Matrix Unleashes A New Widespread DDoS Campaign

aquasec.com · 26 Nov 2024 · Licence: not cleared; local research copy only

CVEs this report names

11 CVEs

CVE-2018-10561Dasan GPON Routers Authentication Bypass Vulnerability
Dasan · Gigabit Passive Optical Network (GPON) RoutersKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1078Valid Accounts2 reports
92.8%Top 0.17%
86.0priority
CVE-2022-30525Zyxel Multiple Firewalls OS Command Injection Vulnerability
Zyxel · Multiple FirewallsKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter2 reports
99.9%Top 0.03%
86.0priority
CVE-2018-10562Dasan GPON Routers Command Injection Vulnerability
Dasan · Gigabit Passive Optical Network (GPON) RoutersKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter1 report
99.9%Top 0.03%
83.7priority
CVE-2014-8361Realtek SDK Improper Input Validation Vulnerability
Realtek · SDKKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter2 reports
>99.9%Top 0.02%
76.0priority
CVE-2018-9995TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR…
Public exploitT1190Exploit Public-Facing Application T1078Valid Accounts1 report
82.3%Top 0.34%
76.0priority
CVE-2017-18368Zyxel P660HN-T1A Routers Command Injection Vulnerability
Zyxel · P660HN-T1A RoutersKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter1 report
94.5%Top 0.15%
73.7priority
CVE-2021-20090Arcadyan Buffalo Firmware Path Traversal Vulnerability
Arcadyan · Buffalo FirmwareKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1078Valid Accounts1 report
>99.9%Top 0.02%
73.7priority
CVE-2024-27348Apache HugeGraph-Server Improper Access Control Vulnerability
Apache · HugeGraph-ServerKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter1 report
99.2%Top 0.07%
73.7priority
CVE-2017-17215Huawei HG532 with some customized versions has a remote code execution vulnerability
Huawei Technologies Co., Ltd. · HG532Public exploitT1190Exploit Public-Facing Application T1059Command and Scripting Interpreter2 reports
78.3%Top 0.42%
69.0priority
CVE-2017-17106Credentials for Zivif PR115-204-P-RS V2.3.4.2103 Webcams can be obtained by an unauthenticated remote attacker using a…
Public exploit2 reports
15.3%Top 3.2%
67.8priority
CVE-2022-30075In TP-Link Router AX50 firmware 210730 and older, import of a malicious backup file via web interface can lead to…
Public exploit1 report
34.6%Top 1.6%
65.5priority

Where it names them

CVE-2018-10561

However, the majority of the vulnerabilities center around IoT devices (CVE-2022-30525, CVE-2022-30075, CVE-2018-10562, CVE-2018-10561, CVE-2018-9995, CVE-2017-18368, CVE-2017-17215, CVE-2017-17106, and CVE-2014-8361).

Original ↗

CVE-2018-10561: This vulnerability allows attackers to bypass authentication on GPON (Gigabit-capable Passive Optical Networks) routers using the Boa web server by appending certain parameters to the URL.

Original ↗

CVE-2022-30525

However, the majority of the vulnerabilities center around IoT devices (CVE-2022-30525, CVE-2022-30075, CVE-2018-10562, CVE-2018-10561, CVE-2018-9995, CVE-2017-18368, CVE-2017-17215, CVE-2017-17106, and CVE-2014-8361).

Original ↗

CVE-2022-30525: A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware.

Original ↗

CVE-2018-10562

However, the majority of the vulnerabilities center around IoT devices (CVE-2022-30525, CVE-2022-30075, CVE-2018-10562, CVE-2018-10561, CVE-2018-9995, CVE-2017-18368, CVE-2017-17215, CVE-2017-17106, and CVE-2014-8361).

Original ↗

CVE-2018-10562: This vulnerability enables command injection on GPON (Gigabit-capable Passive Optical Networks) routers using the Boa web server through the Boa web server’s administrative interface.

Original ↗

CVE-2014-8361

However, the majority of the vulnerabilities center around IoT devices (CVE-2022-30525, CVE-2022-30075, CVE-2018-10562, CVE-2018-10561, CVE-2018-9995, CVE-2017-18368, CVE-2017-17215, CVE-2017-17106, and CVE-2014-8361).

Original ↗

CVE-2014-8361: affects routers with the Universal Plug and Play (UPnP) service exposed, specifically through the AddPortMapping action of the WANIPConnection service.

