management API. Rotate STS session keys per-ranging-session using HKDF-SHA256 with a fresh nonce. Apply chip vendor firmware updates implementing IEEE 802.15.4z STS key management in the secure enclave.

Effort: High

CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

MITRE ATT&CK: T1040 (Credential Access), T1565 (Impact)

NIST 800-53: SC-8, SC-25, IA-3, CM-6

PCI DSS 4: 4.2.1, 6.3.3

HIGH PHX-251 — UWB Ranging Exchange — Cleartext Transmission

Remediation: Configure all UWB devices to operate in IEEE 802.15.4z SP3 mode with STS enabled. Where SP3 is unavailable on legacy hardware, enable application-layer payload encryption and minimise identifying information in ranging frame payloads. Segment UWB traffic to minimum required RF coverage area.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

MITRE ATT&CK: T1040 (Credential Access)

NIST 800-53: SC-8, SC-25, SC-40

PCI DSS 4: 4.2.1

CRITICAL PHX-252 — RTLS Anchor Firmware Update — Missing Signature Verification

Remediation: Implement mandatory cryptographic signature verification on all firmware images prior to installation using a key stored in anchor hardware (OTP fuse or secure element). Require HTTPS and strong API authentication for all firmware update endpoints. Implement a firmware version manifest with expected hash values.

Effort: High

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

OWASP Web: A08:2021 – Software and Data Integrity Failures

MITRE ATT&CK: T1195.002 (Initial Access)

NIST 800-53: SI-7, CM-6, SA-10, SC-25

PCI DSS 4: 6.3.3, 6.2.4

HIGH PHX-253 — RTLS Zone Boundary Bypass — Physical Access Control Defeat

Remediation: Implement multi-anchor consistency checks flagging ranging results that do not geometrically converge within an expected error bound. Augment UWB zone enforcement with complementary controls (badge readers, PIN pads, video verification). Enable STS mode on all anchors to mitigate the Ghost Peak attack vector.

Effort: High

CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

MITRE ATT&CK: T1565 (Impact)

NIST 800-53: PE-3, AC-3, SC-25

PCI DSS 4: 9.2.1

HIGH PHX-254 — UWB Anchor RF Flooding — Denial of Service

Remediation: Deploy UWB hardware supporting channel agility to automatically switch to alternative UWB channels when interference is detected. Implement RTLS application-level monitoring alerting when anchor-to-tag ranging failure rates exceed a threshold. Define operational procedures for switching to backup positioning methods.

Effort: High

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

MITRE ATT&CK: T1498 (Impact)

NIST 800-53: SC-25, SC-5, IR-4, PE-3

PCI DSS 4: 12.10.1

MEDIUM PHX-255 — Cross-Site Scripting in RTLS Management Dashboard

Remediation: Apply strict HTML output encoding (context-aware escaping) to all dynamic values rendered in the dashboard including tag labels, zone names, and custom metadata fields. Implement a Content Security Policy (CSP) header disallowing inline scripts. Sanitise all API-sourced string fields before storage.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

OWASP Web: A03:2021 – Injection

OWASP API: API3:2023 – Injection

MITRE ATT&CK: T1189 (Initial Access), T1059.007 (Execution)

NIST 800-53: SI-10, SC-18, CM-6

PCI DSS 4: 6.2.4

HIGH PHX-256 — Insecure Direct Object Reference in RTLS API

Remediation: Implement server-side authorisation checks on every API endpoint validating that the authenticated user has the required role or ownership to access the requested object. Use cryptographically random UUIDs instead of sequential integers for resource identifiers. Conduct a full audit of RTLS API routes against the intended access control matrix.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A01:2021 – Broken Access Control

OWASP API: API1:2023 – Broken Object Level Authorization

MITRE ATT&CK: T1083 (Discovery)

NIST 800-53: AC-3, AC-6, RA-5

PCI DSS 4: 6.2.4, 8.6.1

CRITICAL PHX-257 — Physical UWB Frame Injection — Ranging Manipulation

Remediation: Enable IEEE 802.15.4z STS (SP3 mode) on all anchors and tags to cryptographically authenticate ranging frame timestamps. Implement anchor-to-anchor cross-validation flagging unexpected ranging responses from unknown sources. Deploy RF anomaly detection for inconsistent transmission parameters. Physically secure anchor hardware against tampering.

