AndroxGh0st Malware Integrates Mozi Botnet to Target IoT and Cloud Services

CVE-2014-2120 is a cross-site scripting (CWE-79) vulnerability in the WebVPN login page of the Cisco Adaptive Security Appliance (ASA). A remote, unauthenticated attacker can inject arbitrary web script or HTML through an unspecified parameter of that login page, which is then rendered by a victim's browser. Successful exploitation lets the attacker execute script in the user's browser context, enabling actions such as credential capture, session manipulation, or phishing within the trusted WebVPN page. Only organizations running Cisco ASA devices with the WebVPN (clientless SSL VPN) login page exposed are affected. Despite the flaw's 2014 disclosure, CISA added it to the Known Exploited Vulnerabilities catalog on 2024-11-12, indicating active exploitation, with no public proof-of-concept code identified.

Do: Inventory ASA devices and determine whether the WebVPN/clientless SSL VPN login page is enabled and reachable by untrusted users. Upgrade to the fixed releases specified in Cisco's advisory, per the CISA KEV required action, or disable WebVPN if it is not needed. Where mitigations are unavailable, CISA directs organizations to discontinue use of the affected product, so prioritize this for internet-facing VPN endpoints.

PHPUnit ships a utility script (eval-stdin.php under /vendor/phpunit/phpunit/src/Util/PHP/) that reads HTTP POST data and evaluates it as PHP code with no authentication. The flaw is triggered when a site's /vendor folder is web-accessible and an attacker sends a POST request whose body begins with '<?php ' directly to that URI. Doing so lets the attacker execute arbitrary PHP code on the server under the web server account, giving unauthenticated remote code execution (CWE-94 code injection). Anyone running a PHP application installed with Composer, where PHPUnit is present in the vendor tree and that directory is reachable over HTTP, is affected. The flaw is under active exploitation: CISA added it to the Known Exploited Vulnerabilities catalog on 2022-02-15 and its EPSS probability of exploitation is 100% (top percentile).

Do: Apply the CISA KEV required action by updating PHPUnit per vendor instructions, which in practice means updating the CMS/framework or running a Composer update that pulls a patched PHPUnit release. Until patched, block web access to the /vendor directory (e.g., deny /vendor/ or at least /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php in your web server configuration) and verify the endpoint is no longer reachable. Check access logs for POST requests to eval-stdin.php and investigate affected servers for webshells or other signs of compromise.

CVE-2018-10562 is an OS command injection flaw (CWE-78) in the web management interface of Dasan GPON home routers. When chained with the companion authentication bypass CVE-2018-10561, a remote, unauthenticated attacker can send crafted requests that execute arbitrary commands on the device. Successful exploitation yields full control of the router, enabling device takeover, botnet enrollment, and, per CISA, use in ransomware operations. Anyone operating an affected Dasan GPON router — many of which were deployed by internet service providers — is affected, and CISA notes the impacted products are end-of-life. Exploitation is confirmed in the wild: the flaw is in CISA's KEV (added 2022-03-31) with known ransomware use and a 100% EPSS probability of exploitation within 30 days.

Do: Because the product line is end-of-life and CISA's required action is to disconnect impacted devices if still in use, retire or replace affected routers rather than patching in place. If replacement must wait, block or firewall the web management interface from the internet, check the device for signs of compromise, and ensure the related authentication-bypass path CVE-2018-10561 is also closed.

CVE-2018-15133 is a PHP deserialization flaw (CWE-502) in Laravel Framework versions through 5.5.40 and 5.6.x through 5.6.29: the decrypt method in Illuminate/Encryption/Encrypter.php passes the decrypted X-XSRF-TOKEN header value to unserialize, enabling PHP object injection via the PendingBroadcast gadget chain. A remote attacker triggers it by sending a crafted X-XSRF-TOKEN header, but only if they know the application's APP_KEY, which typically happens because the key was leaked (e.g., committed to public GitHub repositories) or reused across deployments. Successful exploitation yields remote code execution on the web server with high impact to confidentiality, integrity, and availability; in current campaigns the AndroxGh0st malware exploits this flaw to steal AWS, Azure, and Office 365 credentials and now also distributes Mozi botnet payloads. Any Laravel 5.5.x or 5.6.x application within the affected ranges is exposed, with practical risk concentrated on apps whose APP_KEY has been exposed or shared. Exploitation is confirmed in the wild: CISA added the flaw to the KEV catalog on 2024-01-16, EPSS puts the 30-day exploitation probability at about 77%, and public scanning has already identified 600+ Laravel apps with leaked APP_KEYs on GitHub.

