Chinese Hackers Have Started Exploiting the Newly Disclosed React2Shell Vulnerability
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-1338 | Remote Command Injection in NUUO Camera Web Interface NUUO Camera devices running builds up to 20250203 contain a critical command injection flaw (CWE-74/CWE-77) in the print_file function of /handle_config.php. The log parameter passed to this endpoint is not properly sanitized, so an unauthenticated remote attacker can submit crafted input that is executed as operating-system commands on the device. Successful exploitation can give the attacker control of the surveillance appliance, access to camera streams and recorded footage, and a foothold to pivot into the network it monitors. Any NUUO Camera deployment with a build dated on or before 2025-02-03 is affected, and the vendor was notified but has not responded. Exploit details have been publicly disclosed, the flaw is not yet in CISA KEV, and there are no confirmed reports of in-the-wild exploitation, though EPSS assigns a high (~51%) probability of exploitation within 30 days. Do: Check NUUO's website and support channels for a patched release newer than build 20250203 — the vendor was contacted but did not respond, so a fix may lag. Until a patch is available, restrict internet exposure of the device's web interface (allow only trusted management networks or place it behind a VPN), and use a WAF or reverse proxy to validate or restrict the log parameter on /handle_config.php. Review device and perimeter logs for unexpected command execution or connections to the web interface from unknown sources. | 6.9 | 51% |
| large≈ tens of thousands of internet-exposed NUUO Camera/NVR systems | ||
| CVE-2025-31324 | Unauthenticated File Upload RCE in SAP NetWeaver Visual Composer CVE-2025-31324 is a critical (CVSS 9.8) unrestricted file upload flaw (CWE-434) in the Visual Composer Metadata Uploader component of SAP NetWeaver, which lacks proper authorization. An unauthenticated attacker can send crafted upload requests over the network to the Metadata Uploader endpoint and plant malicious executable binaries, such as webshells, on the host. Executing the uploaded files yields remote code execution with full impact on confidentiality, integrity, and availability, enabling system compromise, lateral movement, and ransomware deployment. Any organization running the affected SAP NetWeaver component is at risk, with the greatest exposure for instances reachable from the internet. Exploitation is confirmed in the wild: the flaw was added to CISA KEV on 2025-04-29, a public PoC exists, and researchers and media report active attacks, including by Chinese-linked actors deploying Golang-based implants on Linux systems and known ransomware use, often chained with CVE-2025-42999. Do: Apply SAP's patch for CVE-2025-31324 (released in the April 2025 security updates) and follow the vendor mitigation instructions per CISA KEV/BOD 22-01 requirements. As interim mitigation, restrict or disable the Visual Composer Metadata Uploader endpoint and ensure it is not reachable from the internet; also patch the related CVE-2025-42999 since the flaws are being chained. Check affected hosts for uploaded webshells, Golang-based implants, and signs of ransomware activity. | 9.8 | 100% | KEV ransomware PoC |
| largetens of thousands of enterprise deployments worldwide, with several thousand instances directly internet-exposed | |
| CVE-2025-55182 | Unauthenticated RCE in React Server Components (React2Shell) CVE-2025-55182 is a critical (CVSS 10.0) pre-authentication remote code execution flaw (CWE-502, deserialization of untrusted data) in React Server Components, specifically the react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack packages in versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0. It is triggered when the vulnerable code unsafely deserializes payloads from HTTP requests sent to Server Function endpoints, requiring no authentication or user interaction. An attacker gains arbitrary code execution on the affected server (CVSS scope changed, with high impact to confidentiality, integrity, and availability), and reporting notes a campaign in which hackers used the flaw to breach 766 Next.js hosts and steal credentials. Any React/Next.js application exposing Server Functions with the affected React versions is in scope, which given the ubiquity of React and Next.js is a very large deployed base. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-12-05 with known ransomware use, EPSS puts the 30-day exploitation probability at 99.8%, multiple public PoC/scanner repositories are available, and coverage has dubbed the flaw React2Shell. Do: Upgrade the react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages to the vendor-patched releases (any version later than the vulnerable 19.0.0, 19.1.0, 19.1.1, and 19.2.0 line) and update Next.js per Vercel's advisory; as a KEV entry, U.S. federal agencies must apply vendor mitigations per BOD 22-01 or discontinue use. Audit internet-exposed Server Function endpoints for the vulnerable React versions and review logs for exploitation activity, including the reported campaign that breached 766 Next.js hosts and stole credentials, then rotate any exposed credentials. | 10.0 | 100% | KEV ransomware PoC ×7 |
| mass≈1M+ internet-facing Next.js/React Server Components deployments (order-of-magnitude estimate) |
Full article620 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananDec 05, 2025Vulnerability / Software Security
Two hacking groups with ties to China have been observed weaponizing the newly disclosed security flaw in React Server Components (RSC) within hours of it becoming public knowledge.
