Jared's Technology Podcast Network · Jared Rimer

We have more maximum severity bugs in the newsletter of Sans for Dec 19, 2025

December 24, 2025·1 hr 47 min·5 clips

Fortinet's two CVE-2025 flaws let attackers bypass SSO with crafted SAML messages.

1. Jared's Technology Podcast Network episode 33 covers the SANS News Bytes newsletter dated December 19, 2025. 2. Jared Reimer hosts and reads the security update, while SANS News Bytes and the named vendors matter because the episode is built around their advisories. 3. The episode exists to push listeners toward urgent patching before Christmas and New Year deadlines. 4. Cisco AsyncOS opens Top of the News with a CVSS 10.0 zero-day in Cisco Secure Email Gateway and Cisco Secure Email and Web Manager. 5. CISA added CVE-2025-20393 to the Known Exploited Vulnerabilities Catalog after Cisco discovered attacks on December 10, 2025. 6. The host says the flaw affects systems with spam quarantine exposed to the Internet and repeats Cisco hardening steps like firewall restriction, HTTP disablement, and SAML or LDAP authentication. 7. SonicWall follows with CVE-2025-40602, a medium-severity local privilege escalation issue in SMA 100 series appliances. 8. CISA set a December 24, 2025 mitigation deadline for the SonicWall issue, and the host notes it was reportedly used with CVE-2025-23006 from January 2025. 9. Fortinet comes next with CVE-2025-59718 and CVE-2025-59719, both improper verification of cryptographic signature flaws. 10. The Fortinet segment says crafted SAML messages could bypass 40-cloud SSO login and that Arctic Wolf observed malicious SSO logins on FortiGate appliances starting December 12, 2025. 11. HPE OneView then gets a CVSS 10.0 bulletin for CVE-2025-37164, which HPE says allows remote unauthenticated code execution. 12. The host stresses that version 11.00 is not affected, while 5.20 through 10.20 require the provided hotfix and, for some systems, a Synergy Composer 2 reimage path. 13. ASUS Live Update is added to KEV because certain distributed versions carried unauthorized modifications from a supply-chain compromise. 14. The ASUS item says the client reached end of life earlier in December 2025 and that the mitigation deadline is January 7, 2026. 15. A Mediterranean ferry case shifts the episode from software bugs to a suspected remote access Trojan on the passenger ferry Fantastic docked at Sète in southern France. 16. The host says French police arrested two crew members, one Bulgarian crew member was released without charge, and one Latvian crew member remained in custody. 17. The tone stays conversational, cautionary, and commentary-driven, with Jared pausing to translate technical terms and give deadline-focused advice. 18. The format mixes headline reading, vendor details, and his own reactions, including repeated reminders to patch and check the newsletter after holiday travel. 19. People running Cisco, SonicWall, Fortinet, HPE, or ASUS gear would get the most value from this episode. 20. Listeners wanting narrative resolution or a light tech roundup may skip it.

As heard by us

A plainspoken patch-now bulletin with practical steps for admins.

This episode turns a severe HPE OneView advisory into something an admin can use right away. It says the flaw is rated CVSS 10, explains that a remote, unauthenticated attacker could reach remote code execution, and lays out the hotfix path for OneView versions 5.20 through…

Read the full review in PlayNext →

Why you'd press play

When a CVSS 10 lands, you want the patch path fast and plain.

Read the full recommendation in PlayNext →

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from Jared's Technology Podcast Network