Malwarecritical
React2Shell under attack: RondoDox Botnet spreads miners and malware
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-12856 | OS Command Injection in Four-Faith F3x24/F3x36 Routers | 7.2 | 84% | PoC ×2 | |
| CVE-2024-3721 | TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical: This issue affects some unknown processing of the file /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___. The manipulation of the… | 6.3 | 86% | ||
| CVE-2025-55182 | Unauthenticated RCE in React Server Components (React2Shell) | 10.0 | 100% | KEVRansomwarePoC ×13 | KEV |
From the original article
2 min read at securityaffairs.com
RondoDox botnet exploits the critical React2Shell flaw (CVE-2025-55182) to infect vulnerable Next. js servers with malware and cryptominers. CloudSEK researchers warn that the RondoDox botnet is exploiting the critical React2Shell flaw ( CVE-2025-55182 ) to drop malware and cryptominers on vulnerable Next.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.