35
Mirai Variant MooBot Targeting D
Unit 42 observed the MooBot Mirai variant exploiting four D-Link vulnerabilities to compromise unpatched routers for use in DDoS attacks.
Unit 42 captured attacks exploiting four D-Link remote code execution vulnerabilities: CVE-2015-2051, CVE-2018-6530, CVE-2022-26258, and CVE-2022-28958, with three rated critical at CVSS 9.8. The exploits download the MooBot malware, a Mirai botnet variant, from infrastructure at 159.203.15.179 via wget. Compromised devices fall under full attacker control and can be used for distributed denial-of-service attacks. D-Link has published bulletins for all four flaws, but unpatched devices remain exposed.
40
60
60
30
55
D-Link addressed three critical RCE in wireless router models
60
60
42
57
42
60
60
60
60
55
60
55
42
60
30
60
60
60
30
30
30
50
30
35
47
30
60
Discontinued D-Link DIR-846 routers are affected by code execution flaws. Replace them!
60
60
CISA Warns of Actively Exploited D-Link Router Vulnerabilities
60
60
CISA adds Samsung and D-link bugs to its Known Exploited Vulnerabilities catalog
60
60
55