Exploit / PoCcritical
Hacker is targeting DNA sequencer applications from Iranian IP address
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-5638 | Unauthenticated RCE in Apache Struts Jakarta Multipart parser | 9.8 | 100% | KEVRansomwarePoC ×10 | KEV |
| CVE-2017-6526 | dnaTools dnaLIMS 4-2015s13: DnaLIMS is vulnerable to unauthenticated command execution through an improperly protected administrative web shell… | 9.8 | 57% | PoC | |
| CVE-2017-6884 | Command Injection in Zyxel EMG2926 Router Diagnostics | 8.8 | 33% | KEVRansomwarePoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 2.176.78.42 | the research industry. The attacks were originated from the 2.176.78.42 IP address that is located in Iran. “From June 12 – 14, we |
From the original article
2 min read at securityaffairs.com
Threat actors are targeting Web-based DNA sequencer applications leveraging a still-unpatched zero-day to take over the targeted systems. Starting from June 12, 2019, the researcher Ankit Anubhav from NewSky Security, observed threat actors targeting Web-based DNA sequencer applications.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.