Malwarehigh
IoT Botnet C0XMO Adds Competitor
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2015-2051 | Remote Command Execution via HNAP GetDeviceSettings in D-Link DIR-645 Router | — | 97% | KEV | — KEV |
| CVE-2016-15047 | AVTECH devices that include the CloudSetup.cgi management endpoint are vulnerable to authenticated OS command injection | 8.7 | 4% | ||
| CVE-2021-27137 | Unauthenticated Stack-Based Buffer Overflow in DD-WRT UPnP (SSDP M-SEARCH) | 8.1 | 4% | KEVPoC ×4 | KEV |
| CVE-2022-35914 | Unauthenticated PHP Code Injection RCE in GLPI via bundled htmlawed (through 10.0.2) | 9.8 | 100% | KEVPoC ×3 | KEV |
| CVE-2025-34054 | An unauthenticated command injection vulnerability exists in AVTECH DVR devices via Search.cgi?action=cgi_query | 10.0 | 3% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 217.160.125.125 | lware fetches this script from the same IP address and port—217[.]160[.]125[.]125:15527—that it uses to distribute the main C0XMO binar |
From the original article
3 min read at securityaffairs.com
C0XMO is a new Gafgyt botnet variant exploiting old router flaws, spreading across IoT devices, killing rivals, and enabling large-scale DDoS attacks. In March 2026, FortiGuard Labs discovered a new variant of the Gafgyt botnet , dubbed C0XMO, which is noticeably more capable than its predecessors.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.