Linksys

Search everything

Mentions · 7d0
Mentions · 30d4
All mentions5
First seenAug 31, 2026
Last mentioned25d ago

Timeline

5 articles · newest first

Cling Botnet Spoofs Google STUN Traffic to Hide Commands Sent to Infected IoT Devices

Cling IoT botnet hides operator commands in spoofed Google STUN replies while exploiting exposed routers and DVRs.

GBHackersOct 6, 11:15 UTC · 25d agoMalwareExploitedCVE-2021-35394 CVE-2014-8361 CVE-2023-26801+56 · 3 reads

ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure

Fortinet reports ClingSTUN, a Linux IoT backdoor that hides operator traffic using public STUN servers.

Security Affairsupdated Oct 6, 11:49 UTC · 25d agofirst Oct 6, 06:31 UTC · 25d agoMalwareExploited3 sources1 · 1 read

Realtek Jungle SDK Exploit Attempts Deliver Cling Botnet With STUN-Based C2

Attackers exploiting Realtek Jungle SDK flaws are deploying the Cling botnet, which hides C2 in STUN traffic.

The Hacker NewsOct 5, 11:46 UTC · 26d agoMalwareExploitedCVE-2021-35394 CVE-2014-8361 CVE-2016-10372+510 · 2 reads

Cling Malware Masquerades as Google STUN Traffic to Control Compromised IoT Devices

Cling, a new IoT botnet, hides command-and-control in spoofed Google STUN traffic while exploiting Realtek CVE-2021-35394.

GBHackersOct 3, 07:48 UTC · 28d agoMalwareExploitedCVE-2021-3539410 · 3 reads

[webapps] Linksys E1200_2.0.04 - Unauthenticated OS Command Injection

A proof-of-concept for unauthenticated OS command injection in Linksys E1200 router firmware 2.0.04 has been published on Exploit-DB.

Exploit-DBAug 31, 00:00 UTC · Aug 31, 2026Exploit / PoC1

Related CVEs

by mentions

CVE-2021-35394100%9.8
Remote Code Execution via Memory Corruption in Realtek Jungle SDK
published Aug 16, 2021Realtek Jungle Software Development Kit (SDK)KEVPoC
CVE-2014-8361100%—
Improper Input Validation in Realtek SDK miniigd SOAP Service Enables Remote RCE
published —Realtek SDKKEV
CVE-2025-3403791%10.0
Unauthenticated OS Command Injection in Linksys E-Series Routers
published Jun 24, 2025Linksys E-Series routers (various models; vulnerable /tmUnblock.cgi and /hndUnblock.cgi CGI endpoints over HTTP on port 8080)
CVE-2016-2001686%9.8
MVPower CCTV DVR models, including TV-7104HE 1.8.4 115215B9 and TV7108HE, contain a web shell that is accessible via a /shell URI
published Oct 19, 2022mvpower tv-7104he firmwarePoC ×2
CVE-2023-2680178%9.8
LB-LINK BL-AC1900_2.0 v1.0.1, LB-LINK BL-WR9000 v2.4.9, LB-LINK BL-X26 v1.2.5, and LB-LINK BL-LTE300 v1.0.8 were discovered to contain a command injection…
published Mar 26, 2023lb-link bl-lte300 firmwarePoC
CVE-2023-410113%9.8
Command Execution vulnerability in China Mobile Communications China Mobile Intelligent Home Gateway v.HG6543C4 allows a remote attacker to execute arbitrary…
published Sep 14, 2023chinamobile intelligent home gateway firmwarePoC
CVE-2016-1037282%9.8
The Eir D1000 modem does not properly restrict the TR-064 protocol, which allows remote attackers to execute arbitrary commands via TCP port 7547, as…
published May 16, 2017eir d1000 modem firmwarePoC ×2
CVE-2024-372186%6.3
TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical: This issue affects some unknown processing of the file /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___. The manipulation of the…
published Apr 13, 2024

Appears with

Realtekvendor · 4
Clingmalware · 3
Realtek Jungle SDKproduct · 3
LB-LINKvendor · 3
FiberHomevendor · 3
Nozomi Networksorganization · 3
MVPowervendor · 2
University of Chicagoorganization · 2
University of Chicagovictim · 2
Eirvendor · 2
Exploit-DBorganization · 1
MVPower CCTV DVRproduct · 1
LB-LINK routersproduct · 1
ClingSTUNmalware · 1
FiberHome SR1041Fproduct · 1
Linksys E1200product · 1

Entities are extracted by the model from each article. First seen Aug 31, 2026, last mentioned 25d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.