Kubernetes maintainers have published an advisory detailing multiple critical vulnerabilities in Ingress-NGINX Controller that could allow unauthenticated remote code execution and full cluster takeover.

The Department of Information and Communications Technology (DICT) through the National Cyber Security Center (NCSC) issues this advisory to alert all PNG Government departments, agencies, and organizations about critical vulnerabilities discovered in Ingress-NGINX Controller for Kubernetes.   

Background

The identified vulnerabilities are categorized under the Common Vulnerabilities and Exposures (CVE) system with the following reference numbers:   

– CVE-2025-1097   

– CVE-2025-1098  

– CVE-2025-1974   

– CVE-2025-24513   

– CVE-2025-24514 

If successfully exploited, these vulnerabilities could allow attackers to execute arbitrary code, access all cluster secrets across namespaces, and potentially lead to complete cluster takeover.  These vulnerabilities pose significant risks as they could compromise the confidentiality, integrity, and availability of affected systems.  

Affected Versions or applications  

Mitigation

To safeguard your organization’s systems and data, DICT and NCSC strongly recommend taking the following actions:   

1. Review Systems: Conduct a comprehensive review of your Kubernetes clusters to identify any instances of Ingress-NGINX Controller running vulnerable versions.   

2. Upgrade affected versions of NGINX Controller 

3. Secure Admission Webhook: Ensure the admission webhook endpoint is not exposed externally to prevent unauthorized access.   

For detailed instructions and additional guidance, refer to the official Kubernetes maintainer’s advisory through the following link: 

Kubernetes – Ingress-NGINX Releases –  

For further information about these vulnerabilities, visit:   

Remote Code Execution Vulnerabilities in Ingress NGINX | Wiz Blog  

Prompt action is crucial to mitigate these critical vulnerabilities and ensure the security of your Kubernetes clusters. By remaining vigilant and keeping your systems up-to-date, you can effectively protect against potential cyber threats.   

For more alerts and advisories, visit the DICT website or follow our official communications channels. Organizations or individuals requiring assistance or further information can contact the National Cyber Security Center (NCSC).  Together, let us prioritize cybersecurity and protect Papua New Guinea’s digital landscape. 

The strategy aligns with the National Cyber Security Policy 2021, reinforcing the government’s commitment to building a resilient and secure digital environment.

 He said  cybersecurity is essential in today’s interconnected digital world to ensure the safety and resilience of individuals, organizations, and nations against malicious cyber activities.

The Minister underlined the importance of protecting sensitive information, systems, and networks, Highlighting the vulnerability of systems in an increasingly digital world.

“As the world transcends into the digital space, the system is vulnerable to cybersecurity threats. Cybersecurity plays a vital role in ensuring safety, especially to safeguard sensitive information, systems, and networks from malicious attacks, unauthorized access, and data breaches.”

The NCS strategy includes the establishment of the National Cyber Security Coordination Centre (N3C), which will strengthen PNG’s technical and intelligence capabilities in line with international standards and best practices. The N3C will play a critical role in defending against cyber threats, protecting critical infrastructure and assets, and ensuring national security.

Minister Masiu also called for collective action from all stakeholders to foster a secure digital environment. “This policy underscores the Marape-Rosso Government’s commitment to fostering a secure digital environment, enabling trust in digital transformation, enhancing national security, and supporting economic growth. It calls on ALL stakeholders to collaborate in building robust cyber defenses and promoting a culture of cybersecurity awareness across the nation.”

To drive the implementation forward, the ICT Minister confirmed his directives to the National Information and Communications Technology Authority (NICTA) to work closely with the Department of ICT.

“I have notified the National Information and Communications Technology Authority to work with the Department to commence the implementation of the National Cyber Security Policy and the subsequent strategy.”

Minister Masiu reaffirms the government’s dedication to safeguarding the prosperity of its citizens and protecting national security.

 “Protecting Papua New Guinea’s national security and promoting the prosperity of PNG citizens are Marape-Rosso Government top priorities, and ensuring the security of cyberspace is fundamental to both endeavours.”

A delegation led by Secretary for the Department of Information and Communications Technology, Mr. Steven Matainaho, attended the 31st Plenary Meeting of the Cybercrime Convention Committee (T-CY) held in Strasbourg, France, from December 10-12, 2024. This marked PNG’s first participation as an observer in the committee.

The delegation also included key representatives: Chief Censor Jim Abani, John Laule from the Department of Justice and Attorney General, Benjamin Howard from PNG Immigration & Citizen Services Authority, and Oala Moi from the National Information and Communications Technology Authority (NICTA).

