170 casos · pág. 5/9
F5 Labs honeynet telemetry shows overall hostile activity rising 55.5% month over month in June 2026, a return to the levels of the earlier-year spike. Highlighted is CVE-2024-44000, an unauthenticated account takeover flaw (CVSS 9.8, CWE-522) in the LiteSpeed Cache WordPress plugin, which rose by 1,128 to 2,603 attacks (8). Scanning is i…
F5 Labs, using attack telemetry from Efflux's global sensor network, analyzed the most exploited vulnerabilities in July 2025 and found that nearly all top-scanned CVEs are HTTP-based RCE or command injection flaws in web interfaces. CVE-2017-9841 (PHPUnit) was the most exploited, followed by CVE-2023-1389 (TP-Link Archer AX21), CVE-2022-…
F5 Labs, using Efflux sensor telemetry, reports a campaign that began on 2025-06-08. One actor is exploiting TP-Link AX21 routers (CVE-2023-1389, command injection in the country query parameter) and Raisecom web interfaces (CVE-2024-7120) to deliver a new malware family named NoBooze1. Four source IPs and three stage-one hosts were rotat…
F5 Labs, using Efflux sensor telemetry, analyzed December 2025 exploitation of React2Shell (CVE-2025-55182), a CVSS 10.0 unsafe deserialization RCE in React Server Components. It was disclosed on 3 December 2025 and rose to second place among the most exploited CVEs, behind only CVE-2017-9841. Within days of disclosure, actors moved from …
F5 Labs, using Efflux sensor telemetry, reports that CVE-2023-1389, an RCE in TP-Link Archer AX21 routers, was the most scanned-for CVE in December 2024 for the fifth consecutive month, with traffic far above any other tracked CVE. Other heavily scanned flaws include CVE-2022-24847 (GeoServer), CVE-2022-22947 (Spring Cloud Gateway), CVE-2…
F5 Labs analyzes CVE-2025-23061 and its predecessor CVE-2024-53900, a CVSS 9.0 flaw in the Mongoose MongoDB client library that allows remote code execution on Node.js API servers. The bug abuses the populate method, which accepts a $where clause containing arbitrary JavaScript. The initial fix for CVE-2024-53900 blocked only top-level $w…
CVE-2026-9082 is a critical (CVSS 9.8) pre-authentication SQL injection in the JSON:API module of Drupal Core. It was published on May 20, 2026 and added to the CISA KEV catalog the same month, with a remediation deadline of May 27. F5 sensors recorded 576 exploitation attempts from 9 source IPs between May 20 and May 31, 2026. The earlie…
F5 Labs, using attack telemetry from Efflux sensors, reports that CVE-2017-9841 (PHPUnit eval-stdin.php RCE) remained the most targeted vulnerability in May 2025 with over 54,000 instances. CVE-2020-8958 (Guangzhou ONU command injection RCE) shows near-exponential targeting growth for a third consecutive month. CVE-2024-3721 (TBK DVR OS c…
F5 Labs, with Efflux sensor telemetry, profiled a persistent information-disclosure scanner operating from 78.153.140.203 in a netblock of AS202306 (HOSTGLOBAL.PLUS LTD), a UK ISP. The IP was first seen on 10 January 2025, vanished on 10 April, and returned on 11 July 2025. It scans 130 unique URLs: 80.23% are variations of /.env, 11.45% …
F5 Labs reports a scanning campaign observed on its Honeynet in March 2026. It recorded 1,897 session-grouped attempts (2,821 raw events) tied to CVE-2018-14028, a WordPress 4.9.7 unrestricted file upload flaw, and the CVE entered the monthly top 10 after being absent in February. Instead of exploiting the upload flaw, the operator probes…
F5 Labs, using Efflux sensor telemetry, reports on the most exploited CVEs of April 2025 and on internet-wide scanning for SparkRAT command-and-control servers. A single actor, using three IPs in DigitalOcean ASN 14061, sent identical HTTP POST requests to the SparkRAT in-place update endpoint, each IP scanning for about 13 hours and reac…
FortiGuard Labs describes Evooo1Bot, a Linux botnet that embeds the Mirai DDoS engine in a more modular and capable framework. It uses encrypted C2 communications, layered string obfuscation (AES-256-CTR, ChaCha20, XOR-based key derivation) and a 28-command remote administration interface. It also ships an integrated exploit arsenal again…
FortiGuard Labs describes ClingSTUN, a Linux back-connect proxy backdoor that keeps persistent access and turns compromised devices into remotely controlled proxy nodes. It combines persistence, process termination, watchdog manipulation and remote command execution. It also uses legitimate public STUN servers for NAT traversal, to discov…
Cisco disclosed CVE-2026-20154, a high-severity vulnerability in the system rate-limiting process for syslog message 419002 in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. An unauthenticated, remote attacker can cause high CPU utilization on an affected device, r…
Cisco disclosed a critical authentication bypass, CVE-2026-76504, in the API session-based authentication management of Cisco Catalyst SD-WAN Manager. An unauthenticated, remote attacker can send a crafted HTTP request and gain access to the API with the privileges of the admin user. Cisco has released software updates and states that no …
Cisco published a security advisory covering multiple vulnerabilities in the web-based management interface and API endpoints of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem). A remote attacker could exploit them to gain unauthorized access, access sensitive information, cause a denial of service (DoS)…
Cisco disclosed CVE-2026-20173, a medium-severity vulnerability in Cisco NX-OS Software that lets an unauthenticated, remote attacker exhaust system resources and cause a denial of service (DoS). The flaw exists because rate limiting is improperly applied to some protocols. The DoS condition clears without manual intervention soon after t…
Cisco disclosed multiple critical vulnerabilities in the Next Generation OAM (NGOAM) feature of Cisco NX-OS Software, affecting Cisco Nexus 3000 Series and Nexus 9000 Series switches. An unauthenticated, remote attacker could execute arbitrary code with root privileges or cause a denial of service (DoS) on an affected device. The flaws ar…
Cisco disclosed a critical vulnerability, CVE-2026-76465, in the MPLS Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software for Cisco Nexus 3000 Series and Nexus 9000 Series switches. An unauthenticated, remote attacker could execute arbitrary code with root privileges or cause a denial of service (DoS) on an af…
Cisco disclosed CVE-2026-20362, a server-side request forgery (SSRF) vulnerability in the web-based management interface of Cisco Finesse. An unauthenticated, remote attacker could exploit it by sending a crafted HTTP request to an affected device. Successful exploitation could expose limited sensitive information from services associated…
