Malwarecritical
RondoDox Botnet targets 56 flaws across 30+ device types worldwide
- CVEs
- CVE-2024-3721CVE-2024-12856CVE-2023-1389CVE-2022-44149CVE-2015-2051CVE-2016-6277CVE-2020-27867CVE-2021-41773CVE-2021-42013CVE-2025-1829CVE-2025-4008CVE-2020-25506CVE-2023-52163CVE-2024-12847CVE-2024-10914CVE-2025-22905CVE-2023-47565CVE-2022-37129CVE-2014-6271CVE-2018-10561CVE-2019-16920CVE-2025-7414CVE-2020-10987CVE-2023-26801CVE-2025-34037CVE-2024-7029CVE-2025-5504CVE-2017-18368CVE-2022-36553CVE-2014-1635CVE-2023-51833CVE-2018-11714CVE-2023-25280CVE-2017-18369CVE-2019-1663CVE-2024-1781
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2014-6271 | Arbitrary Code Execution in GNU Bash (Shellshock) | — | 100% | KEV | — KEV |
| CVE-2015-2051 | Remote Command Execution via HNAP GetDeviceSettings in D-Link DIR-645 Router | — | 97% | KEV | — KEV |
| CVE-2016-6277 | Unauthenticated RCE via Command Injection in NETGEAR Multiple Routers | 8.8 | 100% | KEVPoC ×3 | KEV |
| CVE-2017-18368 | Unauthenticated OS Command Injection in Zyxel/Billion TrueOnline Routers | 9.8 | 95% | KEVPoC ×3 | KEV |
| CVE-2017-18369 | The Billion 5200W-T 1.02b.rc5.dt49 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwarding function, which… | 9.8 | 68% | PoC ×3 | |
| CVE-2018-10561 | Authentication Bypass in Dasan GPON Home Routers (CVE-2018-10561) | 9.8 | 93% | KEVPoC ×2 | KEV |
| CVE-2018-11714 | An issue was discovered on TP-Link TL-WR840N v5 00000005 0.9.1 3.16 v0001.0 Build 170608 Rel.58696n and TL-WR841N v13 00000013 0.9.1 4.16 v0001.0 Build 170622… | 9.8 | 67% | PoC ×2 | |
| CVE-2019-1663 | A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco… | 9.8 | 96% | PoC ×2 | |
| CVE-2019-16920 | Command Injection in Multiple D-Link Routers Enables Full Device Compromise | 9.8 | 100% | KEVPoC ×2 | KEV |
| CVE-2020-10987 | Unauthenticated OS Command Injection in Tenda AC15 AC1900 Router | 9.8 | 80% | KEVPoC | KEV |
| CVE-2020-25506 | Command Injection in D-Link DNS-320 system_mgr.cgi Allows Remote Code Execution | 9.8 | 100% | KEVPoC | KEV |
| CVE-2020-27867 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6020, R6080, R6120, R6220, R6260, R6700v2… | 6.8 | 2% | ||
| CVE-2021-41773 | Path Traversal to RCE in Apache HTTP Server 2.4.49 | 9.8 | 100% | KEVRansomwarePoC ×6 | KEV |
| CVE-2021-42013 | Path Traversal and RCE in Apache HTTP Server (follow-up to CVE-2021-41773) | 9.8 | 100% | KEVRansomwarePoC ×6 | KEV |
| CVE-2022-36553 | Hytec Inter HWL-2511-SS v1.05 and below was discovered to contain a command injection vulnerability via the component /www/cgi-bin/popen.cgi | 9.8 | 91% | ||
| CVE-2022-37129 | D-Link DIR-816 A2_v1.10CNB04.img is vulnerable to Command Injection via /goform/SystemCommand | 8.8 | 8% | PoC | |
| CVE-2022-44149 | The web service on Nexxt Amp300 ARN02304U8 42.103.1.5095 and 80.103.2.5045 devices allows remote OS command execution by placing &telnetd in the JSON host… | 8.8 | 64% | PoC ×4 | |
| CVE-2023-1389 | Command Injection in TP-Link Archer AX21 Router Allows Remote Code Execution | 8.8 | 100% | KEVPoC ×2 | KEV |
| CVE-2023-25280 | Unauthenticated OS Command Injection in D-Link DIR-820 Router (CVE-2023-25280) | 9.8 | 98% | KEVPoC | KEV |
| CVE-2023-26801 | LB-LINK BL-AC1900_2.0 v1.0.1, LB-LINK BL-WR9000 v2.4.9, LB-LINK BL-X26 v1.2.5, and LB-LINK BL-LTE300 v1.0.8 were discovered to contain a command injection… | 9.8 | 78% | PoC | |
| CVE-2023-47565 | Authenticated OS Command Injection in QNAP VioStor NVR (QVR Firmware 4.x) | 8.8 | 73% | KEV | KEV |
| CVE-2023-51833 | A command injection issue in TRENDnet TEW-411BRPplus v.2.07_eu that allows a local attacker to execute arbitrary code via the data1 parameter in the debug.cgi… | 8.1 | 4% | PoC | |
| CVE-2023-52163 | Missing Authorization Enables Command Injection in Digiever DS-2105 Pro NVRs | 8.8 | 97% | KEVPoC ×3 | KEV |
| CVE-2024-10914 | OS Command Injection in D-Link DNS-320/320LW/325/340L NAS Firmware | 9.2 | 98% | PoC | |
| CVE-2024-12847 | Unauthenticated Root RCE in NETGEAR DGN1000 via setup.cgi | 9.8 | 30% | PoC ×2 | |
| CVE-2024-12856 | OS Command Injection in Four-Faith F3x24/F3x36 Routers | 7.2 | 84% | PoC ×2 | |
| CVE-2024-1781 | A vulnerability was found in Totolink X6000R AX3000 9.4.0cu.852_20230719 | 9.8 | 15% | PoC | |
| CVE-2024-3721 | TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical: This issue affects some unknown processing of the file /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___. The manipulation of the… | 6.3 | 86% | ||
| CVE-2024-7029 | Commands can be injected over the network and executed without authentication | 8.7 | 43% | PoC | |
| CVE-2025-1829 | A vulnerability was found in TOTOLINK X18 9.1.0cu.2024_B20220329 | 5.3 | 12% | PoC | |
| CVE-2025-22905 | RE11S v1.11 was discovered to contain a command injection vulnerability via the command parameter at /goform/mp | 9.8 | 5% | PoC | |
| CVE-2025-34037 | Unauthenticated OS Command Injection in Linksys E-Series Routers | 10.0 | 91% | ||
| CVE-2025-4008 | Unauthenticated Command Injection RCE in Smartbedded Meteobridge | 8.7 | 93% | KEVPoC | KEV |
| CVE-2025-5504 | A vulnerability has been found in TOTOLINK X2000R 1.0.0-B20230726.1108 and classified as critical | 5.3 | 14% | PoC | |
| CVE-2025-7414 | A vulnerability classified as critical was found in Tenda O3V2 1.0.0.12(3880) | 2.1 | 13% | PoC ×2 |
From the original article
3 min read at securityaffairs.com
RondoDox botnet exploits 56 known flaws in over 30 device types, including DVRs, CCTV systems, and servers, active globally since June. Trend Micro researchers reported that the RondoDox botnet exploits 56 known flaws in over 30 device types, including DVRs, NVRs, CCTV systems, and web servers, active globally since June.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.