Do: Upgrade Laravel Framework to a release later than 5.6.29 (latest patched 5.6.x or a supported major version) per vendor guidance; CISA's KEV required action is to apply vendor mitigations or discontinue use of the product if mitigations are unavailable. Because exploitation requires knowing the APP_KEY, audit and rotate the key, remove it from public repositories and exposed .env files, and hunt for AndroxGh0st activity (suspicious processes, outbound credential theft) on Laravel hosts.

Atlassian Jira Server and Data Center contain a path traversal flaw (CWE-22) in the /WEB-INF/web.xml endpoint that lets a remote attacker read particular files by sending crafted requests containing traversal sequences. Triggering requires only HTTP access to the affected endpoint on a vulnerable, self-hosted Jira instance; an attacker gains disclosure of specific files, an information-exposure condition that can aid further reconnaissance rather than full system compromise. Organizations running self-hosted Jira Server or Data Center are affected, while Atlassian Cloud is out of scope of this product listing. Exploitation is confirmed by CISA's inclusion of the bug in the Known Exploited Vulnerabilities catalog on 2024-11-12, and a top-percentile EPSS score of 100% indicates near-certain exploitation activity within 30 days; no public proof-of-concept is cataloged and ransomware association is listed as unknown.

Do: Upgrade self-hosted Jira Server and Data Center to the fixed releases specified in Atlassian's advisory for CVE-2021-26086, since the provided data does not include exact version ranges. Audit internet-facing Jira instances for access to the /WEB-INF/web.xml endpoint and restrict or front-end Jira with access controls where patching must be delayed. Federal agencies must apply the vendor mitigation or discontinue use per the CISA KEV required action.

Metabase, an open source data analytics and business intelligence platform, does not validate URLs supplied to its custom GeoJSON map feature, resulting in a local file inclusion flaw (CWE-22/CWE-200). A remote, unauthenticated attacker can abuse the GeoJSON API to read arbitrary files on the Metabase server, including environment variables that frequently contain database credentials and API keys. Any organization running an affected Metabase release with the application reachable by attackers is exposed; the CVSS vector (AV:N/PR:N, C:H) reflects unauthenticated network exploitation with high confidentiality impact. Exploitation is confirmed in the wild: the flaw carries a 97.2% EPSS score (100th percentile) and was added to CISA's Known Exploited Vulnerabilities catalog on 2024-11-12, though no public proof-of-concept is catalogued in the available data.

Do: Upgrade Metabase to 0.40.5 (open source) or 1.40.5 (enterprise) or any later release. If upgrading immediately is not possible, add URL-validation rules on your reverse proxy, load balancer, or WAF to filter requests to the GeoJSON API. Audit environment variables on Metabase hosts for sensitive secrets and review access logs for unexpected GeoJSON API requests, rotating any exposed credentials as a precaution.

Apache HTTP Server contains a path traversal flaw (CWE-22) that lets crafted HTTP requests reach files outside directories configured via Alias-like directives. When files outside those aliased directories are not protected by the default 'require all denied' policy, attackers can read arbitrary files outside the intended root, and if CGI scripts are enabled the traversal can be escalated to remote code execution under the web server account. Anyone running an affected Apache HTTP Server release with such a configuration is exposed; the initial 2.4.50 patch was incomplete, so the flaw's full remediation is tracked under CVE-2021-42013. Exploitation is confirmed in the wild: CISA added the vulnerability to the KEV catalog on 2021-11-03 with known ransomware use, and EPSS assigns a ~100% probability of exploitation within 30 days (100th percentile).

Do: Upgrade to Apache HTTP Server 2.4.51 or later; do not stop at 2.4.50, since its fix was incomplete (see CVE-2021-42013). As an interim mitigation, ensure directories referenced by Alias-like directives are covered by 'require all denied' and disable or restrict CGI (mod_cgi/mod_cgid) on traversable paths. Review access logs for traversal patterns such as /icons/../ and unexpected CGI invocations, and hunt for webshells or ransomware staging given the known ransomware use.

