Wormable Gitpaste-12 Botnet Returns to Target Linux Servers, IoT Devices

CVE-2020-10987 is an unauthenticated OS command injection flaw (CWE-78) in the goform/setUsbUnload endpoint of the Tenda AC15 AC1900 router, demonstrated on firmware version 15.03.05.19. An attacker triggers it by sending a crafted deviceName POST parameter to that endpoint, which is not properly sanitized before being used in a system command. Successful exploitation yields arbitrary remote code execution on the router, giving the attacker full control of the device and a foothold to pivot into the local network, as is typical for IoT botnet recruitment. Owners of Tenda AC15 routers are affected, with greatest risk on units whose web administration interface is reachable from the internet. Exploitation is confirmed in the wild: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), carries a 79.8% EPSS score (top percentile), and a public proof of concept has been available since its 2020 disclosure; ransomware use is unknown.

Do: Apply the latest Tenda AC15 firmware available from the vendor (newer than 15.03.05.19) per CISA's required action and vendor instructions. Until patched, disable or restrict WAN-side remote web administration to trusted source IPs, since the flaw is exploitable without credentials over the network. Check router HTTP logs for unexpected POST requests to /goform/setUsbUnload containing suspicious deviceName values, and monitor for botnet-style command activity.

CVE-2020-17463 is a SQL injection flaw (CWE-89) in FUEL CMS 1.4.7, exploitable through the 'col' parameter on the /pages/items, /permissions/items, and /navigation/items endpoints. Because the parameter is not properly sanitized, a remote, unauthenticated attacker can inject arbitrary SQL via crafted HTTP requests to these URLs with no user interaction or privileges required. Successful exploitation can expose or alter the contents of the CMS database, and under some database configurations may enable further attacks against the backend. Any installation running FUEL CMS 1.4.7 is affected, with internet-exposed instances at greatest risk. The flaw carries a critical CVSS 3.1 score of 9.8, a top-percentile EPSS score (89.7% probability of exploitation within 30 days), a public proof-of-concept, and was added to CISA's Known Exploited Vulnerabilities Catalog on 2021-12-10, indicating known in-the-wild exploitation; ransomware association is unknown.

Do: Upgrade FUEL CMS to a release newer than 1.4.7 per the vendor's instructions, as required by the CISA KEV catalog entry. If patching is not immediate, restrict or filter the 'col' parameter on /pages/items, /permissions/items, and /navigation/items (e.g., via WAF rules) and confirm the CMS database account follows least-privilege principles. Review web and database logs for anomalous queries or SQL injection payloads targeting these endpoints, and verify internet-exposed instances are patched given the KEV listing and high EPSS score.

CVE-2020-17496 is an unauthenticated remote command execution flaw in vBulletin 5 (CWE-74, improper command neutralization) that exists because the vendor's fix for the earlier CVE-2019-16759 was incomplete. An attacker triggers it by sending a request to the ajax/render/widget_tabbedcontainer_tab_panel route with crafted subWidgets data, which the application processes without adequate sanitization. Successful exploitation allows a remote, unauthenticated attacker to execute arbitrary commands on the web server with the privileges of the web application, enabling site compromise, data theft, or deployment of webshells or botnet malware. All vBulletin deployments running versions 5.5.4 through 5.6.2 are affected. Exploitation is confirmed: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), public proof-of-concept exploits and a detailed public analysis exist, and EPSS estimates an 87.7% probability of exploitation within 30 days; ransomware association is listed as unknown.

Do: Upgrade vBulletin to a release newer than 5.6.2 following the vendor's update instructions, as required by CISA's KEV listing. As an interim mitigation, restrict or block access to the ajax/render route (e.g., via WAF rules). Given confirmed in-the-wild exploitation, review web server logs for requests to ajax/render/widget_tabbedcontainer_tab_panel with crafted subWidgets parameters and check for signs of compromise such as webshells or unexpected processes running as the web server user.

CVE-2020-5902 is a critical, unauthenticated remote code execution flaw in the F5 BIG-IP Traffic Management User Interface (TMUI), the appliance's web management console, rooted in a directory/path traversal issue (CWE-22) in undisclosed TMUI pages. It is triggered by sending crafted HTTP(S) requests to the management interface — classically path-traversal URLs beneath the TMUI application on the management port — which lets an attacker bypass authentication, read or delete arbitrary files, and execute commands without credentials. Successful exploitation yields full control of the BIG-IP system, which attackers can use to pivot into networks the appliance fronts, maintain persistence, and deploy ransomware. Any organization running an affected F5 BIG-IP appliance or virtual edition whose TMUI is reachable, or whose management network can be reached, is exposed; F5's installed base spans large enterprises and service providers, so the footprint is broad. Exploitation is confirmed in the wild: the flaw was mass-scanned and exploited within days of its July 2020 disclosure, it is listed in CISA KEV with known ransomware use, and EPSS assigns a ~100% probability of exploitation within 30 days.

Do: Patch immediately using F5's advisory K52145254 — upgrade BIG-IP to a fixed release per the vendor's version matrix, since CISA's required action is applying vendor updates. Until patched, restrict TMUI/management-interface access to trusted source IPs or a VPN (or disable TMUI if unused) and apply F5's published interim workaround. Because ransomware use is confirmed, hunt for indicators of compromise on both patched and unpatched appliances (unexpected files, webshells, modified login pages, new accounts or scheduled tasks) before treating systems as clean.

CVE-2020-8816 is an OS command injection flaw (CWE-78) in Pi-hole's web dashboard, AdminLTE (Pi-hole Web), version 4.3.2. A privileged dashboard user can trigger remote code execution by adding a crafted DHCP static lease, causing injected commands to run on the Pi-hole host. An attacker with an authenticated admin session gains code execution on the DNS appliance, yielding high impact on confidentiality, integrity and availability of that system and the networks whose DNS it handles. Any Pi-hole deployment running the affected AdminLTE web interface is affected, with the greatest risk where the admin panel is reachable from networks an attacker can access. The flaw is listed in CISA's Known Exploited Vulnerabilities Catalog (added 2021-12-10), has a public proof-of-concept, and carries a very high EPSS (~78% probability of exploitation within 30 days), so it should be treated as actively exploited.

Do: Upgrade Pi-hole Web (AdminLTE) to any release newer than v4.3.2 per vendor instructions and treat this as urgent because the flaw is in CISA's KEV. In the interim, keep the admin dashboard off the public internet (restrict to LAN/VPN with strong authentication), review configured DHCP static leases for injected commands, and check web server logs for evidence of exploitation.