Vendor

DCN

0 mentions in 7 days · 1 in 30 days · 1 total · first seen Aug 17, 2026 · last 29d ago

Timeline1 articles

Old Wine in the New Bottle: Mirai Variant Targets Multiple IoT Devices

Unit 42 analyzed the Mirai IZ1H9 botnet variant exploiting Tenda, LB-Link, DCN and Zyxel flaws to build DDoS-capable IoT botnets.

Unit 42 observed the Mirai IZ1H9 variant on April 10, 2023, using a shell script downloader lb.sh from 163.123.143.126 to infect exposed Linux servers and networking devices. Campaigns running since November 2021 share infrastructure, near-identical bot functions and the XOR key 0xBAADF00D. The malware exploits CVE-2023-27076 (Tenda G103), CVE-2023-26801 (LB-Link), CVE-2023-26802 (DCN DCBI-Netlog-LAB) and a Zyxel RCE flaw. Compromised devices join a botnet used for DDoS attacks, and the downloader deletes logs and modifies iptables to block SSH, Telnet and HTTP recovery.

Palo Alto Unit 42Aug 17, 13:04 UTC · 29d agoMalware in the wildCVE-2023-27076 CVE-2023-26801 CVE-2023-26802

Related CVEsby mentions

CVE-2023-270769.823%
Command injection vulnerability found in Tenda G103 v.1.0.0.5 allows attacker to execute arbitrary code via a the language parameter.
Command injection vulnerability found in Tenda G103 v.1.0.0.5 allows attacker to execute arbitrary code via a the language parameter.
· tenda g103 firmware PoC —
CVE-2023-268029.849%
An issue in the component /network_config/nsg_masq.cgi of DCN (Digital China Networks) DCBI-Netlog-LAB v1.0 allows attackers to bypass authentication and execut
An issue in the component /network_config/nsg_masq.cgi of DCN (Digital China Networks) DCBI-Netlog-LAB v1.0 allows attackers to bypass authentication and execute arbitrary commands via a crafted request.
· dcnglobal dcbi-netlog-lab firmware PoC —
CVE-2023-268019.870%
LB-LINK BL-AC1900_2.0 v1.0.1, LB-LINK BL-WR9000 v2.4.9, LB-LINK BL-X26 v1.2.5, and LB-LINK BL-LTE300 v1.0.8 were discovered to contain a command injection vulne
LB-LINK BL-AC1900_2.0 v1.0.1, LB-LINK BL-WR9000 v2.4.9, LB-LINK BL-X26 v1.2.5, and LB-LINK BL-LTE300 v1.0.8 were discovered to contain a command injection vulnerability via the mac, time1, and time2 parameters at /goform/set_LimitClient_cfg.
· lb-link bl-lte300 firmware · lb-link bl-x26 firmware PoC —

Appears with

threat actor IZ1H9 threat actor 1 malware IZ1H9 1 malware Mirai 1 organization Unit 42 1 product DCN DCBI-Netlog-LAB 1 product LB-Link 1 product Tenda G103 1 vendor LB-Link 1 vendor Palo Alto Networks 1 vendor Tenda 1 vendor Zyxel 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.