Realtek Jungle SDK Exploit Attempts Deliver Cling Botnet With STUN-Based C2
Attackers exploiting Realtek Jungle SDK flaws are deploying the Cling botnet, which hides C2 in STUN traffic.
74
CVE-2023-26801
- CVSS 3.1
- 9.8 critical
- EPSS
- 78%p100
- Published
- ·
- Modified
Description · NVD
LB-LINK BL-AC1900_2.0 v1.0.1, LB-LINK BL-WR9000 v2.4.9, LB-LINK BL-X26 v1.2.5, and LB-LINK BL-LTE300 v1.0.8 were discovered to contain a command injection vulnerability via the mac, time1, and time2 parameters at /goform/set_LimitClient_cfg.
- Vendors
- lb-link
- Products
- bl-lte300 firmware, bl-x26 firmware, bl-wr9000 firmware, bl-ac1900 firmware
- Weakness
- CWE-77
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news
8 storiesCling Botnet Spoofs Google STUN Traffic to Hide Commands Sent to Infected IoT Devices
Cling IoT botnet hides operator commands in spoofed Google STUN replies while exploiting exposed routers and DVRs.
71
Cling Malware Masquerades as Google STUN Traffic to Control Compromised IoT Devices
Cling botnet malware disguises its commands as Google STUN traffic on compromised IoT devices.
68
60
60
60
Mirai Botnet Variant Exploits Four-Faith Router Vulnerability for DDoS Attacks
60
Old Wine in the New Bottle: Mirai Variant Targets Multiple IoT Devices
Unit 42 analyzed the Mirai IZ1H9 botnet variant exploiting Tenda, LB-Link, DCN and Zyxel flaws to build DDoS-capable IoT botnets.
40