Mirai-based botnet IZ1H9 added 13 payloads to target routers

The built-in ping tool in multiple D-Link and TRENDnet devices can be abused by remote attackers to execute arbitrary code on the device; the flaw is mapped to CWE-287 (improper authentication), indicating the diagnostic ping interface can be reached without valid credentials. An attacker triggers it by sending crafted requests to the device's web-based ping/diagnostic function and injecting commands, gaining full code execution on the router, typically as a foothold for botnet recruitment, traffic interception, or pivoting into the network behind the device. Only D-Link and TRENDnet products are affected, and CISA notes the impacted devices are end-of-life and will not receive fixes. The issue is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-25), signaling confirmed exploitation in the wild, and its 82.9% EPSS score (100th percentile) indicates very high near-term exploitation likelihood; ransomware use is unknown, though router-targeting botnets such as the Mirai-based IZ1H9 are actively adding payloads for these device classes.

Do: Replace or disconnect affected D-Link and TRENDnet devices, which are end-of-life per CISA and will not receive vendor fixes; if replacement must wait, stop exposing the management interface to the internet and restrict the diagnostic/ping function to trusted networks. Review device logs and outbound traffic for signs of compromise or botnet activity (e.g., Mirai-family scanning). Because specific affected/fixed versions are not listed in the source data, confirm your model against vendor advisories before taking action.

D-Link DSL-2750B routers running firmware before 1.05 contain an unauthenticated command injection flaw (CWE-77) in the 'cli' parameter of the login.cgi web endpoint. An attacker can trigger it remotely by sending a crafted HTTP request to login.cgi with shell metacharacters embedded in the cli parameter, requiring no credentials or user interaction. Successful exploitation yields arbitrary command execution on the router, giving the attacker full control of the device, which can be used for traffic interception, persistence, or recruitment into botnets such as the Mirai-based IZ1H9 campaign noted in recent reporting. Any internet-facing DSL-2750B running affected firmware is exposed, and CISA added the issue to the Known Exploited Vulnerabilities catalog on 2024-01-08 after exploitation observed in the wild from 2016 through 2022. With a CVSS of 9.8 and an EPSS of ~65%, exploitation pressure on unpatched devices remains high.

Do: Upgrade DSL-2750B firmware to version 1.05 or later per vendor instructions; if an update is unavailable or the device is end-of-life, follow CISA's required action and discontinue use or restrict web (HTTP) management access to trusted networks only. Defenders should check device logs for suspicious unauthenticated requests to login.cgi containing shell metacharacters in the cli parameter, as these indicate exploitation attempts.

Netis WF2419 routers contain an operating-system command injection flaw (CWE-78) in the router's web management page that allows an attacker to execute arbitrary commands with root privileges. The flaw is triggered through the web management interface, where crafted input is passed to a system command without adequate sanitization, enabling unauthenticated or low-privilege access to escalate to full command execution as root. An attacker who exploits it gains complete control of the router — root-level code execution — which can be used to intercept or manipulate traffic, pivot into the local network, or enlist the device in a botnet. Any user or organization running a Netis WF2419 router is affected, with the greatest risk on devices whose web management page is reachable from the WAN/internet. Although no public proof-of-concept is known and no CVSS score is published, CISA added the issue to the Known Exploited Vulnerabilities catalog on 2021-11-03 (confirming in-the-wild exploitation; ransomware use not reported), and the 98th-percentile EPSS of 28.2% indicates an elevated probability of exploitation over the next 30 days.

Do: Upgrade WF2419 firmware to the latest release from Netis per the vendor's instructions, as required by CISA (no specific fixed firmware version is provided in this data — check with Netis). Disable or restrict WAN-side remote administration so the web management page is not reachable from the internet, and review device logs for signs of exploitation or compromise. Given the KEV listing and 98th-percentile EPSS despite the missing CVSS score, treat this as a high-priority patch for any WF2419 units in service.

CVE-2020-25506 is an operating system command injection flaw (CWE-78) in the system_mgr.cgi component of D-Link DNS-320 network-attached storage devices. An attacker can trigger it by sending crafted input to the system_mgr.cgi handler of the device's web management interface, causing attacker-controlled data to be executed as operating system commands. Successful exploitation may allow remote code execution on the NAS, giving an attacker control over the device and its stored data. Any D-Link DNS-320 running affected firmware is at risk; the available data does not specify affected or fixed version ranges. The flaw is being exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03, and current EPSS assigns roughly a 100% probability of exploitation within 30 days, though a specific ransomware association has not been confirmed.

Do: Apply D-Link firmware updates for the DNS-320 per the vendor's instructions, as required by CISA's KEV listing. Until patched, stop exposing the device's web interface to the internet (remove port forwarding/DMZ rules or restrict access to trusted management networks). Because exploitation is being observed, check NAS logs for unexpected requests to system_mgr.cgi and signs of unauthorized command execution.