Effort: High

CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

MITRE ATT&CK: T1565 (Impact), T1583 (Resource Development)

NIST 800-53: PE-3, SC-25, IA-3, SI-7

PCI DSS 4: 9.2.1, 4.2.1

CRITICAL PHX-258 — Database Default Credentials

Remediation: Change all default database credentials immediately. Enforce strong password policy (minimum 16 chars, complexity). Disable guest accounts. Implement account lockout after 5 failed attempts.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A07:2021 – Identification and Authentication Failures

OWASP API: API2:2023 – Broken Authentication

MITRE ATT&CK: T1078.001 (Initial Access)

NIST 800-53: IA-5, AC-17, CM-6

PCI DSS 4: 8.3.6, 2.2.1

CRITICAL PHX-259 — MongoDB Unauthenticated Access

Remediation: Enable MongoDB authentication (`security.authorization: enabled` in mongod.conf). Create application-specific users with minimal privilege. Bind to 127.0.0.1 unless network access is required. Enable TLS for all connections.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A05:2021 – Security Misconfiguration

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: AC-3, AC-6, CM-6

PCI DSS 4: 6.2.4, 2.2.1

CRITICAL PHX-260 — Redis Unauthenticated Access

Remediation: Set a strong password with `requirepass` in redis.conf. Enable ACL-based user management (Redis 6+). Bind to 127.0.0.1 with `bind 127.0.0.1`. Rename or disable dangerous commands (CONFIG, DEBUG, EVAL, SLAVEOF) using the `rename-command` directive.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A05:2021 – Security Misconfiguration

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: AC-3, AC-6, CM-6

PCI DSS 4: 6.2.4, 2.2.1

HIGH PHX-261 — Elasticsearch Unauthenticated Access

Remediation: Enable Elasticsearch X-Pack security (enabled by default in 8.x). Configure TLS and require authentication. Use role-based access control to restrict index access. Place behind a reverse proxy with authentication if X-Pack is unavailable.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A05:2021 – Security Misconfiguration

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: AC-3, CM-6, SC-8

PCI DSS 4: 6.2.4, 2.2.1

CRITICAL PHX-262 — CouchDB Admin Party — No Authentication Required

Remediation: Create at least one admin user immediately (`curl -X PUT http://TARGET:5984/_config/admins/admin -d '"strongpassword"'`). Set `bind_address = 127.0.0.1` in local.ini to prevent external access. Enable SSL. Set `require_valid_user = true` in [chttpd] configuration.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A05:2021 – Security Misconfiguration

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: AC-3, CM-6

PCI DSS 4: 6.2.4

HIGH PHX-263 — InfluxDB Unauthenticated Access

Remediation: Enable InfluxDB authentication (`auth-enabled = true` in influxdb.conf). Create admin user and database users with minimal privilege. In InfluxDB 2.x, use token-based authentication. Bind to localhost only unless remote access is required.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A05:2021 – Security Misconfiguration

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: AC-3, CM-6

PCI DSS 4: 6.2.4

HIGH PHX-264 — Neo4j Unauthenticated Access

Remediation: Enable Neo4j native authentication (`dbms.security.auth_enabled=true`). Change default neo4j/neo4j credentials on first login. Restrict Bolt (7687) and HTTP (7474) ports using firewall rules. Use role-based access control to limit read/write permissions per user.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A05:2021 – Security Misconfiguration

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: AC-3, CM-6

PCI DSS 4: 6.2.4

CRITICAL PHX-265 — Cassandra No Authentication

Remediation: Set `authenticator: PasswordAuthenticator` and `authorizer: CassandraAuthorizer` in cassandra.yaml. Change default cassandra/cassandra credentials. Enable SSL/TLS for client and inter-node communication. Use firewall rules to restrict port 9042 to application hosts only.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A05:2021 – Security Misconfiguration

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: AC-3, CM-6

PCI DSS 4: 6.2.4

HIGH PHX-266 — Memcached Unauthenticated Access — Data Dump

Remediation: Bind Memcached to localhost only (`-l 127.0.0.1`). Enable SASL authentication for any deployment requiring network access. Block port 11211 at the firewall. Do not store sensitive data in Memcached without application-level encryption.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A05:2021 – Security Misconfiguration

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1530 (Collection)

NIST 800-53: AC-3, CM-6

PCI DSS 4: 6.2.4, 2.2.1

HIGH PHX-267 — Database User Excessive Privileges

Remediation: Apply least-privilege principle: application users should only have SELECT/INSERT/UPDATE/DELETE on required tables. Remove SUPERUSER, GRANT OPTION, FILE, PROCESS, REPLICATION privileges. Create dedicated DB users per application component. Audit and remove unused accounts.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A01:2021 – Broken Access Control

