New Aquabot Botnet Exploits CVE-2024
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2018-10562 +1 in the same advisory: …10561 | Unauthenticated RCE in Dasan GPON Routers (CVE-2018-10562) CVE-2018-10562 is an OS command injection flaw (CWE-78) in the web management interface of Dasan GPON home routers. When chained with the companion authentication bypass CVE-2018-10561, a remote, unauthenticated attacker can send crafted requests that execute arbitrary commands on the device. Successful exploitation yields full control of the router, enabling device takeover, botnet enrollment, and, per CISA, use in ransomware operations. Anyone operating an affected Dasan GPON router — many of which were deployed by internet service providers — is affected, and CISA notes the impacted products are end-of-life. Exploitation is confirmed in the wild: the flaw is in CISA's KEV (added 2022-03-31) with known ransomware use and a 100% EPSS probability of exploitation within 30 days. Do: Because the product line is end-of-life and CISA's required action is to disconnect impacted devices if still in use, retire or replace affected routers rather than patching in place. If replacement must wait, block or firewall the web management interface from the internet, check the device for signs of compromise, and ensure the related authentication-bypass path CVE-2018-10561 is also closed. | 9.8 | 100% | KEV ransomware PoC ×2 |
| mass≈1 million internet-exposed devices (public scan counts around the 2018 disclosure) | |
| CVE-2018-17532 | Teltonika RUT9XX routers with firmware before 00.04.233 are prone to multiple unauthenticated OS command injection vulnerabilities in autologin.cgi and hotspotl Teltonika RUT9XX routers with firmware before 00.04.233 are prone to multiple unauthenticated OS command injection vulnerabilities in autologin.cgi and hotspotlogin.cgi due to insufficient user input sanitization. This allows remote attackers to execute arbitrary commands with root privileges. NVD description · AI analysis pending | 9.8 | 71% | PoC ×3 |
| — | |
| CVE-2022-31137 | Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Versions prior to 6.1.1.0 are subject to a remote code execution vulnerability. System commands can be run remotely via the subprocess_execute function without processing the inputs received from the user in the /app/options.py file. Attackers need not be authenticated to exploit this vulnerability. Users are advised to upgrade. There are no known workarounds for this vulnerability. NVD description · AI analysis pending | 9.8 | 90% | PoC |
| — | |
| CVE-2023-26801 | LB-LINK BL-AC1900_2.0 v1.0.1, LB-LINK BL-WR9000 v2.4.9, LB-LINK BL-X26 v1.2.5, and LB-LINK BL-LTE300 v1.0.8 were discovered to contain a command injection vulne LB-LINK BL-AC1900_2.0 v1.0.1, LB-LINK BL-WR9000 v2.4.9, LB-LINK BL-X26 v1.2.5, and LB-LINK BL-LTE300 v1.0.8 were discovered to contain a command injection vulnerability via the mac, time1, and time2 parameters at /goform/set_LimitClient_cfg. NVD description · AI analysis pending | 9.8 | 70% | PoC |
| — | |
| CVE-2024-41710 | Argument Injection RCE in Mitel 6800/6900/6900w Series SIP Phones CVE-2024-41710 is an argument injection vulnerability (CWE-88) affecting Mitel 6800 Series, 6900 Series, and 6900w Series SIP phones, including the 6970 Conference Unit, caused by insufficient sanitization of parameters processed during the device's boot process. An attacker who can supply crafted arguments to the boot process can inject and execute arbitrary commands within the context of the phone's system. Organizations deploying these enterprise desk phones are affected; the available data does not specify affected or fixed firmware version ranges. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2025-02-12, confirming exploitation in the wild, though no public proof-of-concept is known and any ransomware association is unconfirmed. EPSS assigns a 41.6% probability of exploitation within the next 30 days (99th percentile), so remediation should be treated as urgent. Do: Update affected 6800/6900/6900w series phones to the fixed firmware per Mitel's security advisory and reboot the phones so they boot with patched firmware, since the flaw is in the boot process; if fixed firmware is unavailable, apply Mitel's mitigations or discontinue use per the CISA KEV required action. Check whether phone management or provisioning interfaces are reachable from untrusted networks and restrict that access. Given KEV-listed exploitation and a 99th-percentile EPSS score, prioritize remediation, and note federal agencies are required to act under the KEV deadline. | 7.2 | 42% | KEV PoC |
| largeon the order of 100,000+ deployed handsets globally (enterprise VoIP installed base estimate; internet-exposed subset likely smaller) |
Full article514 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananJan 30, 2025Vulnerability / IoT Security
A Mirai botnet variant dubbed Aquabot has been observed actively attempting to exploit a medium-severity security flaw impacting Mitel phones in order to ensnare them into a network capable of mounting distributed denial-of-service (DDoS) attacks.
The vulnerability in question is CVE-2024-41710 (CVSS score: 6.8), a case of command injection in the boot process that could allow a malicious actor to execute arbitrary commands within the context of the phone.
It affects Mitel 6800 Series, 6900 Series, 6900w Series SIP Phones, and Mitel 6970 Conference Unit. It was addressed by Mitel in mid-July 2024. A proof-of-concept (PoC) exploit for the flaw became publicly available in August.
Outside of CVE-2024-41710, some of the other vulnerabilities targeted by the botnet include CVE-2018-10561, CVE-2018-10562, CVE-2018-17532, CVE-2022-31137, CVE-2023-26801, and a remote code execution flaw targeting Linksys E-series devices.
"Aquabot is a botnet that was built off the Mirai framework with the ultimate goal of distributed denial-of-service (DDoS)," Akamai researchers Kyle Lefton and Larry Cashdollar said. "It has been known since November 2023."
The web infrastructure company said it detected active exploitation attempts against CVE-2024-41710 since early January 2025, with the attacks mirroring a "payload almost identical to the PoC" to deploy the botnet malware.
The attack involves executing a shell script that, in turn, uses the "wget" command to retrieve Aquabot for different CPU architectures.
The Aquabot Mirai variant spotted in the attack has been assessed to be a third iteration of the malware, sporting a novel "report_kill" function that reports back to the command-and-control (C2) server when a kill signal is caught on the infected device. However, sending this information hasn't been found to elicit any response from the server to date.
This new version, besides triggering C2 communication upon detecting certain signals, renames itself to "httpd.x86" to avoid attracting attention and is programmed to terminate processes that match certain requirements, such as local shells. It's suspected that the signal handling features are likely incorporated to craft more stealthy variants or detect malicious activity from competing botnets.
There is some evidence suggesting that the threat actors behind Aquabot are offering the network of compromised hosts as a DDoS service on Telegram under the monikers Cursinq Firewall, The Eye Services, and The Eye Botnet.
The development is a sign that Mirai continues to plague a wide range of internet-connected devices that often lack proper security features, or have either reached end-of-life or left accessible with default configuration and passwords, making them low-hanging fruits ripe for exploitation and a key conduit for DDoS attacks.
"Threat actors commonly claim that the botnet is used only for DDoS mitigation testing purposes to try to mislead researchers or law enforcement," the researchers said.
"Threat actors will claim it's just a PoC or something educational, but a deeper analysis shows that they are in fact advertising DDoS as a service, or the owners are boasting about running their own botnet on Telegram."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/01/new-aquabot-botnet-exploits-cve-2024.html