FortiGuard Labs disclosed Evooo1Bot, a Mirai-based Linux botnet active since July 2026 that hijacks routers and IoT devices for DDoS, credential theft, and SOCKS5 proxying.
Fortinet's FortiGuard Labs disclosed Evooo1Bot, a previously undocumented Linux botnet active since July 2026 that reuses Mirai's DDoS engine while adding encrypted C2, SSH brute-force scanning, credential sniffing, and SOCKS5 proxy modules. The bot exploits 18 known CVEs across Alcatel, NETGEAR, Tenda, D-Link, Telesquare, and Mitsubishi devices, some dating back to 2007, and communicates exclusively over port 443 to blend with HTTPS traffic. Compromised hosts can be turned into SOCKS5 relays for anonymous traffic forwarding or monetization via proxy services. The malware uses AES-256-CTR, ChaCha20, and XOR obfuscation with a 28-command administration interface.
Unauthenticated Command Injection in Tenda AC7, AC9, and AC10 Routers
CVE-2018-14558 is an unauthenticated OS command injection flaw (CWE-78) in the web interface of Tenda AC7, AC9, and AC10 routers, where the formsetUsbUnload handler passes untrusted input to the dosystemCmd function. An attacker triggers it by sending a crafted HTTP request to the goform/setUsbUnload endpoint, requiring no authentication or user interaction per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Successful exploitation yields arbitrary command execution on the router, enabling full device takeover for traffic interception, botnet enrollment, or pivoting into the local network. Anyone running AC7 firmware through V15.03.06.44_CN(AC7), AC9 firmware through V15.03.05.19(6318)_CN(AC9), or AC10 firmware through V15.03.06.23_CN(AC10) is affected. The flaw has a public proof of concept, an 8.7% EPSS (95th percentile), and was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03, indicating exploitation in the wild.
· Tenda AC7 router firmware through V15.03.06.44_CN(AC7) · Tenda AC9 router firmware through V15.03.05.19(6318)_CN(AC9) KEV PoC mass
Unauthenticated OS Command Injection in Tenda AC15 AC1900 Router
CVE-2020-10987 is an unauthenticated OS command injection flaw (CWE-78) in the goform/setUsbUnload endpoint of the Tenda AC15 AC1900 router, demonstrated on firmware version 15.03.05.19. An attacker triggers it by sending a crafted deviceName POST parameter to that endpoint, which is not properly sanitized before being used in a system command. Successful exploitation yields arbitrary remote code execution on the router, giving the attacker full control of the device and a foothold to pivot into the local network, as is typical for IoT botnet recruitment. Owners of Tenda AC15 routers are affected, with greatest risk on units whose web administration interface is reachable from the internet. Exploitation is confirmed in the wild: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), carries a 79.8% EPSS score (top percentile), and a public proof of concept has been available since its 2020 disclosure; ransomware use is unknown.
· Tenda AC15 AC1900 router firmware Firmware version 15.03.05.19 (the only version named in the advisory; the full affected version range is not specified, so other AC15 firmware releases may also KEV PoC moderate
Unauthenticated Buffer Overflow in D-Link GO-RT-AC750 Router Firmware
CVE-2022-37055 is a buffer overflow (CWE-120) in the cgibin binary's hnap_main handler on D-Link GO-RT-AC750 routers running GORTAC750_revA_v101b03 or GO-RT-AC750_revB_FWv200b02 firmware. Because the flaw sits in the router's HNAP/web management interface and requires no authentication, a remote attacker can trigger it with crafted network requests sent directly to the device. Successful exploitation can corrupt memory and is scored critical (CVSS 3.1: 9.8), giving the attacker potential full control of the router with high confidentiality, integrity, and availability impact. Owners of these specific GO-RT-AC750 (rev A and rev B) firmware releases are affected, and the broader context of active Mirai-family botnet campaigns targeting Linux-based edge devices raises the risk of automated mass exploitation. CISA added the vulnerability to the Known Exploited Vulnerabilities catalog on 2025-12-08, confirming exploitation in the wild, and its EPSS of 55.5% (99th percentile) indicates a high near-term probability of exploitation.
· D-Link GO-RT-AC750 (rev A) router firmware GORTAC750_revA_v101b03 · D-Link GO-RT-AC750 (rev B) router firmware GO-RT-AC750_revB_FWv200b02 KEV PoC large
Unauthenticated RCE via Command Injection in NETGEAR Multiple Routers
Multiple NETGEAR router models allow unauthenticated web pages to pass form input directly to the device's command-line interface, which permits remote code execution (CVE-2016-6277). An attacker triggers the flaw by sending a crafted HTTP request to the router's web interface without logging in, causing attacker-supplied input to be interpreted as commands on the router. Successful exploitation grants the ability to run arbitrary commands on the device, typically with root privileges, enabling full takeover of the router and use as a pivot point into the network behind it. Any NETGEAR router among the affected models running firmware without the vendor patch is vulnerable, with internet-facing management interfaces at greatest risk. The flaw was added to CISA's Known Exploited Vulnerability catalog on 2022-03-07, indicating exploitation in the wild, and it carries a very high 99.8% EPSS probability of exploitation within 30 days.
Command Injection RCE in Alcatel OmniPCX Enterprise masterCGI
CVE-2007-3010 is a command execution flaw in masterCGI, a component of the Unified Maintenance Tool in the Alcatel OmniPCX Enterprise Communication Server. Because the CGI fails to properly validate user-supplied input (CWE-20), a remote attacker can send crafted requests to the web-based maintenance interface and inject arbitrary operating system commands, which are executed on the PBX server. Successful exploitation yields remote code execution on the communication server, giving attackers a foothold on a Linux-based edge device that could be used for further compromise, lateral movement into the voice network, or, per recent botnet trends, conscription into proxy botnets. Any organization running an Alcatel OmniPCX Enterprise communication server with the Unified Maintenance Tool reachable is affected. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-04-15) with a very high 97.4% EPSS score, indicating active in-the-wild exploitation, though no public proof-of-concept code is known.
· Alcatel OmniPCX Enterprise Communication Server (Unified Maintenance Tool / masterCGI) KEVmoderate
An issue was discovered on Mitsubishi Electric Europe B.V.
An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. An unauthenticated remote OS Command Injection vulnerability allows an attacker to execute arbitrary commands on the RTU due to the passing of unsafe user supplied data to the RTU's system shell. Functionality in mobile.php provides users with the ability to ping sites or IP addresses via Mobile Connection Test. When the Mobile Connection Test is submitted, action.php is called to execute the test. An attacker can use a shell command separator (;) in the host variable to…
Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without any authentication.
Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without any authentication.
D-Link DIR-868L B1 router firmware version FW2.05WWB02 contains an unauthenticated OS command injection vulnerability in the fileaccess.cgi component.
D-Link DIR-868L B1 router firmware version FW2.05WWB02 contains an unauthenticated OS command injection vulnerability in the fileaccess.cgi component. The endpoint /dws/api/UploadFile accepts a pre_api_arg parameter that is passed directly to system-level shell execution functions without sanitization or authentication. Remote attackers can exploit this to execute arbitrary commands as root via crafted HTTP requests.
A vulnerability was determined in D-Link DIR-823X up to 250416.
A vulnerability was determined in D-Link DIR-823X up to 250416. Affected by this vulnerability is the function sub_415028 of the file /goform/set_static_leases. Executing manipulation of the argument Hostname can lead to command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.