OWASP API: API1:2023 – Broken Object Level Authorization

MITRE ATT&CK: T1078.003 (Privilege Escalation)

NIST 800-53: AC-6, CM-6, AC-2

PCI DSS 4: 7.2.4, 8.2.2

MEDIUM PHX-268 — Unencrypted Database Connection

Remediation: Enable SSL/TLS on database connections. For MySQL: set `require_secure_transport=ON`. For PostgreSQL: set `ssl=on` in postgresql.conf and `hostssl` in pg_hba.conf. For MongoDB: configure TLS in mongod.conf. Use valid certificates from a trusted CA.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A02:2021 – Cryptographic Failures

OWASP API: API9:2023 – Improper Inventory Management

MITRE ATT&CK: T1040 (Credential Access)

NIST 800-53: SC-8, SC-28, SC-13

PCI DSS 4: 4.2.1

MEDIUM PHX-269 — Database Audit Logging Disabled

Remediation: Enable database audit logging. For MySQL: enable `general_log` and `slow_query_log`. For PostgreSQL: configure `log_statement = 'all'` and `log_connections = on`. For MSSQL: enable SQL Server Audit. Forward logs to SIEM for correlation and alerting.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N

OWASP Web: A09:2021 – Security Logging and Monitoring Failures

OWASP API: API9:2023 – Improper Inventory Management

MITRE ATT&CK: T1562.006 (Defense Evasion)

NIST 800-53: AU-2, AU-12, AU-3

PCI DSS 4: 10.2.1, 10.3.3

HIGH PHX-270 — Outdated Database Version with Known CVEs

Remediation: Upgrade to the latest stable version of the database software. Subscribe to vendor security advisories. Implement a patching schedule for database systems. Use a vulnerability scanner (Nuclei/Tenable) to continuously track exposed DB versions against CVE databases.

Effort: High

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A06:2021 – Vulnerable and Outdated Components

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: RA-5, SI-2, SA-11

PCI DSS 4: 6.3.3

HIGH PHX-271 — Database Backup Files Accessible

Remediation: Remove backup files from web-accessible directories. Store backups in isolated storage with restricted access. Encrypt backup files at rest. Use access controls to limit who can read backup storage. Scan web roots regularly for backup file extensions (.sql, .bak, .dump, .tar.gz).

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A05:2021 – Security Misconfiguration

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1530 (Collection)

NIST 800-53: AC-3, CM-6, MP-5

PCI DSS 4: 3.5.1, 6.2.4

HIGH PHX-272 — Sensitive PII Data in Database Schema

Remediation: Encrypt PII columns at rest using AES-256 (column-level encryption or transparent data encryption). Pseudonymize data where possible. Apply field-level access controls. Conduct a data classification and retention audit. Comply with GDPR/CCPA data minimization requirements.

Effort: High

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A02:2021 – Cryptographic Failures

OWASP API: API3:2023 – Broken Object Property Level Authorization

MITRE ATT&CK: T1005 (Collection)

NIST 800-53: SC-28, MP-3, AC-6

PCI DSS 4: 3.5.1, 4.2.1

CRITICAL PHX-273 — MySQL FILE / UDF Remote Code Execution

Remediation: Revoke FILE privilege from all non-admin users (`REVOKE FILE ON *.* FROM 'user'@'host'`). Disable `local_infile`. Set `secure_file_priv` to an empty path or a restricted directory. Remove UDF functions that allow OS interaction. Run MySQL as a low-privilege OS user.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A03:2021 – Injection

OWASP API: API3:2023 – Injection

MITRE ATT&CK: T1059 (Execution)

NIST 800-53: SI-10, CM-6

PCI DSS 4: 6.2.4, 6.3.2

CRITICAL PHX-274 — PostgreSQL COPY TO PROGRAM Remote Code Execution

Remediation: Revoke SUPERUSER role from application-facing users. Use pg_hba.conf to restrict connections. Set `pg_execute_server_program` permission only on admin roles. Run PostgreSQL as a non-privileged OS user. Apply row-level security where appropriate.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A03:2021 – Injection

OWASP API: API3:2023 – Injection

MITRE ATT&CK: T1059 (Execution)

