AWS: China-linked threat actors weaponized React2Shell hours after disclosure
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-1338 | Remote Command Injection in NUUO Camera Web Interface NUUO Camera devices running builds up to 20250203 contain a critical command injection flaw (CWE-74/CWE-77) in the print_file function of /handle_config.php. The log parameter passed to this endpoint is not properly sanitized, so an unauthenticated remote attacker can submit crafted input that is executed as operating-system commands on the device. Successful exploitation can give the attacker control of the surveillance appliance, access to camera streams and recorded footage, and a foothold to pivot into the network it monitors. Any NUUO Camera deployment with a build dated on or before 2025-02-03 is affected, and the vendor was notified but has not responded. Exploit details have been publicly disclosed, the flaw is not yet in CISA KEV, and there are no confirmed reports of in-the-wild exploitation, though EPSS assigns a high (~51%) probability of exploitation within 30 days. Do: Check NUUO's website and support channels for a patched release newer than build 20250203 — the vendor was contacted but did not respond, so a fix may lag. Until a patch is available, restrict internet exposure of the device's web interface (allow only trusted management networks or place it behind a VPN), and use a WAF or reverse proxy to validate or restrict the log parameter on /handle_config.php. Review device and perimeter logs for unexpected command execution or connections to the web interface from unknown sources. | 6.9 | 51% |
| large≈ tens of thousands of internet-exposed NUUO Camera/NVR systems | ||
| CVE-2025-55182 | Unauthenticated RCE in React Server Components (React2Shell) CVE-2025-55182 is a critical (CVSS 10.0) pre-authentication remote code execution flaw (CWE-502, deserialization of untrusted data) in React Server Components, specifically the react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack packages in versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0. It is triggered when the vulnerable code unsafely deserializes payloads from HTTP requests sent to Server Function endpoints, requiring no authentication or user interaction. An attacker gains arbitrary code execution on the affected server (CVSS scope changed, with high impact to confidentiality, integrity, and availability), and reporting notes a campaign in which hackers used the flaw to breach 766 Next.js hosts and steal credentials. Any React/Next.js application exposing Server Functions with the affected React versions is in scope, which given the ubiquity of React and Next.js is a very large deployed base. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-12-05 with known ransomware use, EPSS puts the 30-day exploitation probability at 99.8%, multiple public PoC/scanner repositories are available, and coverage has dubbed the flaw React2Shell. Do: Upgrade the react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages to the vendor-patched releases (any version later than the vulnerable 19.0.0, 19.1.0, 19.1.1, and 19.2.0 line) and update Next.js per Vercel's advisory; as a KEV entry, U.S. federal agencies must apply vendor mitigations per BOD 22-01 or discontinue use. Audit internet-exposed Server Function endpoints for the vulnerable React versions and review logs for exploitation activity, including the reported campaign that breached 766 Next.js hosts and stole credentials, then rotate any exposed credentials. | 10.0 | 100% | KEV ransomware PoC ×7 |
| mass≈1M+ internet-facing Next.js/React Server Components deployments (order-of-magnitude estimate) |
Full article527 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
December 08, 2025
Multiple China-linked threat actors began exploiting the CVE-2025-55182, aka React2Shell flaw, within hours, AWS Security warns.
Multiple China-linked threat actors began exploiting the CVE-2025-55182, also known as the React2Shell flaw, within hours, according to AWS Security. The researchers confirmed that this vulnerability doesn’t affect AWS services, however they opted to share threat intelligence data to help customers running React or Next.js applications in their own environments take immediate action.
The vulnerability is a pre-authentication remote code execution vulnerability in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The flaw comes from the code deserializing data from HTTP requests to Server Function endpoints without proper safety checks.
“A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack.” reads the advisory. “The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.”
The researcher Lachlan Davidson reported the security vulnerability in React on November 29th. He explained that unsafe payload decoding in Server Function endpoints allows unauthenticated code execution. Apps using React Server Components may be exposed even without Server Function endpoints.
Versions 19.0.1, 19.1.2, and 19.2.1 addressed the flaw.
AWS Security observed exploitation attempts in AWS MadPot coming from infrastructure tied to China-linked groups Earth Lamia and Jackpot Panda. Earth Lamia typically exploits web app flaws to target organizations across LATAM, the Middle East, and Southeast Asia, while Jackpot Panda focuses on East and Southeast Asia for intelligence tied to security and corruption. Both operate through large shared anonymization networks widely used in Chinese cyber operations, which mask attacker identity and make precise attribution difficult.
“Our analysis of exploitation attempts in AWS MadPot honeypot infrastructure has identified exploitation activity from IP addresses and infrastructure historically linked to known China state-nexus threat actors.” reads the report published by AWS Security. “Large-scale anonymization networks have become a defining characteristic of Chinese cyber operations, enabling reconnaissance, exploitation, and command-and-control activities while obscuring attribution. These networks are used by multiple threat groups simultaneously, making it difficult to attribute specific activities to individual actors.”
Most unattributed activity uses China-linked ASNs, indicating the region as the main source. Groups rapidly weaponize public PoCs as soon as they appear online.
Threat actors use automated scanners and PoC exploits to target CVE-2025-55182 and other N-days like CVE-2025-1338, rapidly integrating public exploits and running broad multi-CVE campaigns. Many public PoCs are flawed, yet still used, reflecting a focus on speed, volume, and low entry barriers. Failed attempts create significant log noise, potentially masking more sophisticated attacks.
“Analysis of data from MadPot reveals the persistent nature of these exploitation attempts. In one notable example, an unattributed threat cluster associated with IP address 183[.]6.80.214 spent nearly an hour (from 2:30:17 AM to 3:22:48 AM UTC on December 4, 2025) systematically troubleshooting exploitation attempts.” concludes the report. “This behavior demonstrates that threat actors aren’t just running automated scans, but are actively debugging and refining their exploitation techniques against live targets.”
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, newsletter)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/185436/security/aws-china-linked-threat-actors-weaponized-react2shell-hours-after-disclosure.html