F5 Sensor Intel: Web-Based RCE and Command Injection Flaws Dominate July 2025 Exploitation Telemetry
F5 Labs, using attack telemetry from Efflux's global sensor network, analyzed the most exploited vulnerabilities in July 2025 and found that nearly all top-scanned CVEs are HTTP-based RCE or command injection flaws in web interfaces. CVE-2017-9841 (PHPUnit) was the most exploited, followed by CVE-2023-1389 (TP-Link Archer AX21), CVE-2022-24847 (GeoServer), CVE-2022-42475 (FortiOS SSL-VPN) and CVE-2019-9082 (ThinkPHP). RCE accounts for over 24% of CISA's KEV catalog (304 of 1,402 entries as of 31 July 2025). F5 attributes the trend to poor input sanitization in web management interfaces that are treated as ancillary features. Exploitation is often aimed at delivering botnet payloads such as Mirai variants.
10 exploits públicos
Há código de exploração publicado no Exploit-DB para CVE-2024-4577, CVE-2023-1389, CVE-2021-44228 e outros. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.
-
PHP CGI Module 8.3.4 - Remote Code Execution (RCE)
This script exploits CVE-2024-4577, an argument injection flaw in PHP running as CGI on Windows, where a soft hyphen in the query string is turned into a dash and lets the attacker pass configuration options to the interpreter. It needs only network access to an exposed php-cgi executable, with no login or user interaction. The options make PHP run code sent in the request body, giving command execution as the web server user. It looks like a working exploit with multi-host scanning and an interactive shell.
-
TP-Link Archer AX21 - Unauthenticated Command Injection
This script exploits CVE-2023-1389, a command injection in the web interface of the TP-Link Archer AX21, where the country setting of the locale handler reaches a shell unsanitized. The attacker needs only network reach to the router's web interface, no login, and firmware older than 1.1.4 Build 20230219. Sending the crafted request twice runs commands as root, and here it opens a reverse shell to the attacker. It is a short but working proof of concept that matches the listed CVE.
-
AD Manager Plus 7122 - Remote Code Execution (RCE)
This entry describes Log4Shell (CVE-2021-44228) in ManageEngine ADManager Plus builds before 7122, reached through a request parameter on the product's search function in its web interface. The write-up needs only network access to the login page, with no valid credentials, and an unpatched version that still logs attacker-controlled input with a vulnerable Log4j. The authors first confirmed it with an out-of-band DNS callback, then claim full remote code execution on another target after evading a firewall and antivirus, but they publish no working exploit code. It is really a short research narrative and detection hint, not a ready exploit. Defenders should upgrade past 7122 and watch for JNDI lookup strings in web logs.
-
Spring Cloud Gateway 3.1.0 - Remote Code Execution (RCE)
The script abuses Spring Cloud Gateway's actuator management interface, which lets a remote user create and refresh routes. It plants a route whose filter value is evaluated as a Spring expression, running an operating system command on the server and returning the output. It needs only network access to an exposed actuator without authentication, on versions before 3.0.7 or 3.1.1 (tested on 3.1.0). It is a working exploit that matches CVE-2022-22947 and cleans up its route afterward.
-
PHP Unit 4.8.28 - Remote Code Execution (RCE) (Unauthenticated)
This script exploits CVE-2017-9841: PHPUnit's eval-stdin helper, when left reachable in a web-exposed vendor directory, executes any PHP code sent in an HTTP request body. The attacker needs only network access to a site that deployed PHPUnit (a dev dependency) publicly, with no login or user interaction. The tool checks several common framework layouts with a harmless test, then offers an interactive prompt that runs system commands as the web server user. It is a simple, working exploit that matches the CVE.
-
Apache Log4j 2 - Remote Code Execution (RCE)
This script exploits CVE-2021-44228 (Log4Shell) in Apache Log4j 2 versions 2.0-beta9 to 2.14.1, where a logged string with a JNDI lookup makes the application fetch and load remote code. The attacker needs no authentication, only a way to get text into something the target logs, and the target must be able to reach the attacker's server. The tool runs a rogue directory and web server that deliver a class opening a reverse shell, giving remote code execution. It is a working proof of concept, not verified by Exploit-DB.
-
Apache Log4j2 2.14.1 - Information Disclosure
CVE-2021-44228 · autor: leonjza -
Microsoft SQL Server Reporting Services 2016 - Remote Code Execution
CVE-2020-0618 · autor: West Shepherd -
ThinkPHP - Multiple PHP Injection RCEs (Metasploit)
This Metasploit module exploits remote code execution in the ThinkPHP 5.x web framework through the public index page, where a crafted request makes the framework call a PHP function with attacker-chosen input. The attacker needs only network access to the web server, with no login or user interaction, and a ThinkPHP version up to 5.0.23. The module reads the version from an error page and picks one of two techniques, one per CVE. It runs system commands as the web server user and can drop a Linux payload for a remote session. It is a mature, working exploit.
