Created on 2025-02-12 13:38 and updated on 2025-02-12 13:38.

Description

A Mirai botnet is attempting exploitation in the wild using a new set of CVEs, focusing mostly on IoT devices. Includes:

• Tenda CVE-2024-41473
• Draytek CVE-2024-12987
• HuangDou UTCMS V9 CVE-2024-9916
• Totolink CVE-2024-2353 CVE-2024-24328 CVE-2024-24329
• (likely) Four-Faith CVE-2024-9644

Source: The Shadowserver Foundation

Vulnerabilities included in this bundle

• CVE-2024-9644: Four-Faith F3x36 bapply.cgi Auth Bypass
• CVE-2024-2353:
• CVE-2024-9916:
• CVE-2024-12987:
• CVE-2024-24328:
• CVE-2024-24329:
• CVE-2024-41473:

Meta

[
   {
      ref: [
         "https://www.linkedin.com/posts/the-shadowserver-foundation_high-honeypot-http-scanner-events-report-activity-7295374394028154880-ASW-",
      ],
   },
]

Author

Cédric Bonhomme

---

Combined sightings