159 CVEs Exploited in Q1 2025: Threat Analysis, IT Act Liabilities, and Legal Recourse in India

Recent global threat intelligence reveals a alarming reality for cybersecurity professionals and corporate leadership alike: during the first quarter of 2025, 159 Common Vulnerabilities and Exposures (CVEs) were actively exploited in the wild. More critically, 28.3% of these vulnerabilities were weaponized and targeted by threat actors within just 24 hours of public disclosure.

The shrinking window between vulnerability disclosure and automated exploitation—often referred to as the "zero-day to n-day compression"—leaves virtually no margin for delayed patching cycles. For businesses operating across India, and particularly commercial hubs like Mumbai, Thane, and Navi Mumbai, unpatched infrastructure is no longer merely an IT operational oversight. It represents an acute operational risk that triggers direct liabilities under Indian statutory law.

This article examines the legal and regulatory implications of rapid vulnerability exploitation, the compliance mandates governing corporate digital systems, and the actionable recourse available to affected organizations and individuals.

---

Understanding the Threat: The 24-Hour Weaponization Window

When a software vulnerability is assigned a CVE identifier and published alongside proof-of-concept (PoC) code or vulnerability advisories, malicious threat actors immediately integrate automated vulnerability scanners to target vulnerable web applications, virtual private network (VPN) gateways, and public-facing network perimeter devices.

In Q1 2025, the data underscores three significant shifts:

1. Automated Reconnaissance: Malicious actors use automated bots to scan global IP ranges within hours of a CVE disclosure.
2. Ransomware Pre-Positioning: Exploit kits rapidly pivot from initial access to privilege escalation and data exfiltration, demanding ransoms before security patches can be tested and deployed.
3. Supply Chain Exposure: Third-party APIs and open-source enterprise components are heavily targeted, turning an unpatched sub-dependency into a corporate gateway.

---

Indian Legal Framework: Corporate Liability and Negligence

When an enterprise in India falls victim to a breach facilitated by an unpatched, publicly disclosed vulnerability, management cannot simply claim victimhood. The legal framework examines whether the organization maintained reasonable security practices.

1. Section 43A and Section 43 of the Information Technology Act, 2000

Under Section 43A of the IT Act, any body corporate possessing, dealing, or handling Sensitive Personal Data or Information (SPDI) in a computer resource that fails to implement and maintain "reasonable security practices and procedures" (RSPPs), thereby causing wrongful loss or wrongful gain, is liable to pay compensation to the affected parties.

If a CVE was publicly disclosed, an advisory issued, and an enterprise failed to apply remediations or mitigation controls within an industry-standard timeframe, such omission can substantiate a claim of gross negligence under civil proceedings before the Adjudicating Officer appointed under Section 46 of the IT Act.

2. Mandatory CERT-In 6-Hour Reporting Window

Under the Cyber Security Directions issued by the Indian Computer Emergency Response Team (CERT-In) under Section 70B(6) of the IT Act, organizations are legally mandated to report specified cybersecurity incidents to CERT-In within six hours of noticing or being brought to notice of the incident. These reportable incidents include:

• Unauthorized access to IT systems/data;
• Targeted scanning/probing of critical networks;
• Compromise of critical systems or information;
• Ransomware attacks and data breaches.

Failure to comply with CERT-In directives attracts penal provisions under Section 70B(7), including imprisonment up to one year, a monetary fine up to ₹1,00,000, or both.

3. Digital Personal Data Protection Act (DPDP Act), 2023

Under the DPDP Act, "Data Fiduciaries" are statutorily obligated to implement reasonable security safeguards to prevent personal data breaches. If an exploited CVE results in the compromise of personal data, the Data Protection Board of India holds the power to impose substantial monetary penalties—often reaching up to ₹250 crore—specifically for failure to take reasonable security safeguards to prevent a breach.

