New Botnet Campaign Exploits Ruckus Wireless Flaw
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-25717 | Unauthenticated RCE via Command Injection in Ruckus Wireless Admin ≤10.4 CVE-2023-25717 is a command-injection flaw (CWE-94) in Ruckus Wireless Admin through version 10.4, the management interface used with Ruckus/CommScope SmartZone controllers. An unauthenticated attacker triggers it by sending a crafted HTTP GET request to /forms/doLogin, injecting shell commands (e.g., $(curl ...) substrings) into the login_username or password parameters, which the device executes. Successful exploitation yields remote code execution with full compromise of the management interface, and the same code path is also tied to CSRF/SSRF issues. Any organization running an internet-exposed Ruckus Wireless Admin or SmartZone management endpoint is affected, and the flaw has been actively exploited in the wild — botnet campaigns (notably Andoryu) used it to recruit devices, and CISA added it to the Known Exploited Vulnerabilities catalog on 2023-05-12; EPSS puts the 30-day exploitation probability at 98.1%. Do: Apply vendor updates per Ruckus/CommScope instructions for Wireless Admin (beyond 10.4) and SmartZone firmware, and per CISA KEV guidance disconnect any product that is end-of-life if it cannot be patched. Restrict the management interface so /forms/doLogin is not reachable from the internet, and review access logs for unauthenticated GET requests containing shell syntax such as $( ) in the login_username or password parameters to detect prior exploitation. | 9.8 | 98% | KEV PoC |
| largeon the order of 10,000–100,000 internet-exposed management interfaces (unknown exact count) |
Full article314 words · extracted from infosecurity-magazine.com · click to collapse
A critical vulnerability has been discovered in the Linux-based Ruckus access points (AP) that allows remote attackers to take control of vulnerable systems.
Tracked CVE-2023-25717 and first discovered in February, the flaw has been recently exploited by a new botnet named AndoryuBot, according to a new advisory by Fortinet.
“[AndoryuBot] contains DDoS attack modules for different protocols and communicates with its command-and-control server using SOCKS5 proxies,” explained Fortinet senior antivirus analyst Cara Lin.
“Based on our IPS [intrusion prevention system] signatures trigger count [...] this campaign started distributing the current version sometime after mid-April.”
AndoryuBot utilizes the Ruckus vulnerability to obtain entry into a device and subsequently downloads a script for additional spread. The particular variant observed by Fortinet targeted Linux systems and was designed to infect different types of computer processors, including some used in smartphones, laptops and other electronic devices.
AndoryuBot uses a way of downloading itself called “curl.” However, Fortinet found an error in the malware’s code that makes it unable to run on some computers.
“Once a target device is compromised, AndoryuBot quickly spreads and begins communicating with its C2 server via the SOCKS protocol,” Lin wrote. “Once the victim system receives the attack command, it starts a DDoS attack on a specific IP address and port number.”
According to Lin, AndoryuBot then quickly updates with more DDoS methods and awaits attack commands.
“Users should be aware of this new threat and actively apply patches on affected devices as soon as they become available,” advised Fortinet.
The advisory provides IPS signatures for customers and Indicators of Compromise (IOCs) for other system defenders to safeguard companies against the threats identified in the exploit.
Its publication comes weeks after Akamai security researchers discovered a new DDoS botnet capable of launching attacks with data volumes reaching several Tbps.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/botnet-campaign-exploits-ruckus/