Malwaremedium
Experts warn of a surge in activity associated FICORA and Kaiten botnets
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2015-2051 | Remote Command Execution via HNAP GetDeviceSettings in D-Link DIR-645 Router | — | 97% | KEV | — KEV |
| CVE-2019-10891 | D-Link DIR-806 devices: There is a command injection in function hnap_main, which calls system() without checking the parameter that can be controlled by… | 9.8 | 19% | PoC | |
| CVE-2022-37056 | D-Link GO-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 is vulnerable to Command Injection via /cgibin, hnap_main | 9.8 | 11% | PoC | |
| CVE-2024-33112 | D-Link DIR-845L router v1.01KRb03 and before is vulnerable to Command injection via the hnap_main()func | 7.5 | 6% | PoC |
From the original article
2 min read at securityaffairs.com
FortiGuard Labs observed increased activity from two botnets, the Mirai variant “FICORA” and the Kaiten variant “CAPSAICIN”. FortiGuard Labs researchers observed a surge in activity associated with two botnets, the Mirai variant “ FICORA ” and the Kaiten variant “CAPSAICIN,” in late 2024. Both botnets target vulnerabilities in D-Link devices, particularly through the HNAP interface, allowing remote command execution.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.