Lumen says Volt Typhoon banks Silent Train access in infrastructure
Lumen says the group rotates exploited SOHO, IoT and enterprise devices, including multiple zero-days, against high-value targets.
78
Vendor
Netgear
- Mentions · 7d4
- Mentions · 30d5
- All mentions8
- First seenAug 13, 2026
- Last mentioned1d ago
Timeline
8 articles · newest firstNETGEAR RAX120 V1.2.5.18 SOAP InstallApp command injection disclosed
An authenticated request can reach OS command execution in the router's root-configured web stack.
44
Volt Typhoon uses Silent Train relays for zero-day edge attacks
Black Lotus Labs says four confirmed zero-days hit VeloCloud, Cisco SD-WAN, N-central, and Versa Director.
86
Volt Typhoon rebuilt Silent Train relay chains since late 2023
Black Lotus Labs says chains were rebuilt in under two minutes and hundreds of victims were notified.
84
16-year-old Broadcom WPS flaw can give nearby attackers router control
Researcher demos stole a Wi-Fi password and opened a shell without the network key; tested Belgian gateways were still unpatched.
73
New Mirai Variant Targeting Network Security Devices
New Mirai botnet variant exploits nine vulnerabilities in SonicWall, D-Link, Netgear, and other devices, with attacks ongoing at publication.
75
IoT Under Siege: The Anatomy of the Latest Mirai Campaign Leveraging Multiple IoT Exploits
Unit 42 tracks a Mirai botnet campaign exploiting over 20 IoT vulnerabilities in routers, cameras and DVRs to build DDoS botnets since March 2023.
42
New Mirai variant adds stealth capabilities to notorious botnet code
FortiGuard Labs reports new Mirai-derived botnet Evooo1Bot actively exploits unpatched routers and edge devices, adding encrypted C2, stealthy SSH scanning, and proxying.
60
Related CVEs
by mentions- CVE-2022-2930398%9.8Unauthenticated Command Injection in Contec SolarView Compact
- CVE-2021-2250297%9.8Unauthenticated Command Injection RCE in Micro Focus Operation Bridge Reporter
- CVE-2025-88764%9.4OS Command Injection in N-able N-central Before 2025.3.1
- CVE-2019-1935628%7.5Command Injection RCE as Root in Netis WF2419 Routers
- CVE-2024-397174%7.2Unrestricted File Upload in Versa Networks Versa Director Exploited by Volt Typhoon
- CVE-2021-275623%5.5Out-of-Bounds Write in Arm Trusted Firmware-M Through 1.2
- CVE-2022-4569977%9.8Command injection in the administration interface in APSystems ECU-R version 5203 allows a remote unauthenticated attacker to execute arbitrary commands as…
- CVE-2022-3149965%9.8Nortek Linear eMerge E3-Series devices before 0.32-08f allow an unauthenticated attacker to inject OS commands via ReaderNo
- CVE-2022-270025%9.8Arris TR3300 v1.0.13 were discovered to contain a command injection vulnerability in the ddns function via the ddns_name, ddns_pwd, h_ddns、ddns_host parameters
- CVE-2022-3002339%8.8Tenda ONT GPON AC1200 Dual band WiFi HG9 v1.0.1 is vulnerable to Command Injection via the Ping function
Appears with
- D-Linkvendor · 3
- Black Lotus Labsorganization · 3
- Miraimalware · 3
- Volt Typhoonthreat actor · 3
- Intelbrasvendor · 3
- Ciscovendor · 2
- Versa Directorproduct · 2
- TP-Linkvendor · 2
- Unit 42organization · 2
- Tendavendor · 2
- FBIorganization · 2
- Lumenorganization · 2
- Cisco Catalyst SD-WANproduct · 2
- VeloCloud Orchestratorproduct · 2
- Netgear Orbiproduct · 2
- Silent Trainmalware · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.