RondoDox Botnet Exploits Critical React2Shell Flaw to Hijack IoT Devices and Web Servers

CVE-2023-1389 is a command injection flaw (CWE-77) in TP-Link's Archer AX21 Wi-Fi 6 router that lets an attacker execute arbitrary operating-system commands on the device. It is triggered by sending crafted input to a remotely reachable service on the router, which passes attacker-controlled values to the device's shell without proper sanitization; the source data does not specify the vulnerable endpoint or exact affected firmware ranges. Successful exploitation yields remote code execution on the router, giving the attacker a foothold in the network where the router sits, from which they can pivot or abuse the device further. Any household or organization running an Archer AX21 router is affected, with the highest risk where the router's management interface is exposed to the internet. The flaw was added to CISA's KEV catalog on 2023-05-01, confirming exploitation in the wild; EPSS assigns a ~100% probability of exploitation within 30 days (top percentile), while no public proof-of-concept or ransomware association is documented in the source data.

Do: Update the Archer AX21 to the latest firmware available from TP-Link per the vendor's instructions (fixed firmware is published on the product's TP-Link support page). If updating is not immediately possible, disable WAN-side/remote management and restrict the router's web interface to the local network. Because exploitation is confirmed in the wild, also review exposed routers for signs of compromise, such as unexplained configuration changes or unexpected outbound traffic.

XWiki Platform contains an eval injection flaw (CWE-95) that allows any unauthenticated guest user to execute arbitrary code on the hosting server. An attacker triggers the flaw by sending a crafted request to the platform's SolrSearch functionality, which evaluates attacker-controlled input without authentication. Successful exploitation yields arbitrary remote code execution with the privileges of the wiki application, potentially enabling full server compromise. Any deployment of XWiki Platform is affected, with internet-exposed wikis at the highest risk; the affected version ranges are not specified in the available data. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-10-30, indicating confirmed in-the-wild exploitation (ransomware use unconfirmed), and EPSS assigns a ~99.9% probability of exploitation within 30 days.

Do: Upgrade to a patched XWiki Platform release per the vendor's security advisory (fixed version numbers not provided in the available data); as interim mitigation, restrict untrusted access to the SolrSearch endpoint and review access logs for anomalous search requests and post-exploitation indicators such as unusual application-server child processes, new files, or webshells. The 2025-10-30 KEV listing makes remediation mandatory for U.S. federal agencies under BOD 22-01, and given the unauthenticated RCE with near-certain exploitation probability, internet-exposed wikis should be patched urgently.

CVE-2025-55182 is a critical (CVSS 10.0) pre-authentication remote code execution flaw (CWE-502, deserialization of untrusted data) in React Server Components, specifically the react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack packages in versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0. It is triggered when the vulnerable code unsafely deserializes payloads from HTTP requests sent to Server Function endpoints, requiring no authentication or user interaction. An attacker gains arbitrary code execution on the affected server (CVSS scope changed, with high impact to confidentiality, integrity, and availability), and reporting notes a campaign in which hackers used the flaw to breach 766 Next.js hosts and steal credentials. Any React/Next.js application exposing Server Functions with the affected React versions is in scope, which given the ubiquity of React and Next.js is a very large deployed base. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-12-05 with known ransomware use, EPSS puts the 30-day exploitation probability at 99.8%, multiple public PoC/scanner repositories are available, and coverage has dubbed the flaw React2Shell.

Do: Upgrade the react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages to the vendor-patched releases (any version later than the vulnerable 19.0.0, 19.1.0, 19.1.1, and 19.2.0 line) and update Next.js per Vercel's advisory; as a KEV entry, U.S. federal agencies must apply vendor mitigations per BOD 22-01 or discontinue use. Audit internet-exposed Server Function endpoints for the vulnerable React versions and review logs for exploitation activity, including the reported campaign that breached 766 Next.js hosts and stole credentials, then rotate any exposed credentials.