Tenda

Search everything

Mentions · 7d0
Mentions · 30d1
All mentions5
First seenAug 13, 2026
Last mentioned24d ago

Timeline

5 articles · newest first

ClingSTUN Malware Turns Vulnerable IoT Devices Into Persistent Remote Proxy Nodes

ClingSTUN exploits unpatched IoT devices and turns them into persistent proxy nodes using public STUN.

GBHackersOct 6, 05:03 UTC · 24d agoMalwareExploitedCVE-2022-36553 CVE-2023-1389 CVE-2024-23625+12 · 2 reads

Old Wine in the New Bottle: Mirai Variant Targets Multiple IoT Devices

Unit 42 analyzed the Mirai IZ1H9 botnet variant exploiting Tenda, LB-Link, DCN and Zyxel flaws to build DDoS-capable IoT botnets.

Palo Alto Unit 42Aug 17, 13:04 UTC · Aug 17, 2026MalwareExploitedCVE-2023-27076 CVE-2023-26801 CVE-2023-268024 · 1 read

IoT Under Siege: The Anatomy of the Latest Mirai Campaign Leveraging Multiple IoT Exploits

Unit 42 tracks a Mirai botnet campaign exploiting over 20 IoT vulnerabilities in routers, cameras and DVRs to build DDoS botnets since March 2023.

Palo Alto Unit 42Aug 17, 13:04 UTC · Aug 17, 2026MalwareExploitedCVE-2019-12725 CVE-2019-17621 CVE-2019-20500+133 · 1 read

Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies

Fortinet researchers documented Evooo1Bot, a new Mirai-derived Linux botnet active since July 2026 that exploits known edge-device flaws to build SOCKS5 proxy networks.

The Hacker NewsAug 17, 09:29 UTC · Aug 17, 2026MalwareExploitedCVE-2007-3010 CVE-2016-6277 CVE-2018-14558+151 · 1 read

New Mirai variant adds stealth capabilities to notorious botnet code

FortiGuard Labs reports new Mirai-derived botnet Evooo1Bot actively exploits unpatched routers and edge devices, adding encrypted C2, stealthy SSH scanning, and proxying.

The RecordAug 13, 15:57 UTC · Aug 13, 2026MalwareExploited2 · 1 read

Related CVEs

by mentions

CVE-2023-1389100%8.8
Command Injection in TP-Link Archer AX21 Router Allows Remote Code Execution
published Mar 15, 2023TP-Link Archer AX21 (Archer AX-21) Wi-Fi 6 routerKEVPoC ×2
CVE-2022-30525100%9.8
OS Command Injection in Zyxel Firewalls Enables Remote Command Execution
published May 12, 2022ZyxelKEVPoC ×3
CVE-2021-4642294%9.8
Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without any authentication
published Apr 27, 2022telesquare sdt-cs3b1 firmwarePoC ×2
CVE-2022-29464100%9.8
Unrestricted file upload leading to unauthenticated RCE in multiple WSO2 products
published Apr 18, 2022WSO2KEVRansomwarePoC ×2
CVE-2022-26134100%9.8
Unauthenticated OGNL Injection RCE in Atlassian Confluence Server/Data Center
published Jun 3, 2022Atlassian Confluence ServerKEVRansomwarePoC ×2
CVE-2007-301097%—
Command Injection RCE in Alcatel OmniPCX Enterprise masterCGI
published —Alcatel OmniPCX Enterprise Communication Server (Unified Maintenance Tool / masterCGI)KEV
CVE-2024-2362523%9.8
A command injection vulnerability exists in D-Link DAP-1650 devices when handling UPnP SUBSCRIBE messages
published Jan 26, 2024dlink dap-1650 firmware
CVE-2022-270025%9.8
Arris TR3300 v1.0.13 were discovered to contain a command injection vulnerability in the ddns function via the ddns_name, ddns_pwd, h_ddns、ddns_host parameters
published Mar 15, 2022commscope arris tr3300 firmwarePoC
CVE-2022-3655391%9.8
Hytec Inter HWL-2511-SS v1.05 and below was discovered to contain a command injection vulnerability via the component /www/cgi-bin/popen.cgi
published Aug 29, 2022hytec hwl-2511-ss firmware
CVE-2024-1091498%9.2
OS Command Injection in D-Link DNS-320/320LW/325/340L NAS Firmware
published Nov 6, 2024D-Link DNS-320 firmwarePoC

Appears with

D-Linkvendor · 4
Miraimalware · 4
Zyxelvendor · 3
TP-Linkvendor · 3
Fortinetvendor · 2
Telesquarevendor · 2
Netgearvendor · 2
Unit 42organization · 2
Evooo1Botmalware · 2
Palo Alto Networksvendor · 1
Tenda G103product · 1
CISAorganization · 1
FLIRvendor · 1
TLR-2005KSHproduct · 1
Alcatelvendor · 1
FortiGuard Labsproduct · 1

Entities are extracted by the model from each article. First seen Aug 13, 2026, last mentioned 24d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.