/
ttps_attack:T1071.001 × latest_source_host:f5.com × has_exploit:true × limpar

Resultados

3 casos · pág. 1/1

f5.com · exploit público high

F5 Labs: SparkRAT C2 scanning from DigitalOcean and April 2025 CVE exploitation trends, including Fortinet SSL-VPN and SAP NetWeaver

F5 Labs, using Efflux sensor telemetry, reports on the most exploited CVEs of April 2025 and on internet-wide scanning for SparkRAT command-and-control servers. A single actor, using three IPs in DigitalOcean ASN 14061, sent identical HTTP POST requests to the SparkRAT in-place update endpoint, each IP scanning for about 13 hours and reac…

CVE-2017-9841 CVE-2019-9082 CVE-2022-24847 Patchwork BianLian
f5.com · exploit público high

NoBooze1 malware delivered to TP-Link AX21 routers and Raisecom web interfaces by a single actor via command injection

F5 Labs, using Efflux sensor telemetry, reports a campaign that began on 2025-06-08. One actor is exploiting TP-Link AX21 routers (CVE-2023-1389, command injection in the country query parameter) and Raisecom web interfaces (CVE-2024-7120) to deliver a new malware family named NoBooze1. Four source IPs and three stage-one hosts were rotat…

CVE-2023-1389 CVE-2024-7120 CVE-2019-9082
f5.com · exploit público critical

React2Shell (CVE-2025-55182) mass exploitation: RondoDox, credential stealers and reverse shells observed in December 2025

F5 Labs, using Efflux sensor telemetry, analyzed December 2025 exploitation of React2Shell (CVE-2025-55182), a CVSS 10.0 unsafe deserialization RCE in React Server Components. It was disclosed on 3 December 2025 and rose to second place among the most exploited CVEs, behind only CVE-2017-9841. Within days of disclosure, actors moved from …

CVE-2025-55182 CVE-2017-9841 CVE-2023-1389 RondoDox