Vulnerabilitymedium
A new Zerobot variant spreads by exploiting Apache flaws
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2016-20017 | Unauthenticated Command Injection in D-Link DSL-2750B Router login.cgi | 9.8 | 66% | KEVPoC ×2 | KEV |
CVE-2017-17105+1 related CVE | Zivif PR115-204-P-RS V2.3.4.2103 and V4.7.4.2121 (and possibly in-between versions) web cameras are vulnerable to unauthenticated, blind remote command… | 9.8 | 85% | PoC ×2 | |
| CVE-2018-10561 | Authentication Bypass in Dasan GPON Home Routers (CVE-2018-10561) | 9.8 | 93% | KEVPoC ×2 | KEV |
| CVE-2018-12613 | An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute) files on the server | 8.8 | 98% | PoC ×3 | |
| CVE-2018-20057 | An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 devices | 8.8 | 7% | PoC | |
| CVE-2019-10655 | Grandstream GAC2500 1.0.3.35, GXP2200 1.0.3.27, GVC3202 1.0.3.51, GXV3275 before 1.0.3.219 Beta, and GXV3240 before 1.0.3.219 Beta devices allow… | 9.8 | 15% | PoC ×3 | |
| CVE-2020-25223 | Unauthenticated Command Injection RCE in Sophos SG UTM WebAdmin | 9.8 | 97% | KEVPoC ×2 | KEV |
| CVE-2020-7209 | LinuxKI v6.0-1 and earlier is vulnerable to an remote code execution which is resolved in release 6.0-2 | 9.8 | 99% | PoC ×2 | |
| CVE-2021-42013 | Path Traversal and RCE in Apache HTTP Server (follow-up to CVE-2021-41773) | 9.8 | 100% | KEVRansomwarePoC ×6 | KEV |
| CVE-2022-30023 | Tenda ONT GPON AC1200 Dual band WiFi HG9 v1.0.1 is vulnerable to Command Injection via the Ping function | 8.8 | 39% | PoC | |
| CVE-2022-31137 | Roxy-WI: Versions prior to 6.1.1.0 are subject to a remote code execution vulnerability. System commands can be run remotely via the… | 9.8 | 91% | PoC | |
| CVE-2022-33891 | Command Injection in Apache Spark UI via ACL Impersonation (CVE-2022-33891) | 8.8 | 93% | KEVPoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | zerostresser.com | ing the botnet as a malware-as-a-service model, one domain (zerostresser[.]com) with links to the bot was among the 48 domains associate |
From the original article
3 min read at securityaffairs.com
Microsoft spotted an upgraded variant of the Zerobot botnet that spreads by exploiting Apache vulnerabilities. Microsoft Threat Intelligence Center (MSTIC) researchers discovered a new variant of the Zerobot botnet (aka ZeroStresser) that was improved with the capabilities to target more Internet of Things (IoT) devices. The IT giant is tracking this cluster of threat activity as DEV-1061.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.