Original ↗

CVE-2018-9995

However, the majority of the vulnerabilities center around IoT devices (CVE-2022-30525, CVE-2022-30075, CVE-2018-10562, CVE-2018-10561, CVE-2018-9995, CVE-2017-18368, CVE-2017-17215, CVE-2017-17106, and CVE-2014-8361).

Original ↗

CVE-2018-9995: Targeting Digital Video Recorders (DVRs) to exploit weaknesses in certain DVR devices that use the Hi3520 platform.

Original ↗

CVE-2017-18368

Router Vulnerabilities: Attacks on routers, including ZTE and GPON models, exploit vulnerabilities such as CVE-2017-18368, a command injection flaw, and CVE-2021-20090, which affects various devices running Arcadyan firmware.

Original ↗

However, the majority of the vulnerabilities center around IoT devices (CVE-2022-30525, CVE-2022-30075, CVE-2018-10562, CVE-2018-10561, CVE-2018-9995, CVE-2017-18368, CVE-2017-17215, CVE-2017-17106, and CVE-2014-8361).

Original ↗

CVE-2017-18368: Involves a command injection vulnerability in ZTE routers, where attackers can exploit endpoints similar to those shown above, using them to inject malicious commands and gain control over the device.

Original ↗

CVE-2021-20090

Router Vulnerabilities: Attacks on routers, including ZTE and GPON models, exploit vulnerabilities such as CVE-2017-18368, a command injection flaw, and CVE-2021-20090, which affects various devices running Arcadyan firmware.

Original ↗

Exploit Public-Facing Application: Exploits vulnerabilities in IoT devices, routers, and servers such as HugeGraph (CVE-2024-27348) and Arcadyan firmware (CVE-2021-20090).

Original ↗

CVE-2024-27348

The most recent CVE, CVE-2024-27348, involves HugeGraph and represents a critical vulnerability published in April 2024.

Original ↗

Exploit Public-Facing Application: Exploits vulnerabilities in IoT devices, routers, and servers such as HugeGraph (CVE-2024-27348) and Arcadyan firmware (CVE-2021-20090).

Original ↗

CVE-2024-27348: Exploiting a vulnerability in Apache HugeGraph Server, specifically a hypothetical, which may allow for Remote Code Execution (RCE) via the Gremlin server endpoint.

Original ↗

CVE-2017-17215

However, the majority of the vulnerabilities center around IoT devices (CVE-2022-30525, CVE-2022-30075, CVE-2018-10562, CVE-2018-10561, CVE-2018-9995, CVE-2017-18368, CVE-2017-17215, CVE-2017-17106, and CVE-2014-8361).

Original ↗

CVE-2017-17215: A remote code execution vulnerability affecting certain Huawei routers.

Original ↗

CVE-2017-17106

However, the majority of the vulnerabilities center around IoT devices (CVE-2022-30525, CVE-2022-30075, CVE-2018-10562, CVE-2018-10561, CVE-2018-9995, CVE-2017-18368, CVE-2017-17215, CVE-2017-17106, and CVE-2014-8361).

Original ↗

CVE-2017-17106: Credentials for Zivif PR115-204-P-RS V2.3.4.2103 Webcams can be obtained by an unauthenticated remote attacker using a standard web /cgi-bin/hi3510/param.cgi?cmd=getuser HTTP request.

Original ↗

CVE-2022-30075

However, the majority of the vulnerabilities center around IoT devices (CVE-2022-30525, CVE-2022-30075, CVE-2018-10562, CVE-2018-10561, CVE-2018-9995, CVE-2017-18368, CVE-2017-17215, CVE-2017-17106, and CVE-2014-8361).

Original ↗

CVE-2022-30075: This CVE affects specific TP-Link routers, allowing unauthenticated users to manipulate configuration parameters, potentially injecting commands.

Original ↗

Techniques drawn from this report

2 links, in kill-chain order

Initial Access Exploit Public-Facing Application T1190 for CVE-2024-27348

AI mapping from the description

Exploit Public-Facing Application: Exploits vulnerabilities in IoT devices, routers, and servers such as HugeGraph (CVE-2024-27348) and Arcadyan firmware (CVE-2021-20090).

Original ↗

Initial Access Exploit Public-Facing Application T1190 for CVE-2021-20090

AI mapping from the description

Exploit Public-Facing Application: Exploits vulnerabilities in IoT devices, routers, and servers such as HugeGraph (CVE-2024-27348) and Arcadyan firmware (CVE-2021-20090).

Original ↗