LB-LINK

Search everything

Mentions · 7d0
Mentions · 30d3
All mentions4
First seenAug 17, 2026
Last mentioned24d ago

Timeline

4 articles · newest first

Cling Botnet Spoofs Google STUN Traffic to Hide Commands Sent to Infected IoT Devices

Cling IoT botnet hides operator commands in spoofed Google STUN replies while exploiting exposed routers and DVRs.

GBHackersOct 6, 11:15 UTC · 24d agoMalwareExploitedCVE-2021-35394 CVE-2014-8361 CVE-2023-26801+56 · 3 reads

Realtek Jungle SDK Exploit Attempts Deliver Cling Botnet With STUN-Based C2

Attackers exploiting Realtek Jungle SDK flaws are deploying the Cling botnet, which hides C2 in STUN traffic.

The Hacker NewsOct 5, 11:46 UTC · 25d agoMalwareExploitedCVE-2021-35394 CVE-2014-8361 CVE-2016-10372+510 · 2 reads

Cling Malware Masquerades as Google STUN Traffic to Control Compromised IoT Devices

Cling, a new IoT botnet, hides command-and-control in spoofed Google STUN traffic while exploiting Realtek CVE-2021-35394.

GBHackersOct 3, 07:48 UTC · 27d agoMalwareExploitedCVE-2021-3539410 · 3 reads

Old Wine in the New Bottle: Mirai Variant Targets Multiple IoT Devices

Unit 42 analyzed the Mirai IZ1H9 botnet variant exploiting Tenda, LB-Link, DCN and Zyxel flaws to build DDoS-capable IoT botnets.

Palo Alto Unit 42Aug 17, 13:04 UTC · Aug 17, 2026MalwareExploitedCVE-2023-27076 CVE-2023-26801 CVE-2023-268024 · 1 read

Related CVEs

by mentions

CVE-2021-35394100%9.8
Remote Code Execution via Memory Corruption in Realtek Jungle SDK
published Aug 16, 2021Realtek Jungle Software Development Kit (SDK)KEVPoC
CVE-2023-2680178%9.8
LB-LINK BL-AC1900_2.0 v1.0.1, LB-LINK BL-WR9000 v2.4.9, LB-LINK BL-X26 v1.2.5, and LB-LINK BL-LTE300 v1.0.8 were discovered to contain a command injection…
published Mar 26, 2023lb-link bl-lte300 firmwarePoC
CVE-2014-8361100%—
Improper Input Validation in Realtek SDK miniigd SOAP Service Enables Remote RCE
published —Realtek SDKKEV
CVE-2025-3403791%10.0
Unauthenticated OS Command Injection in Linksys E-Series Routers
published Jun 24, 2025Linksys E-Series routers (various models; vulnerable /tmUnblock.cgi and /hndUnblock.cgi CGI endpoints over HTTP on port 8080)
CVE-2016-2001686%9.8
MVPower CCTV DVR models, including TV-7104HE 1.8.4 115215B9 and TV7108HE, contain a web shell that is accessible via a /shell URI
published Oct 19, 2022mvpower tv-7104he firmwarePoC ×2
CVE-2023-410113%9.8
Command Execution vulnerability in China Mobile Communications China Mobile Intelligent Home Gateway v.HG6543C4 allows a remote attacker to execute arbitrary…
published Sep 14, 2023chinamobile intelligent home gateway firmwarePoC
CVE-2016-1037282%9.8
The Eir D1000 modem does not properly restrict the TR-064 protocol, which allows remote attackers to execute arbitrary commands via TCP port 7547, as…
published May 16, 2017eir d1000 modem firmwarePoC ×2
CVE-2024-372186%6.3
TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical: This issue affects some unknown processing of the file /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___. The manipulation of the…
published Apr 13, 2024
CVE-2023-2680249%9.8
An issue in the component /network_config/nsg_masq.cgi of DCN (Digital China Networks) DCBI-Netlog-LAB v1.0 allows attackers to bypass authentication and…
published Mar 26, 2023dcnglobal dcbi-netlog-lab firmwarePoC
CVE-2023-2707623%9.8
Command injection vulnerability found in Tenda G103 v.1.0.0.5 allows attacker to execute arbitrary code via a the language parameter
published Apr 10, 2023tenda g103 firmwarePoC

Appears with

Nozomi Networksorganization · 3
Realtek Jungle SDKproduct · 3
Realtekvendor · 3
Clingmalware · 3
Linksysvendor · 3
FiberHomevendor · 3
University of Chicagoorganization · 2
Eirvendor · 2
University of Chicagovictim · 2
MVPowervendor · 2
TBK DVRproduct · 1
China Mobile HG6543C4product · 1
Miraimalware · 1
DCNvendor · 1
Googleorganization · 1
LB-LINK routersproduct · 1

Entities are extracted by the model from each article. First seen Aug 17, 2026, last mentioned 24d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.