Tenable: Vulnerability disclosures skyrocketed over last 5 years

Over the last five years, there has been a 183% increase in the number of disclosed vulnerabilities, according to new research by Tenable.

The "2020 Threat Landscape Retrospective," released Thursday, provided an overview of key vulnerabilities disclosed or exploited throughout 2020, as well as trends that impacted the year including breaches and ransomware attacks. The report was compiled by three members of Tenable's security response team -- Scott Caveza, research engineering manager, Satnam Narang, staff research engineer, and Rody Quinlan, research engineer -- and includes data and disclosures through December 31, 2020.

The researchers discovered concerning data regarding CVEs, both in sheer numbers and a lack of patching. In total, 18,358 new CVEs were assigned in 2020. According to the report, from 2015 to 2020, the number of reported CVEs increased at an annual percentage growth rate of 36.6%.

"The 18,358 CVEs reported in 2020 represent a 6% increase over the 17,305 reported in 2019 and a 183% increase over the 6,487 disclosed in 2015," the report said. "The fact that for the last three years, we have seen over 16,000 CVEs reported annually reflects a new normal for vulnerability disclosure."

Unpatched vulnerabilities are a far bigger problem than zero-days, according to the report. "This low-hanging fruit is favored by nation-state actors and run-of-the-mill cybercriminals alike. While zero-day vulnerabilities are often leveraged as part of targeted attacks, unpatched vulnerabilities are targeted en masse, posing a much greater threat," the researchers wrote in the report.

Narang told SearchSecurity that threat actors find value in taking existing proof-of-concept (PoC) codes for disclosed vulnerabilities and folding them into their attacks, rather than trying to discover and develop zero-day vulnerabilities.

"That is one reason the government alerts talk about how zero-days are great and valuable for attackers, but the cost associated with developing a zero-day and spending the time and energy to develop it yourself, or purchasing one, is prohibitive when you have all these unpatched systems out there with public PoCs. It's like a no-brainer," he said.

The availability of a public PoC is an important factor when it comes to the decision to patch and the urgency, although many security teams rely solely on the common vulnerability scoring system (CVSS). The system is scored one to 10, with 10 being the most critical. CVEs are assigned a CVSS score, as well as a name and logo. However, according to the report, some severe though nameless vulnerabilities get overshadowed by the high-profile ones.

"'Headline' vulnerabilities tend to be the ones that attract the most attention from the media and business leaders, putting pressure on security professionals to respond even if the threat to the business is low," the report said. "Our review of high-profile vulnerabilities in 2020 reveals that not every critical vulnerability had a name and logo given to it. Conversely, not every vulnerability with a name and logo should be seen as critical."

While the CVSS helps in certain cases, providing context and an easy way to reference vulnerabilities, said Narang, it's also important to look past the logo and name and get into the details.

"Any time you see a CVSS 10, that's a pretty sure-fire way to know, 'I need to drop what I'm doing and take care of this as soon as possible,'" he said. "But not every headline or noteworthy vulnerability is going to require the same amount of attention. One example we point to is the 'Boothole'. That was a vulnerability that got a logo and a name, and it affects Linux and Windows devices, bypasses secure boot. It's an interesting vulnerability, but in the grand scheme of things, it's probably not the most severe thing you need to panic and worry about."

Meanwhile, there are critical vulnerabilities that received less attention. For example, Narang pointed to Oracle Web Logic vulnerabilities that often get published quarterly as part of Oracle's critical patch update. "Those ones do get exploited in the wild, sometimes as zero-days, sometimes after researchers have published PoC. Those don't have names, but those are actually pretty severe, too."