CVE-2022-1040 is a critical authentication bypass in the User Portal and Webadmin of Sophos Firewall (SFOS) version v18.5 MR3 and older. A remote, unauthenticated attacker who can reach either web-facing service bypasses authentication and executes code on the firewall appliance. Successful exploitation yields full device compromise (CVSS 9.8 with high confidentiality, integrity, and availability impact), enabling traffic interception, persistence, and pivoting into the protected network. Any organization running an affected Sophos Firewall version where the User Portal or Webadmin is reachable, especially from the internet, is exposed. Exploitation is confirmed in the wild: it was exploited as a zero-day in March 2022, added to CISA's Known Exploited Vulnerabilities Catalog on 2022-03-31, and used in campaigns attributed to Chinese actors, including a U.S. indictment of a Chinese hacker for exploiting the flaw.

Do: Upgrade Sophos Firewall to a fixed release (v18.5 MR4 or later, per Sophos' patch instructions). Until patched, restrict access to the User Portal and Webadmin to trusted management networks or VPN clients and remove any direct internet exposure to these services. Review device and authentication logs for signs of exploitation, including unexpected or modified administrator accounts and configuration changes, and follow the vendor/CISA required action to apply updates.

Oracle E-Business Suite versions 12.2.3 through 12.2.11 contain a critical, unauthenticated arbitrary file upload flaw (CWE-306, missing authentication) in the Upload component of the Web Applications Desktop Integrator. Because exploitation requires no credentials and no user interaction, any attacker with HTTP network access to the affected component can trigger the flaw remotely and achieve takeover of Oracle Web Applications Desktop Integrator, with high impact on confidentiality, integrity, and availability (CVSS 3.1 score 9.8). Organizations running any affected E-Business Suite 12.2 release are exposed, particularly where EBS interfaces are reachable from the internet. The flaw is being actively exploited: it was added to CISA's Known Exploited Vulnerabilities Catalog on 2023-02-02 with known ransomware use, EPSS assigns a 98.3% probability of exploitation within 30 days, and exploitation attempts were observed after a public proof-of-concept was released.

Do: Apply the Oracle Critical Patch Update that addresses CVE-2022-21587 (October 2022 CPU or later) on all E-Business Suite 12.2.3-12.2.11 systems, per CISA's required action. Until patched, restrict internet access to EBS, especially the Web Applications Desktop Integrator upload endpoints, and review logs and uploaded-file locations for signs of exploitation. Prioritize remediation given confirmed active exploitation and ransomware use.

CVE-2022-22947 is a code injection (Spring Expression Language injection) flaw in VMware Spring Cloud Gateway that allows arbitrary remote code execution when the Gateway Actuator endpoint is enabled, exposed, and unsecured. A remote, unauthenticated attacker can send a maliciously crafted request (typically a crafted POST to the gateway actuator routes endpoint) that is evaluated as code, letting the attacker run arbitrary commands on the host. The CVSS 3.1 score is 10.0 (critical) because exploitation is network-based, requires no privileges or user interaction, and impacts confidentiality, integrity, and availability beyond the vulnerable component. All Spring Cloud Gateway deployments prior to 3.1.1/3.0.7 are affected, along with Oracle products that embed the component, including Commerce Guided Search and multiple Oracle Communications Cloud Native Core functions. Exploitation is confirmed: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-05-16, EPSS puts the 30-day exploitation probability at 98.3% (100th percentile), public PoC exploits exist, and related reporting describes botnets adding Spring Cloud Gateway exploits to their attack tooling.

Do: Upgrade Spring Cloud Gateway to 3.1.1 or later, or to 3.0.7 or later on the 3.0.x line, per VMware's advisory, and apply the relevant Oracle Critical Patch Update for affected Oracle Commerce Guided Search and Communications Cloud Native Core products. If you cannot patch immediately, disable or restrict the Gateway Actuator endpoint so it is not reachable over the network without authentication. Scan for exposed gateway actuator endpoints and review hosts for signs of command execution; this flaw is on CISA's KEV list, which requires applying updates per vendor instructions.

CVE-2023-1389 is a command injection flaw (CWE-77) in TP-Link's Archer AX21 Wi-Fi 6 router that lets an attacker execute arbitrary operating-system commands on the device. It is triggered by sending crafted input to a remotely reachable service on the router, which passes attacker-controlled values to the device's shell without proper sanitization; the source data does not specify the vulnerable endpoint or exact affected firmware ranges. Successful exploitation yields remote code execution on the router, giving the attacker a foothold in the network where the router sits, from which they can pivot or abuse the device further. Any household or organization running an Archer AX21 router is affected, with the highest risk where the router's management interface is exposed to the internet. The flaw was added to CISA's KEV catalog on 2023-05-01, confirming exploitation in the wild; EPSS assigns a ~100% probability of exploitation within 30 days (top percentile), while no public proof-of-concept or ransomware association is documented in the source data.