---

Criminal Recourse Under the Bharatiya Nyaya Sanhita (BNS) & IT Act

When an unauthorized breach occurs, the perpetrators are liable under both cyber-specific statutes and India's general criminal code:

• Section 66 of the IT Act: Penalizes hacking, unauthorized access, and system disruption with imprisonment up to three years or fines up to ₹5,00,000.
• Section 66C and 66D: Covers identity theft and cheating by personation through computer resources.
• Section 308 of Bharatiya Nyaya Sanhita (BNS), 2023 (Extortion): Ransomware operators who encrypt critical databases and demand payment commit extortion under the BNS.
• Section 318 of BNS, 2023 (Cheating): Applied where threat actors manipulate financial systems or commit wire fraud subsequent to initial perimeter breach.
• Section 303 of BNS, 2023 (Theft): Pertains to unauthorized appropriation of digital assets and corporate trade secrets.

---

Evidence Preservation Under the Bharatiya Sakshya Adhiniyam (BSA), 2023

For any criminal complaint or civil recovery action to succeed in an Indian court, electronic evidence must be preserved strictly in accordance with the law. The Bharatiya Sakshya Adhiniyam, 2023 (BSA) governs the admissibility of electronic records under Section 63 (which replaces the erstwhile Section 65B of the Indian Evidence Act).

Victim organizations must:

• Preserve forensic disk images, firewall logs, NetFlow records, and SIEM alerts.
• Maintain a strict chain of custody for all physical and digital media.
• Prepare the requisite Section 63 BSA certificate signed by the person in lawful charge of the computer resource or an authorized expert at the time the evidence is produced.

---

How Victims in Mumbai, Thane, and Mira Road Can Report Incidents

If your enterprise or personal device experiences an intrusion or ransomware deployment resulting from an exploited vulnerability, prompt local and statutory reporting is critical:

1. Centralized Online Portal

• Lodge an initial report on the National Cyber Crime Reporting Portal at cybercrime.gov.in or call the national cyber helpline at 1930 immediately to freeze suspicious banking transactions if funds have been siphoned.

2. Specialized Cyber Crime Police Stations

For formal First Information Reports (FIRs) and corporate-level investigation, complaints can be lodged directly with dedicated zonal cyber stations:

• Mumbai: The Cyber Police Station, Bandra-Kurla Complex (BKC), or regional cyber cells across South, Central, East, West, and North Mumbai jurisdictions.
• Thane: Thane Cyber Police Station located at Commissioner of Police Office premises, Thane West.
• Mira Road & Bhayandar: The Cyber Crime Cell of the Mira-Bhayandar, Vasai-Virar (MBVV) Police Commissionerate.

When approaching the police, submit a detailed written complaint containing a timeline of the breach, affected IP addresses, log extracts, suspected CVE details, and the Section 63 BSA evidentiary certificate.

---

Frequently Asked Questions (FAQs)

1. Does our organization need to disclose every unpatched vulnerability to the police?

No. Mere identification of an unpatched CVE on your internal network is a security and maintenance issue, not a crime. However, if an external actor exploits that vulnerability to gain unauthorized access, alter data, or deploy ransomware, it constitutes a criminal offense under Section 66 of the IT Act and mandates reporting to CERT-In.

2. Can our company be sued by clients if customer data leaks via a zero-day exploit?

Yes. Under Section 43A of the IT Act and provisions of the DPDP Act, affected data subjects or clients can claim damages or file complaints before regulatory adjudicators. The core legal defense depends on proving that the organization adhered to reasonable security standards, updated patches within accepted industry norms, and maintained active incident response controls.

3. What is the deadline for reporting a ransomware attack to CERT-In?

Under the CERT-In Directions of April 2022, corporate entities, service providers, and intermediaries are required to report ransomware attacks and unauthorized access incidents to CERT-In within six hours of detection.

4. What is the first legal step following an enterprise intrusion?

Immediately trigger your Incident Response Plan under attorney-client privilege where feasible. Isolate the affected systems, secure system logs before they roll over, document the breach timeline for CERT-In reporting, and contact cyber counsel to draft both statutory notifications and criminal complaints.

---

Legal Support from APS Law

Navigating the legal fallout of a cyber attack requires seamless coordination between technical forensic realities and statutory compliance. APS Law assists corporate clients, startups, and individuals across Mumbai, Thane, and Mira Road with cyber incident response, regulatory compliance under the IT Act and DPDP Act, CERT-In compliance filings, and formal criminal litigation.

If your organization has suffered an intrusion or requires a comprehensive review of its legal data protection safeguards, contact APS Law today to schedule a consultation.