NIST 800-53: SI-10, CM-6

PCI DSS 4: 6.2.4

CRITICAL PHX-275 — Redis SLAVEOF / CONFIG Unauthorized Command Execution

Remediation: Enable Redis authentication (`requirepass`). Use the `rename-command` directive to rename or disable CONFIG, SLAVEOF, DEBUG, EVAL, and EXEC commands. Bind to localhost only. Use Redis ACLs (Redis 6+) to restrict command execution per user.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A05:2021 – Security Misconfiguration

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: CM-6, AC-3

PCI DSS 4: 6.2.4

CRITICAL PHX-276 — MSSQL xp_cmdshell Enabled — OS Command Execution

Remediation: Disable xp_cmdshell: `EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell', 0; RECONFIGURE;`. Restrict sa account. Use Windows Authentication instead of SQL authentication. Enable SQL Server Audit to detect attempted xp_cmdshell usage.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A03:2021 – Injection

OWASP API: API3:2023 – Injection

MITRE ATT&CK: T1059.001 (Execution)

NIST 800-53: SI-10, CM-7, CM-6

PCI DSS 4: 6.2.4, 6.3.2

CRITICAL PHX-277 — Oracle Database Default SYS/SYSTEM Credentials

Remediation: Change all Oracle default passwords immediately (SYS, SYSTEM, DBSNMP, SCOTT, HR, OE, SH, PM, IX, BI accounts). Use Oracle Security Assessment Tool (OSAT) for comprehensive audit. Lock or expire unused default accounts. Enable Oracle Auditing and Database Vault for additional controls.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A07:2021 – Identification and Authentication Failures

OWASP API: API2:2023 – Broken Authentication

MITRE ATT&CK: T1078.001 (Initial Access)

NIST 800-53: IA-5, CM-6

PCI DSS 4: 8.3.6, 2.2.1

HIGH PHX-278 — Database Accessible from Internet

Remediation: Place databases behind a firewall with deny-all inbound from Internet. Allow only application server IPs to connect on DB port. Use a VPN or bastion host for administrative access. Consider database proxies (ProxySQL, PgBouncer) to add an additional network layer.

Effort: High

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A05:2021 – Security Misconfiguration

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: SC-7, CM-6

PCI DSS 4: 1.3.2, 6.2.4

HIGH PHX-279 — SQL Injection via Stored Procedure or Trigger

Remediation: Refactor stored procedures to use parameterized inputs instead of dynamic SQL construction. Review all stored procedures for `EXEC()`, `sp_executesql()` with string concatenation. Apply code review to all database objects. Use database static analysis tools (sqlcheck, SonarQube with DB rules).

Effort: High

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A03:2021 – Injection

OWASP API: API3:2023 – Injection

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: SI-10

PCI DSS 4: 6.2.4

MEDIUM PHX-280 — Database Connection Pool Credentials in Error Response

Remediation: Disable verbose error messages in production (never return stack traces or connection strings to clients). Sanitize all error responses. Use centralized error handling that strips sensitive data before logging. Store credentials in secret managers (HashiCorp Vault, AWS Secrets Manager) rather than config files.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A02:2021 – Cryptographic Failures

OWASP API: API3:2023 – Broken Object Property Level Authorization

MITRE ATT&CK: T1552 (Credential Access)

NIST 800-53: SC-28, AU-2

PCI DSS 4: 3.3.2

HIGH PHX-281 — Database User Password Hash Exposed

Remediation: Rotate all database user passwords immediately. Upgrade MySQL to use caching_sha2_password instead of mysql_native_password (MD5-based). For PostgreSQL, use scram-sha-256 in pg_hba.conf. Apply principle of least privilege to prevent non-admin users from reading the user/password tables.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A07:2021 – Identification and Authentication Failures

OWASP API: API2:2023 – Broken Authentication

MITRE ATT&CK: T1003.008 (Credential Access)

NIST 800-53: IA-5, SC-28

PCI DSS 4: 8.3.6, 3.5.1

MEDIUM PHX-282 — Anonymous Database Schema Browsing Permitted

Remediation: Restrict access to INFORMATION_SCHEMA to authenticated users only. Revoke SELECT on mysql.user, sys.*, and schema metadata tables from anonymous users. In PostgreSQL, restrict pg_catalog and information_schema access. Enable authentication before any schema metadata is exposed.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 – Security Misconfiguration

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1589 (Reconnaissance)

NIST 800-53: AC-3, CM-6

PCI DSS 4: 6.2.4