The vulnerability in question is CVE-2025-55182 (CVSS score: 10.0), aka React2Shell, which allows unauthenticated remote code execution. It has been addressed in React versions 19.0.1, 19.1.2, and 19.2.1.
According to a new report shared by Amazon Web Services (AWS), two China-linked threat actors known as Earth Lamia and Jackpot Panda have been observed attempting to exploit the maximum-severity security flaw.
"Our analysis of exploitation attempts in AWS MadPot honeypot infrastructure has identified exploitation activity from IP addresses and infrastructure historically linked to known China state-nexus threat actors," CJ Moses, CISO of Amazon Integrated Security, said in a report shared with The Hacker News.
Specifically, the tech giant said it identified infrastructure associated with Earth Lamia, a China-nexus group that was attributed to attacks exploiting a critical SAP NetWeaver flaw (CVE-2025-31324) earlier this year.
The hacking crew has targeted sectors across financial services, logistics, retail, IT companies, universities, and government organizations across Latin America, the Middle East, and Southeast Asia.
The attack efforts have also originated from infrastructure related to another China-nexus cyber threat actor known as Jackpot Panda, which has primarily singled out entities that are either engaged in or support online gambling operations in East and Southeast Asia.
Jackpot Panda, per CrowdStrike, is assessed to be active since at least 2020, and has targeted trusted third-party relationships in an attempt to deploy malicious implants and gain initial access. Notably, the threat actor was connected to the supply chain compromise of a chat app known as Comm100 in September 2022. The activity is tracked by ESET as Operation ChattyGoblin.
It has since emerged that a Chinese hacking contractor, I-Soon, may have been involved in the supply chain attack, citing infrastructure overlaps. Interestingly, attacks mounted by the group in 2023 have primarily focused on Chinese-speaking victims, indicating possible domestic surveillance.
"Beginning in May 2023, the adversary used a trojanized installer for CloudChat, a China-based chat application popular with illegal, Chinese-speaking gambling communities in Mainland China," CrowdStrike said in its Global Threat Report released last year.
"The trojanized installer served from CloudChat's website contained the first stage of a multi-step process that ultimately deployed XShade – a novel implant with code that overlaps with Jackpot Panda's unique CplRAT implant."
Amazon said it also detected threat actors exploiting 2025-55182 along with other N-day flaws, including a vulnerability in NUUO Camera (CVE-2025-1338, CVSS score: 7.3), suggesting broader attempts to scan the internet for unpatched systems.
The observed activity involves attempts to run discovery commands (e.g., whoami), write files ("/tmp/pwned.txt"), and read files containing sensitive information (e.g., "/etc/passwd").
"This demonstrates a systematic approach: threat actors monitor for new vulnerability disclosures, rapidly integrate public exploits into their scanning infrastructure, and conduct broad campaigns across multiple Common Vulnerabilities and Exposures (CVEs) simultaneously to maximize their chances of finding vulnerable targets," Moses said.
Cloudflare Blames Outage on React2Shell Patch
The development comes as Cloudflare experienced a brief but widespread outage that caused websites and online platforms to return a "500 Internal Server Error" message.
"A change made to how Cloudflare's Web Application Firewall parses requests caused Cloudflare's network to be unavailable for several minutes this morning," the web infrastructure provider said in a statement Friday. "This was not an attack; the change was deployed by our team to help mitigate the industry-wide vulnerability disclosed this week in React Server Components."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/12/chinese-hackers-have-started-exploiting.html