Malwarehigh
BotenaGo botnet targets millions of IoT devices using 33 exploits
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2013-5223 | Authenticated Cross-Site Scripting (XSS) in D-Link DSL-2760U Gateway | — | 51% | KEV | — KEV |
| CVE-2015-2051 | Remote Command Execution via HNAP GetDeviceSettings in D-Link DIR-645 Router | — | 97% | KEV | — KEV |
| CVE-2016-11021 | Authenticated OS Command Injection in D-Link DCS-930L Cameras Allows RCE | 7.2 | 70% | KEVPoC | KEV |
| CVE-2016-1555 | Unauthenticated Command Injection RCE in NETGEAR Business Wireless Access Points | 9.8 | 98% | KEVPoC | KEV |
| CVE-2016-6277 | Unauthenticated RCE via Command Injection in NETGEAR Multiple Routers | 8.8 | 100% | KEVPoC ×3 | KEV |
| CVE-2017-18368 | Unauthenticated OS Command Injection in Zyxel/Billion TrueOnline Routers | 9.8 | 95% | KEVPoC ×3 | KEV |
| CVE-2017-6077 | Command Injection RCE in NETGEAR DGN2200 Router ping.cgi | 9.8 | 69% | KEVPoC | KEV |
| CVE-2017-6334 | Authenticated OS Command Injection in NETGEAR DGN2200 dnslookup.cgi | 8.8 | 73% | KEVPoC ×3 | KEV |
| CVE-2018-10088 | Buffer overflow in XiongMai uc-httpd 1.0.0 has unspecified impact and attack vectors, a different vulnerability than CVE-2017-16725 | 9.8 | 40% | PoC ×2 | |
CVE-2018-10562+1 related CVE | Unauthenticated RCE in Dasan GPON Routers (CVE-2018-10562) | 9.8 | 100% | KEVRansomwarePoC ×2 | KEV |
| CVE-2019-19824 | On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd… | 8.8 | 25% | PoC ×4 | |
| CVE-2020-10173 | Comtrend VR-3033 DE11-416SSG-C01_R02.A2pvI042j1.d26m devices have Multiple Authenticated Command Injection vulnerabilities via the ping and traceroute… | 8.8 | 77% | PoC | |
| CVE-2020-10987 | Unauthenticated OS Command Injection in Tenda AC15 AC1900 Router | 9.8 | 80% | KEVPoC | KEV |
| CVE-2020-8515 | Unauthenticated Command Injection RCE in DrayTek Vigor3900/2960/300B Routers | 9.8 | 100% | KEVPoC | KEV |
| CVE-2020-8958 | Guangzhou 1GE ONU V2801RW 1.9.1-181203 through 2.9.0-181024 and V2804RGW 1.9.1-181203 through 2.9.0-181024 devices allow remote attackers to execute arbitrary… | 7.2 | 46% | PoC ×2 | |
| CVE-2020-9054 | Pre-Authentication OS Command Injection in Zyxel NAS Devices | 9.8 | 100% | KEVPoC | KEV |
| CVE-2020-9377 | OS Command Injection RCE in D-Link DIR-610 Routers | 8.8 | 22% | KEVPoC ×2 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 1.0.0.28 | 1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before 1.0.0.28.Beta, R7300DST before 1.0.0.46.Beta, R7900 before 1.0.1.8.B |
| ipv4 | 1.0.0.46 | 1.0.7.6.Beta, R7100LG before 1.0.0.28.Beta, R7300DST before 1.0.0.46.Beta, R7900 before 1.0.1.8.Beta, R8000 before 1.0.3.26.Beta |
| ipv4 | 1.0.1.14 | fore 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before 1.0. |
| ipv4 | 1.0.1.18 | E-2016-6277 NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7 |
| ipv4 | 1.0.1.8 | 1.0.0.28.Beta, R7300DST before 1.0.0.46.Beta, R7900 before 1.0.1.8.Beta, R8000 before 1.0.3.26.Beta, D6220, D6400, D7000 CVE-2 |
| ipv4 | 1.0.3.26 | fore 1.0.0.46.Beta, R7900 before 1.0.1.8.Beta, R8000 before 1.0.3.26.Beta, D6220, D6400, D7000 CVE-2018-10561, CVE-2018-10562 GP |
| ipv4 | 1.0.4.6 | rmware through 10.0.0.50 CVE-2016-6277 NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Bet |
| ipv4 | 1.0.7.6 | .1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before 1.0.0.28.Beta, R7300DST before 1.0.0.4 |
From the original article
3 min read at securityaffairs.com
Researchers at AT&T discovered a new BotenaGo botnet that is using thirty three exploits to target millions of routers and IoT devices. BotenaGo is a new botnet discovered by researchers at AT&T that leverages thirty three exploits to target millions of routers and IoT devices. CVE-2020-8515 DrayTek Vigor2960 1.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.