-
zzzphp CMS 1.6.1 - Cross-Site Request Forgery
This is a cross-site request forgery proof of concept against the zzzphp CMS 1.6.1 admin panel, in the template file editing function. The admin save form has no anti-CSRF token, so a malicious web page can silently submit a forged edit. The attacker only needs to lure a logged-in administrator to that page; no credentials or local access are required. The forged edit writes a PHP expression into a site template, which the CMS later evaluates, leading to remote code execution. It is a simple, working-looking PoC (unverified), and the author describes it as a follow-up to CVE-2019-9041.
Detalhes técnicos
- CVE-2023-1389: TP-Link Archer AX21 (AX1800) firmware prior to 1.1.4 Build 20230219 has a command injection flaw at
/cgi-bin/luci;stok=/locale. The unsanitizedcountryparameter is passed topopen(), allowing unauthenticated root command execution via a single POST request. July 2025 saw 8,465 events, of which 1,149 (13.6%) were active exploitation attempts and 86.4% were reconnaissance. - Other CVEs in the top-10 list: CVE-2022-22947, CVE-2020-8958, CVE-2025-31324, CVE-2024-4577 and CVE-2022-47945. CVE-2022-42475 is an RCE that is neither a web-interface flaw nor command injection.
- Attackers follow two patterns. First, reconnaissance with lightweight probes such as
echo(md5(CVE-2017-9841)), which may overlap with legitimate web survey activity. Second, exploitation viacurl/wgetto download and run botnet code (Mirai variants) or RATs, either written to disk or piped to a shell. - CVE-2021-44228 (Log4Shell) still shows residual scanning activity, and scanning for CVE-2020-0618 has risen recently.
Remediação
- Update or remove outdated PHPUnit, GeoServer, ThinkPHP and Log4j; apply TP-Link firmware updates and Fortinet patches for CVE-2022-42475.
- Scan the environment for vulnerabilities aggressively and patch high-priority flaws as soon as feasible.
- Deploy a WAF or similar tool to detect and block web exploits.
- Monitor anomalous outbound traffic to identify devices participating in DDoS botnets, and consider a DDoS mitigation service.
Linha do tempo
-
F5 Sensor Intel: Web-Based RCE and Command Injection Flaws Dominate July 2025 Exploitation Telemetry
ler a análise desta fonte ocultar
F5 Labs, using attack telemetry from Efflux's global sensor network, analyzed the most exploited vulnerabilities in July 2025 and found that nearly all top-scanned CVEs are HTTP-based RCE or command injection flaws in web interfaces. CVE-2017-9841 (PHPUnit) was the most exploited, followed by CVE-2023-1389 (TP-Link Archer AX21), CVE-2022-24847 (GeoServer), CVE-2022-42475 (FortiOS SSL-VPN) and CVE-2019-9082 (ThinkPHP). RCE accounts for over 24% of CISA's KEV catalog (304 of 1,402 entries as of 31 July 2025). F5 attributes the trend to poor input sanitization in web management interfaces that are treated as ancillary features. Exploitation is often aimed at delivering botnet payloads such as Mirai variants.
Technical Details
- CVE-2023-1389: TP-Link Archer AX21 (AX1800) firmware prior to 1.1.4 Build 20230219 has a command injection flaw at
/cgi-bin/luci;stok=/locale. The unsanitizedcountryparameter is passed topopen(), allowing unauthenticated root command execution via a single POST request. July 2025 saw 8,465 events, of which 1,149 (13.6%) were active exploitation attempts and 86.4% were reconnaissance. - Other CVEs in the top-10 list: CVE-2022-22947, CVE-2020-8958, CVE-2025-31324, CVE-2024-4577 and CVE-2022-47945. CVE-2022-42475 is an RCE that is neither a web-interface flaw nor command injection.
- Attackers follow two patterns. First, reconnaissance with lightweight probes such as
echo(md5(CVE-2017-9841)), which may overlap with legitimate web survey activity. Second, exploitation viacurl/wgetto download and run botnet code (Mirai variants) or RATs, either written to disk or piped to a shell. - CVE-2021-44228 (Log4Shell) still shows residual scanning activity, and scanning for CVE-2020-0618 has risen recently.
Remediation
- Update or remove outdated PHPUnit, GeoServer, ThinkPHP and Log4j; apply TP-Link firmware updates and Fortinet patches for CVE-2022-42475.
- Scan the environment for vulnerabilities aggressively and patch high-priority flaws as soon as feasible.
- Deploy a WAF or similar tool to detect and block web exploits.
- Monitor anomalous outbound traffic to identify devices participating in DDoS botnets, and consider a DDoS mitigation service.
- CVE-2023-1389: TP-Link Archer AX21 (AX1800) firmware prior to 1.1.4 Build 20230219 has a command injection flaw at