Delivering a statement on December 11, Secretary Matainaho emphasized PNG’s progress toward accession and underscored the importance of the Budapest Convention in combating cybercrime. He expressed PNG’s gratitude to the Council of Europe for the opportunity to join global efforts to address cyber threats.

Recapping on the cyber issues faced by the country this year Secretary Matainaho gave an overview of the “Black Wednesday” incident. “On January 10 this year, Papua New Guinea experienced social unrest that was exacerbated by misinformation and disinformation on social media. The Papua New Guinea National Executive Council promptly issued the following direction that immediate and necessary steps be taken to ensure Papua New Guinea’s ratification and signing of a cybercrime convention for domestic enforcement.”

Mr. Matainaho highlighted PNG’s swift steps towards accession. “On January 30 this year, the State Solicitor of Papua New Guinea issued legal clearance for PNG to accede to the Budapest Convention on Cybercrime. In June this year, Papua New Guinea wrote to the Council of Europe conveying our request to be invited to accede to the Budapest Convention. The invitation was announced on 9 October this year, along with Malawi and Kenya.”

He reaffirmed the significance of the Convention in enhancing PNG’s cyber resilience. “The Budapest Convention is a pioneering framework for international cooperation in the fight against cybercrime. By acceding to this Convention, we are confident that this process will empower Papua New Guinea to strengthen our legal frameworks and capacity.”

Mr. Matainaho further noted PNG’s readiness to align its domestic legislation with international standards.

“Based on the expert insights provided by the Council of Europe in 2019, we remain committed to refining the Cybercrime Code Act 2016 and the Mutual Assistance in Criminal Matters Act 2005 to facilitate international cooperation for electronic evidence.

“Accession to and ratification of the Budapest Convention and its Protocols will also lead to a wholesale review of other related legislation so that Papua New Guinea is on par to implement the Budapest Convention at the domestic level.”

The Secretary concluded by outlining PNG’s next steps. “When we return home this weekend, we will commence the domestic procedure for ratification. We look forward to depositing Papua New Guinea’s instrument of accession.

“The Council of Europe has our sincere appreciation for inviting Papua New Guinea. We are excited about the possibilities that lie ahead in the pursuit of a safer digital future.”

Fortinet identified a critical vulnerability affecting FortiOS and FortiProxy products. This vulnerability poses a significant risk as it could compromise the confidentiality, integrity, or availability of affected systems.

The Department of Information and Communications Technology (DICT) through the National Cyber Security Center (NCSC) issues this advisory to alert all PNG Government departments, agencies, and organizations about a critical vulnerability discovered in FortOS and FortiProxy products. This alert is intended to be understood by technical users. 

Background

Fortinet, a prominent provider of security solutions like firewalls, endpoint security and intrusion detection systems, has identified a critical vulnerability affecting FortiOS and FortiProxy. The identified vulnerability is categorized under the Common Vulnerabilities and Exposures (CVE) system with the following reference number: CVE-2024-55591. The vulnerability may allow an unauthenticated remote attacker to gain “super-admin” privileges. 

Fortinet has already identified active exploits of this critical vulnerability, and have observed the following post exploitation activities: 

1. Creating an admin account on the device with a random username. 

1. Creating a Local User account on the device using a random name. 

2. Creating a user group or adding the above local user to an existing sslvpn user group 

3. Adding/changing other settings (firewall policy, etc) 

4. Logging in the sslvpn with the above added local users to get a tunnel to the internal network. 

Affected versions or applications: 

Mitigation

To safeguard your organization’s systems and data, DICT and NCSC strongly recommend taking the following actions: 

1. Follow Fortinet’s published advice for affected versions. 

2. Upgrade affected versions of FortiOS and FortiProxy versions. 

3. Monitor and investigate for suspicious activity in connected environments. 

For more detailed information and specific instructions regarding the vulnerability and updates, we encourage you to refer to Fortinet’s published advice through the following link: Authentication bypass in Node.js websocket module. 

Prompt action is crucial in addressing these critical vulnerabilities to ensure the security and stability of your organization’s systems and data. By remaining vigilant and keeping your infrastructure up-to-date, you can effectively safeguard against potential cyber threats. The NCSC and the Department of ICT are dedicated to promoting a secure digital environment, and we encourage all stakeholders to adhere to the recommended actions for enhanced cybersecurity resilience. 

For any further assistance or inquiries, please reach out to the National Cyber Security Center (NCSC). Together, let us prioritize cybersecurity and protect Papua New Guinea’s digital landscape.