ClingSTUN Malware Turns Unpatched IoT Devices Into Proxy Nodes
ClingSTUN exploits unpatched IoT flaws and uses public STUN servers to run proxy nodes.
76
CVE-2024-23625
- CVSS 3.1
- 9.8 critical
- EPSS
- 23%p98
- Published
- ·
- Modified
Description · NVD
A command injection vulnerability exists in D-Link DAP-1650 devices when handling UPnP SUBSCRIBE messages. An unauthenticated attacker can exploit this vulnerability to gain command execution on the device as root.
- Vendors
- dlink
- Products
- dap-1650 firmware
- Weakness
- CWE-77
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news
3 storiesClingSTUN Malware Turns Vulnerable IoT Devices Into Persistent Remote Proxy Nodes
ClingSTUN exploits unpatched IoT devices and turns them into persistent proxy nodes using public STUN.
68
ClingSTUN Backdoor Exploits Multiple IoT Vulnerabilities to Gain Persistent Remote Access
Fortinet documents ClingSTUN, a Linux IoT backdoor exploiting multiple vendor flaws to build persistent proxy nodes with STUN-based control.
60