Malwarehigh
New Mirai botnet targets tens of flaws in popular IoT devices
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2019-12725 | Zeroshell 3.9.0 is prone to a remote command execution vulnerability | 9.8 | 90% | PoC | |
| CVE-2019-17621 | Unauthenticated Root Command Injection in D-Link DIR-859 Router UPnP | 9.8 | 91% | KEVPoC ×2 | KEV |
| CVE-2019-20500 | Authenticated OS Command Injection in D-Link DWL-2600AP Access Point Web Interface | 7.8 | 97% | KEVPoC | KEV |
| CVE-2021-25296 | Authenticated OS Command Injection in Nagios XI 5.7.5 Windows WMI Wizard | 8.8 | 72% | KEVPoC ×3 | KEV |
| CVE-2021-46422 | Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without any authentication | 9.8 | 94% | PoC ×2 | |
| CVE-2022-27002 | Arris TR3300 v1.0.13 were discovered to contain a command injection vulnerability in the ddns function via the ddns_name, ddns_pwd, h_ddns、ddns_host parameters | 9.8 | 5% | PoC | |
| CVE-2022-29303 | Unauthenticated Command Injection in Contec SolarView Compact | 9.8 | 98% | KEVPoC ×2 | KEV |
| CVE-2022-30023 | Tenda ONT GPON AC1200 Dual band WiFi HG9 v1.0.1 is vulnerable to Command Injection via the Ping function | 8.8 | 39% | PoC | |
| CVE-2022-30525 | OS Command Injection in Zyxel Firewalls Enables Remote Command Execution | 9.8 | 100% | KEVPoC ×3 | KEV |
| CVE-2022-31499 | Nortek Linear eMerge E3-Series devices before 0.32-08f allow an unauthenticated attacker to inject OS commands via ReaderNo | 9.8 | 65% | PoC ×2 | |
| CVE-2022-37061 | All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are vulnerable to Remote Command Injection | 9.8 | 100% | PoC ×5 | |
| CVE-2022-40005 | Intelbras WiFiber 120AC inMesh before 1-1-220826 allows command injection by authenticated users, as demonstrated by the /boaform/formPing6 and… | 8.8 | 35% | PoC ×2 | |
| CVE-2022-45699 | Command injection in the administration interface in APSystems ECU-R version 5203 allows a remote unauthenticated attacker to execute arbitrary commands as… | 9.8 | 77% | PoC ×2 | |
| CVE-2023-1389 | Command Injection in TP-Link Archer AX21 Router Allows Remote Code Execution | 8.8 | 100% | KEVPoC ×2 | KEV |
| CVE-2023-25280 | Unauthenticated OS Command Injection in D-Link DIR-820 Router (CVE-2023-25280) | 9.8 | 98% | KEVPoC | KEV |
| CVE-2023-27240 | Tenda AX3 V16.03.12.11 was discovered to contain a command injection vulnerability via the lanip parameter at /goform/AdvSetLanip | 9.8 | 3% | PoC |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 185.225.74.251 | er bot clients for the specific Linux architectures: hxxp://185.225.74[.]251/armv4l hxxp://185.225.74[.]251/armv5l hxxp://185.225.74[. |
| url | http://185.225.74.251/arc | 4 hxxp://185.225.74[.]251/i686 hxxp://185.225.74[.]251/i586 hxxp://185.225.74[.]251/arc hxxp://185.225.74[.]251/m68k hxxp://185.225.74[.]251/spar |
| url | http://185.225.74.251/armv4l | he proper bot clients for the specific Linux architectures: hxxp://185.225.74[.]251/armv4l hxxp://185.225.74[.]251/armv5l hxxp://185.225.74[.]251/ar |
| url | http://185.225.74.251/armv5l | pecific Linux architectures: hxxp://185.225.74[.]251/armv4l hxxp://185.225.74[.]251/armv5l hxxp://185.225.74[.]251/armv6l hxxp://185.225.74[.]251/ar |
| url | http://185.225.74.251/armv6l | xp://185.225.74[.]251/armv4l hxxp://185.225.74[.]251/armv5l hxxp://185.225.74[.]251/armv6l hxxp://185.225.74[.]251/armv7l hxxp://185.225.74[.]251/mi |
| url | http://185.225.74.251/armv7l | xp://185.225.74[.]251/armv5l hxxp://185.225.74[.]251/armv6l hxxp://185.225.74[.]251/armv7l hxxp://185.225.74[.]251/mips hxxp://185.225.74[.]251/mips |
| url | http://185.225.74.251/i586 | hxxp://185.225.74[.]251/x86_64 hxxp://185.225.74[.]251/i686 hxxp://185.225.74[.]251/i586 hxxp://185.225.74[.]251/arc hxxp://185.225.74[.]251/m68k |
| url | http://185.225.74.251/i686 | hxxp://185.225.74[.]251/sh4 hxxp://185.225.74[.]251/x86_64 hxxp://185.225.74[.]251/i686 hxxp://185.225.74[.]251/i586 hxxp://185.225.74[.]251/arc |
| url | http://185.225.74.251/m68k | 86 hxxp://185.225.74[.]251/i586 hxxp://185.225.74[.]251/arc hxxp://185.225.74[.]251/m68k hxxp://185.225.74[.]251/sparc Once executed the bot clien |
| url | http://185.225.74.251/mips | xp://185.225.74[.]251/armv6l hxxp://185.225.74[.]251/armv7l hxxp://185.225.74[.]251/mips hxxp://185.225.74[.]251/mipsel hxxp://185.225.74[.]251/sh |
| url | http://185.225.74.251/mipsel | hxxp://185.225.74[.]251/armv7l hxxp://185.225.74[.]251/mips hxxp://185.225.74[.]251/mipsel hxxp://185.225.74[.]251/sh4 hxxp://185.225.74[.]251/x86_6 |
| url | http://185.225.74.251/sh4 | hxxp://185.225.74[.]251/mips hxxp://185.225.74[.]251/mipsel hxxp://185.225.74[.]251/sh4 hxxp://185.225.74[.]251/x86_64 hxxp://185.225.74[.]251/i6 |
| url | http://185.225.74.251/sparc | 86 hxxp://185.225.74[.]251/arc hxxp://185.225.74[.]251/m68k hxxp://185.225.74[.]251/sparc Once executed the bot client, the shell script downloader |
| url | http://185.225.74.251/x86_64 | hxxp://185.225.74[.]251/mipsel hxxp://185.225.74[.]251/sh4 hxxp://185.225.74[.]251/x86_64 hxxp://185.225.74[.]251/i686 hxxp://185.225.74[.]251/i586 |
From the original article
3 min read at securityaffairs.com
Since March 2023, Unit 42 researchers have observed a variant of the Mirai botnet spreading by targeting tens of flaws in D-Link, Zyxel, and Netgear devices. Since March 2023, researchers at Palo Alto Networks Unit 42 have observed a new variant of the Mirai botnet targeting multiple vulnerabilities in popular IoT devices.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.