Do: Update the Archer AX21 to the latest firmware available from TP-Link per the vendor's instructions (fixed firmware is published on the product's TP-Link support page). If updating is not immediately possible, disable WAN-side/remote management and restrict the router's web interface to the local network. Because exploitation is confirmed in the wild, also review exposed routers for signs of compromise, such as unexplained configuration changes or unexpected outbound traffic.

CVE-2023-25717 is a command-injection flaw (CWE-94) in Ruckus Wireless Admin through version 10.4, the management interface used with Ruckus/CommScope SmartZone controllers. An unauthenticated attacker triggers it by sending a crafted HTTP GET request to /forms/doLogin, injecting shell commands (e.g., $(curl ...) substrings) into the login_username or password parameters, which the device executes. Successful exploitation yields remote code execution with full compromise of the management interface, and the same code path is also tied to CSRF/SSRF issues. Any organization running an internet-exposed Ruckus Wireless Admin or SmartZone management endpoint is affected, and the flaw has been actively exploited in the wild — botnet campaigns (notably Andoryu) used it to recruit devices, and CISA added it to the Known Exploited Vulnerabilities catalog on 2023-05-12; EPSS puts the 30-day exploitation probability at 98.1%.

Do: Apply vendor updates per Ruckus/CommScope instructions for Wireless Admin (beyond 10.4) and SmartZone firmware, and per CISA KEV guidance disconnect any product that is end-of-life if it cannot be patched. Restrict the management interface so /forms/doLogin is not reachable from the internet, and review access logs for unauthenticated GET requests containing shell syntax such as $( ) in the login_username or password parameters to detect prior exploitation.

OSGeo GeoServer ships the GeoTools library, which evaluates feature property names directly as XPath expressions without proper neutralization (CWE-95), so attacker-supplied input is executed as code rather than treated as data. A remote, unauthenticated attacker triggers the flaw by sending specially crafted requests to a GeoServer service, causing the injected expression to be evaluated in the server's context. Successful exploitation results in remote code execution on the host running GeoServer, giving the attacker control over the mapping server and any data or credentials it can reach. Any organization running GeoServer is affected, and the underlying GeoTools flaw also extends to dependent applications such as GeoNetwork, which shipped its own fix for an unauthenticated RCE chain affecting government geoportal backends. The flaw is being actively exploited: it was added to CISA KEV on 2024-07-15, and EPSS assigns a 99.8% probability of exploitation within 30 days.

Do: Upgrade GeoServer to the fixed releases identified in the OSGeo advisory (2.23.6, 2.24.4 or 2.25.2, or later); where upgrading is not immediately possible, restrict access to GeoServer's public endpoints per vendor mitigations or discontinue use of the product per the KEV required action. Organizations running GeoNetwork or other GeoTools-based applications should apply those vendors' fixes as well. Given active exploitation, hunt for signs of compromise such as unexpected child processes spawned by the GeoServer Java process, new files or services on the host, and unusual map/feature service request patterns.

CVE-2024-4577 is an OS command injection flaw (CWE-78) in Windows-based PHP when it runs in CGI mode, allowing arbitrary code execution on the server. It is triggered when attacker-supplied characters in HTTP requests are mishandled by Windows' character-encoding conversion as the OS invokes php-cgi, letting attackers inject command-line arguments to the PHP interpreter; this bypasses the decade-old fix for CVE-2012-1823. A successful attacker gains the ability to run arbitrary commands and code in the context of the web server. Affected systems are PHP running on Windows through the CGI interface; deployments that do not use PHP-CGI on Windows are not described as affected in the source data. Exploitation is active: the flaw was added to CISA KEV on 2024-06-12 with known ransomware use, and EPSS assigns roughly 100% probability of exploitation within 30 days.

Do: Per the CISA KEV required action, apply mitigations per vendor instructions or discontinue use: upgrade Windows PHP-CGI deployments to a PHP release that fixes CVE-2024-4577 per PHP Group advisories, or stop using CGI mode on Windows (e.g., switch to FastCGI) and apply any vendor-recommended workarounds. Given known ransomware abuse, review web server access logs for exploitation attempts (notably %AD-encoded soft hyphens and injected -d/-s arguments in php-cgi query strings) and prioritize patching internet-facing Windows hosts.