New Mirai variants target routers and DVRs in parallel campaigns
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-17215 | Huawei HG532 with some customized versions has a remote code execution vulnerability. Huawei HG532 with some customized versions has a remote code execution vulnerability. An authenticated attacker could send malicious packets to port 37215 to launch attacks. Successful exploit could lead to the remote execution of arbitrary code. NVD description · AI analysis pending | 8.8 | 78% |
| — | ||
| CVE-2023-1389 | Command Injection in TP-Link Archer AX21 Router Allows Remote Code Execution CVE-2023-1389 is a command injection flaw (CWE-77) in TP-Link's Archer AX21 Wi-Fi 6 router that lets an attacker execute arbitrary operating-system commands on the device. It is triggered by sending crafted input to a remotely reachable service on the router, which passes attacker-controlled values to the device's shell without proper sanitization; the source data does not specify the vulnerable endpoint or exact affected firmware ranges. Successful exploitation yields remote code execution on the router, giving the attacker a foothold in the network where the router sits, from which they can pivot or abuse the device further. Any household or organization running an Archer AX21 router is affected, with the highest risk where the router's management interface is exposed to the internet. The flaw was added to CISA's KEV catalog on 2023-05-01, confirming exploitation in the wild; EPSS assigns a ~100% probability of exploitation within 30 days (top percentile), while no public proof-of-concept or ransomware association is documented in the source data. Do: Update the Archer AX21 to the latest firmware available from TP-Link per the vendor's instructions (fixed firmware is published on the product's TP-Link support page). If updating is not immediately possible, disable WAN-side/remote management and restrict the router's web interface to the local network. Because exploitation is confirmed in the wild, also review exposed routers for signs of compromise, such as unexplained configuration changes or unexpected outbound traffic. | 8.8 | 100% | KEV PoC ×2 |
| masslikely hundreds of thousands of routers deployed, with >100k plausibly internet-exposed | |
| CVE-2024-3721 | A vulnerability was found in TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical. A vulnerability was found in TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical. This issue affects some unknown processing of the file /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___. The manipulation of the argument mdb/mdc leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260573 was assigned to this vulnerability. NVD description · AI analysis pending | 6.3 | 86% | — | — | ||
| CVE-2025-29635 | Authenticated Command Injection in D-Link DIR-823X Routers Exploited by Mirai Botnet CVE-2025-29635 is a command injection flaw (CWE-77) in D-Link DIR-823X router firmware builds 240126 and 240802 that permits arbitrary command execution on the device. It is triggered by sending a crafted POST request to the /goform/set_prohibiting endpoint, and because the flaw requires high privileges (CVSS PR:H), the attacker must hold valid administrative credentials, which in botnet campaigns is typically achieved via default or weak passwords. Successful exploitation yields full remote command execution on the router, which in the observed campaign has been used by Mirai-variant botnets to enroll devices for DDoS activity. Any DIR-823X running the listed firmware builds is affected, with exposure concentrated in units whose web administration interface is reachable from the internet. The flaw was added to CISA's KEV catalog on 2026-04-24 after documented in-the-wild exploitation (an Akamai report on a Mirai campaign and a public PoC), and its EPSS score of 87.9% places it in the top percentile for near-term exploitation risk. Do: Apply updated DIR-823X firmware per D-Link's guidance (a fixed build is not specified in this data) or the applicable BOD 22-01 mitigation deadline, reported as May 2026 for federal agencies. Until patched, ensure the router's admin interface is not exposed to the WAN and change default/weak credentials, since exploitation requires valid administrative access. Check devices for indicators of Mirai-style compromise (unexpected processes, outbound scanning or DDoS traffic) and review logs for POST requests to /goform/set_prohibiting from untrusted sources. | 7.2 | 88% | KEV PoC ×2 |
| moderatelikely thousands of internet-exposed DIR-823X routers (roughly 1k-10k units directly attackable; installed base of the model could be higher) |
Full article493 words · extracted from helpnetsecurity.com · click to collapse
Hidden inside newly discovered botnet malware is an unusual message from its creator: “AI.NEEDS.TO.DIE”.
Dubbed “tuxnokill” by researchers at Akamai, the malware is one of two fresh Mirai botnet variants documented this month by major cybersecurity firms and, judging by the aforementioned hard-coded string, this particular variant might have been coded the old-fashioned way.
“Tuxnokill” and “Nexcorium”
Based on hits on the company’s global network of honeypots, Akamai found that tuxnokill is spreading through CVE-2025-29635, a command injection flaw in D-Link DIR-823X routers that sat unexploited for a full year after its disclosure in March 2025.
“A public proof of concept (PoC) exploit was shared by the researchers to GitHub and linked to the CVE disclosure, but has since been removed,” the researchers noted. The exploit used by the attacker presents key differences, but targets the same vulnerable code path and triggers the same system() call.
The same threat actor was also observed probing TP-Link Archer AX21 devices via CVE-2023-1389 and ZTE ZXV10 H108L routers with a publicly available exploit.
Meanwhile, Fortinet’s FortiGuard Labs detailed a parallel campaign by a group calling itself “Nexus Team,” which has been targeting TBK digital video recorders (DVNs) via CVE-2024-3721.
Their malware, called “Nexcorium”, is more sophisticated. Like “tuxnokill”, it targets multiple Linux architectures, but it also makes sure to hold on the compromised systems via four separate persistance mechanisms.
“It updates /etc/inittab to make sure the process restarts if it stops. It creates or updates /etc/rc.local to ensure execution at system startup. It then checks common system paths (e.g., /bin/systemctl, /usr/bin/systemctl, and /etc/system/system) and creates a service file at /etc/systemd/system/persist.service, enabling it to run automatically at startup,” the researchers explained.
Finally, it creates a scheduled task using crontab to ensure it runs after reboot. And, after doing all that, it deletes its original binary from the current execution path to evade and frustrate analysis.
The malware is capable of making the compromised devices engage in DDoS attacks via multiple attack methods. And, interestingly, it comes bundled with an exploit targeting older Huawei devices via CVE-2017-17215.
IoT’s endless security problem
Both campaigns follow the well-known and effective playbook: exploit known vulnerabilities in cheap, unsupported, unpatched IoT hardware, covertly conscript them into a botnet, and then use those botnets to launch DDoS attacks.
“Especially when public PoC exploits exist for these vulnerabilities, attackers can easily incorporate them into their exploitation vectors,” Akamai researchers noted.
Unfortunately, end-of-life devices, slow patching cycles, and default credentials continue to hand botnet operators an easy path into home and business networks worldwide.
Both companies have shared indicators of compromise and detection rules.
“We highly recommend that organizations regularly monitor vulnerability disclosures that are relevant to their infrastructure, and apply the proper patches, upgrades, and safeguards to ensure their own operational security,” Akamai advised.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2026/04/22/new-mirai-variants-target-routers-and-dvrs-via-old-flaws/