CVE-2021-27561 is a critical (CVSS 9.8) unauthenticated OS command injection flaw (CWE-78) in Yealink Device Management (DM) 3.6.0.20, which CISA also characterizes as a server-side request forgery issue. A remote attacker can send a crafted, unauthenticated HTTP request to the /sm/api/v1/firewall/zone/services URI to inject operating system commands that execute with root privileges on the DM server. Successful exploitation yields full root control of the management server, allowing an attacker to pivot into the managed VoIP/UC environment, move laterally inside the network, or enroll the host in an IoT-style botnet. The flaw affects organizations running Yealink Device Management to administer fleets of Yealink IP phones, and it is trivially exploitable over the network with no user interaction. It was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03, confirming exploitation in the wild, and the recent emergence of Mirai-variant botnets targeting network devices is consistent with active mass-scanning for this class of unauthenticated injection flaw; EPSS puts the 30-day exploitation probability at roughly 83%.

Do: Upgrade Yealink Device Management to a fixed release per Yealink's instructions (the confirmed affected version is 3.6.0.20); CISA's required action is to apply vendor updates. Until patched, restrict access to the DM web interface to trusted management networks and verify it is not internet-exposed. Check access logs for unauthenticated requests to /sm/api/v1/firewall/zone/services, which would indicate probing or exploitation.

Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.

Sunhillo SureLine before version 8.7.0.1.1 contains an unauthenticated OS command injection flaw (CWE-78) in its /cgi/networkDiag.cgi web endpoint. An attacker with network access to the device's management interface can inject shell metacharacters into the ipAddr or dnsAddr parameters, causing arbitrary operating system commands to be executed with the privileges of the web service. Because no authentication or user interaction is required (CVSS 3.1: 9.8, AV:N/AC:L/PR:N/UI:N), a remote attacker can achieve full command execution, with high impact on confidentiality, integrity, and availability of the device. SureLine is Sunhillo's surveillance data distribution platform used primarily in the aviation sector (airports and air traffic control facilities), so affected users are mainly those organizations rather than the general public. CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 2024-03-05, indicating it has been observed being exploited in the wild, and a public technical advisory with a proof of concept was published by NCC Group in July 2021.

Do: Upgrade SureLine to version 8.7.0.1.1 or later. If upgrading is not immediately possible, restrict network access to the device's management interface (especially the /cgi/networkDiag.cgi endpoint) and place the unit behind a firewall or VPN rather than exposing it directly to the internet. Note that as a KEV-listed vulnerability, CISA requires applying vendor mitigations or discontinuing use of the product, so inventory any internet-exposed SureLine appliances and check logs for unexpected requests to networkDiag.cgi.

A command injection flaw (CWE-78) in the Dynamic DNS (DDNS) handling of the ncc2 binary allows unauthenticated remote attackers to execute arbitrary commands on D-Link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L routers. Because the DDNS function passes attacker-controlled input to a system shell without sanitization, a crafted request to the router's web service triggers command execution with the device's privileges (CVSS 9.8, AV:N/AC:L/PR:N/UI:N). A successful attacker gains full control of the router, enabling botnet enrollment, traffic interception, or pivoting into the local network. All hardware revisions of these five consumer/SOHO routers are affected, and because every model has reached End of Life/End of Service Life, D-Link will not issue patches. The flaw carries a 97.8% EPSS score, was added to CISA's Known Exploited Vulnerabilities catalog on 2022-04-04, and has a public proof-of-concept, indicating active in-the-wild exploitation.

Do: Replace or retire any in-use DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, or DIR-836L router, as no firmware patch will be released. If replacement must wait, disable the DDNS feature and WAN-facing remote management, and verify the admin interface is not reachable from the internet. CISA's required action is to disconnect these end-of-life devices if they are still in service.

TOTOLINK A860R V4.1.2cu.5182_B20201027 was discovered to contain a command injection via the component /cgi-bin/downloadFile.cgi.

CVE-2023-1389 is a command injection flaw (CWE-77) in TP-Link's Archer AX21 Wi-Fi 6 router that lets an attacker execute arbitrary operating-system commands on the device. It is triggered by sending crafted input to a remotely reachable service on the router, which passes attacker-controlled values to the device's shell without proper sanitization; the source data does not specify the vulnerable endpoint or exact affected firmware ranges. Successful exploitation yields remote code execution on the router, giving the attacker a foothold in the network where the router sits, from which they can pivot or abuse the device further. Any household or organization running an Archer AX21 router is affected, with the highest risk where the router's management interface is exposed to the internet. The flaw was added to CISA's KEV catalog on 2023-05-01, confirming exploitation in the wild; EPSS assigns a ~100% probability of exploitation within 30 days (top percentile), while no public proof-of-concept or ransomware association is documented in the source data.

Do: Update the Archer AX21 to the latest firmware available from TP-Link per the vendor's instructions (fixed firmware is published on the product's TP-Link support page). If updating is not immediately possible, disable WAN-side/remote management and restrict the router's web interface to the local network. Because exploitation is confirmed in the wild, also review exposed routers for signs of compromise, such as unexplained configuration changes or unexpected outbound traffic.

Korenix Jetwave 4200 Series 1.3.0 and JetWave 3000 Series 1.6.0 are vulnerable to Command Injection via /goform/formSysCmd. An attacker an modify the sysCmd parameter in order to execute commands as root.