Cyber Attackers Turn to Cloud Services to Deploy Malware

MVPower CCTV DVR models, including TV-7104HE 1.8.4 115215B9 and TV7108HE, contain a web shell that is accessible via a /shell URI. A remote unauthenticated attacker can execute arbitrary operating system commands as root. This vulnerability has also been referred to as the "JAWS webserver RCE" because of the easily identifying HTTP response server field. Other firmware versions, at least from 2014 through 2019, can be affected. This was exploited in the wild in 2017 through 2022.

Huawei HG532 with some customized versions has a remote code execution vulnerability. An authenticated attacker could send malicious packets to port 37215 to launch attacks. Successful exploit could lead to the remote execution of arbitrary code.

CVE-2018-10561 is a critical authentication bypass (CWE-287, CVSS 9.8) in Dasan GPON home router firmware: the devices fail to properly enforce login when a specific suffix is added to a URL. An attacker simply appends "?images" to any protected URL — for example /menu.html?images/ or /GponForm/diag_FORM?images/ — and the router treats the request as already authenticated. Once bypassed, the attacker gains full access to the device's management interface, enabling configuration changes, diagnostics, and use of the router as a botnet node or network pivot. All Dasan Gigabit Passive Optical Network (GPON) routers running the affected firmware are exposed, especially units with their web interface reachable from the internet; CISA notes the impacted product is end-of-life. Exploitation is active and widespread: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-31), carries a 92.9% EPSS probability of exploitation within 30 days, and IoT botnets have historically targeted these routers.

Do: CISA's required action is to disconnect or replace these routers if still in use, since the product is end-of-life and should not remain deployed. As an interim mitigation, remove the device's web management interface from internet exposure and block or strip requests containing "?images"; verify exposure by loading /menu.html?images/ without logging in — if it returns the management page, the device is vulnerable. A community mitigation tool and unofficial patch have been published by researchers, but replacement remains the recommended fix, and defenders should expect continued botnet scanning of exposed units.

CVE-2023-1389 is a command injection flaw (CWE-77) in TP-Link's Archer AX21 Wi-Fi 6 router that lets an attacker execute arbitrary operating-system commands on the device. It is triggered by sending crafted input to a remotely reachable service on the router, which passes attacker-controlled values to the device's shell without proper sanitization; the source data does not specify the vulnerable endpoint or exact affected firmware ranges. Successful exploitation yields remote code execution on the router, giving the attacker a foothold in the network where the router sits, from which they can pivot or abuse the device further. Any household or organization running an Archer AX21 router is affected, with the highest risk where the router's management interface is exposed to the internet. The flaw was added to CISA's KEV catalog on 2023-05-01, confirming exploitation in the wild; EPSS assigns a ~100% probability of exploitation within 30 days (top percentile), while no public proof-of-concept or ransomware association is documented in the source data.

Do: Update the Archer AX21 to the latest firmware available from TP-Link per the vendor's instructions (fixed firmware is published on the product's TP-Link support page). If updating is not immediately possible, disable WAN-side/remote management and restrict the router's web interface to the local network. Because exploitation is confirmed in the wild, also review exposed routers for signs of compromise, such as unexplained configuration changes or unexpected outbound traffic.

Ivanti Connect Secure (formerly Pulse Connect Secure) and Ivanti Policy Secure appliances contain a command injection flaw (CWE-77) in their web components, triggered when an authenticated administrator sends crafted requests to the appliance. The bug can be chained with the separate authentication bypass CVE-2023-46805, allowing an unauthenticated attacker to achieve the same result. Successful exploitation lets an attacker execute arbitrary commands and code on the appliance, providing a foothold into the networks behind the VPN or network access control gateway. Any organization running these appliances, typically enterprises and government agencies often deployed directly on the internet perimeter, is affected. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-01-10 with known ransomware use and EPSS assigns a 100% probability of exploitation within 30 days, although no public proof-of-concept is available.

Do: Apply Ivanti's mitigations or patched builds immediately per vendor instructions, addressing the chained authentication bypass CVE-2023-46805 at the same time, and discontinue or restrict use of any appliance for which mitigations are unavailable, especially if it is internet-facing. Because exploitation with ransomware use is known, assume compromise is possible: review appliance web logs for suspicious requests and run Ivanti's integrity-checking guidance to verify appliance images before and after remediation. Where feasible, restrict direct internet exposure of the appliance web interface and monitor for further vendor advisories.