Mirai-based botnet IZ1H9 added 13 payloads to target routers
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2015-1187 | Unauthenticated RCE via Ping Tool in D-Link and TRENDnet Routers | — | 83% | KEV | — KEV |
| CVE-2016-20017 | Unauthenticated Command Injection in D-Link DSL-2750B Router login.cgi | 9.8 | 66% | KEVPoC ×2 | KEV |
| CVE-2019-19356 | Command Injection RCE as Root in Netis WF2419 Routers | 7.5 | 28% | KEVPoC ×3 | KEV |
| CVE-2020-25506 | Command Injection in D-Link DNS-320 system_mgr.cgi Allows Remote Code Execution | 9.8 | 100% | KEVPoC | KEV |
| CVE-2021-27561 | Unauthenticated Root Command Injection in Yealink Device Management | 9.8 | 84% | KEV | KEV |
| CVE-2021-33544 | Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute… | 7.2 | 96% | PoC | |
| CVE-2021-36380 | Unauthenticated OS Command Injection in Sunhillo SureLine | 9.8 | 98% | KEVPoC | KEV |
| CVE-2021-45382 | Command Injection RCE in D-Link DIR-810L/820L/826L/830L/836L Routers | 9.8 | 98% | KEVPoC | KEV |
| CVE-2022-40475 | TOTOLINK A860R V4.1.2cu.5182_B20201027 was discovered to contain a command injection via the component /cgi-bin/downloadFile.cgi | 9.8 | 4% | PoC | |
| CVE-2023-1389 | Command Injection in TP-Link Archer AX21 Router Allows Remote Code Execution | 8.8 | 100% | KEVPoC ×2 | KEV |
| CVE-2023-23295 | Korenix Jetwave 4200 Series 1.3.0 and JetWave 3000 Series 1.6.0 are vulnerable to Command Injection via /goform/formSysCmd | 8.8 | 4% | PoC |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 3.6.0.20 | rary command execution flaws Yealink Device Management (DM) 3.6.0.20: CVE-2021-27561 / 27562 . TP-Link Archer AX21 (AX1800): CVE |
| url | http://194.180.48.100 | lities, a shell script downloader “l.sh” is downloaded from hxxp://194[.]180[.]48[.]100. Upon executing the script, it deletes logs and downl |
From the original article
2 min read at securityaffairs.com
A Mirai-based DDoS botnet tracked as IZ1H9 has added thirteen new exploits to target routers from different vendors, including D-Link, Zyxel, and TP-Link. Fortinet researchers observed a new Mirai -based DDoS botnet, tracked as IZ1H9, that added thirteen new payloads to target routers from multiple vendors, including D-Link, Zyxel, TP-Link, and TOTOLINK.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.