Malwarecritical
Over 1,000 Exposed ComfyUI Instances Targeted in Cryptomining Botnet Campaign
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-38646 | Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's… | 9.8 | 99% | ||
| CVE-2023-46604 | Unauthenticated RCE in Apache ActiveMQ via OpenWire Deserialization | 9.8 | 100% | KEVRansomwarePoC | KEV |
| CVE-2025-55182 | Unauthenticated RCE in React Server Components (React2Shell) | 10.0 | 100% | KEVRansomwarePoC ×13 | KEV |
| CVE-2025-68613 | Authenticated RCE in n8n Workflow Automation Expression Evaluation | 8.8 | 99% | KEVPoC ×2 | KEV |
| CVE-2025-7544 | A vulnerability was found in Tenda AC1206 15.03.06.23 | 7.4 | 2% | PoC ×2 |
From the original article
7 min read at thehackernews.com
An active campaign has been observed targeting internet-exposed instances running ComfyUI, a popular stable diffusion platform, to enlist them into a cryptocurrency mining and proxy botnet.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.