Mirai Botnet Variant Exploits Four-Faith Router Vulnerability for DDoS Attacks
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2014-8361 | Improper Input Validation in Realtek SDK miniigd SOAP Service Enables Remote RCE | — | 100% | KEV | — KEV |
| CVE-2016-20016 | MVPower CCTV DVR models, including TV-7104HE 1.8.4 115215B9 and TV7108HE, contain a web shell that is accessible via a /shell URI | 9.8 | 86% | PoC ×2 | |
| CVE-2017-17215 | Huawei HG532 with some customized versions has a remote code execution vulnerability | 8.8 | 78% | ||
| CVE-2017-5259 | In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, an undocumented, root-privilege administration web shell is available using the HTTP path… | 8.8 | 31% | ||
| CVE-2020-25499 | TOTOLINK A3002RU-V2.0.0 B20190814.1034 allows authenticated remote users to modify the system's 'Run Command' | 8.8 | 4% | PoC | |
| CVE-2020-9054 | Pre-Authentication OS Command Injection in Zyxel NAS Devices | 9.8 | 100% | KEVPoC | KEV |
| CVE-2021-35394 | Remote Code Execution via Memory Corruption in Realtek Jungle SDK | 9.8 | 100% | KEVPoC | KEV |
| CVE-2023-26801 | LB-LINK BL-AC1900_2.0 v1.0.1, LB-LINK BL-WR9000 v2.4.9, LB-LINK BL-X26 v1.2.5, and LB-LINK BL-LTE300 v1.0.8 were discovered to contain a command injection… | 9.8 | 78% | PoC | |
| CVE-2024-12856 | OS Command Injection in Four-Faith F3x24/F3x36 Routers | 7.2 | 84% | PoC ×2 | |
| CVE-2024-4577 | OS Command Injection in Windows PHP-CGI Allows Remote Code Execution | 9.8 | 100% | KEVRansomwarePoC ×11 | KEV |
CVE-2024-8956+1 related CVE | Authentication Bypass in PTZOptics PT30X-SDI/NDI Cameras Leaks Credentials | 9.1 group max | 59% | KEVPoC | KEV |
From the original article
2 min read at thehackernews.com
A Mirai botnet variant has been found exploiting a newly disclosed security flaw impacting Four-Faith industrial routers since early November 2024 with the goal of conducting distributed denial-of-service (DDoS) attacks. The botnet maintains approximately 15,000 daily active IP addresses, with the infections primarily scattered across China, Iran, Russia, Turkey, and the United States.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.