IoT Botnet C0XMO Adds Competitor

The D-Link DIR-645 wired/wireless router is vulnerable to OS command injection (CWE-77) in its HNAP interface: input supplied to the GetDeviceSettings action is not properly neutralized, so a remote attacker who sends a crafted HTTP request to the router's HNAP endpoint can have arbitrary operating-system commands executed on the device. Successful exploitation gives the attacker control of the router at the system level, enabling reconfiguration or abuse of the device, traffic interception or redirection, and recruitment into IoT botnets, as reflected in recent Moobot/MooBot botnet campaigns. Any site or household still running a DIR-645, especially one whose web/HNAP management interface is reachable from the internet, is affected; the product is end-of-life. The flaw is under active exploitation: it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-02-10, and EPSS assigns a 97.1% probability of exploitation within 30 days (100th percentile). CISA's required action reflects the risk: disconnect the impacted product if it is still in use because it has reached end-of-life.

Do: Because the DIR-645 is end-of-life, CISA's required action is to disconnect it; replace the device where possible, or at minimum apply the latest available D-Link firmware for the DIR-645 and ensure the management/HNAP interface is not reachable from the internet (block or restrict remote administration on the WAN side). Check the device for signs of botnet infection, such as unexpected outbound traffic or unexpected HNAP POST/SOAP requests, and prioritize this fix given the 97.1% EPSS score and known in-the-wild exploitation.

AVTECH devices that include the CloudSetup.cgi management endpoint are vulnerable to authenticated OS command injection. The `exefile` parameter in CloudSetup.cgi is passed to the underlying system command execution without proper validation or whitelisting. An authenticated attacker who can invoke this endpoint can supply crafted input to execute arbitrary system commands as root. Successful exploitation grants full control of the device, and - depending on deployment and whether the device stores credentials or has network reachability to internal systems - may enable credential theft, lateral movement, or data exfiltration. The archived SEARCH-LAB disclosure implies that this vulnerability was remediated in early 2017, but AVTECH has not defined an affected version range.

DD-WRT firmware before build 45724 contains a stack-based buffer overflow (CWE-121) caused by an unsafe strcpy in the UPnP handling code (ssdp_msearch in router/upnp/src/ssdp.c). An unauthenticated remote attacker can trigger it by sending a crafted SSDP M-SEARCH request to a UPnP-enabled interface, overflowing an internal fixed buffer. Successful exploitation can crash the router or allow code execution and full device compromise, consistent with the high confidentiality, integrity and availability impacts in the 8.1 CVSS score. Exposure is limited because UPnP is disabled by default and, by default, listens only on internal interfaces, so risk is concentrated on DD-WRT routers where UPnP has been enabled and on networks where an attacker has LAN access. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-07-21, has public proofs of concept, and is reportedly being exploited in the wild by the C0XMO IoT botnet (a Gafgyt variant) to propagate and remove rival malware.

Do: Upgrade affected DD-WRT routers to build 45724 or later. If upgrading is not immediately possible, disable UPnP, or verify that UPnP/SSDP is bound only to internal interfaces and that UDP port 1900 (SSDP) and M-SEARCH traffic are not reachable from the WAN. Per the CISA KEV required action, apply mitigations in line with BOD 26-04 guidance, and check any internet-exposed DD-WRT device for signs of compromise (e.g., unexpected botnet traffic) if UPnP was enabled.

GLPI, a widely deployed open-source IT asset management platform, bundles a third-party htmlawed library whose htmLawedTest.php script permits unauthenticated PHP code injection (CWE-74) in GLPI versions through 10.0.2. An attacker triggers it by sending a crafted HTTP request with injected PHP parameters to the directly web-reachable /vendor/htmlawed/htmlawed/htmLawedTest.php script, with no authentication and no user interaction required (AV:N/AC:L/PR:N/UI:N). Successful exploitation yields remote code execution on the web server as the web service account, enabling data theft, lateral movement, and follow-on activity such as ransomware staging or botnet recruitment. Any organization running GLPI 10.0.2 or earlier is affected, particularly internet-facing instances where the test script is directly reachable. The flaw is under active exploitation: it was added to CISA's Known Exploited Vulnerabilities Catalog on 2023-03-07 (required action: apply vendor updates), carries a 99.7% EPSS score, and multiple public proof-of-concept exploits are available.

Do: Upgrade GLPI to a fixed release newer than 10.0.2 (or update the bundled htmlawed library to a patched version); as an interim mitigation, remove or block direct web access to /vendor/htmlawed/htmlawed/htmLawedTest.php. Prioritize internet-facing instances given active exploitation and the 99.7% EPSS score, and review web access logs for requests to htmLawedTest.php plus signs of webshells or unexpected administrator accounts. As a CISA KEV entry, federal agencies and other KEV subscribers are required to apply vendor updates per the catalog instructions.

An unauthenticated command injection vulnerability exists in AVTECH DVR devices via Search.cgi?action=cgi_query. The use of wget without input sanitization allows attackers to inject shell commands through the username or queryb64str parameters, executing commands as root. Exploitation evidence was observed by the Shadowserver Foundation on 2025-01-04 UTC.