/
← Voltar ao feed
medium exploit público

F5 Sensor Intel: CVE-2023-1389 (TP-Link Archer AX21) tops scanning for a fifth month, December 2024

1 fonte(s) · 1 atualização(ões) · publicado 21/01/2025 14:09 · coletado há 4 dias

F5 Labs, using Efflux sensor telemetry, reports that CVE-2023-1389, an RCE in TP-Link Archer AX21 routers, was the most scanned-for CVE in December 2024 for the fifth consecutive month, with traffic far above any other tracked CVE. Other heavily scanned flaws include CVE-2022-24847 (GeoServer), CVE-2022-22947 (Spring Cloud Gateway), CVE-2020-11625 (AvertX webcam) and CVE-2022-42475 (FortiOS/FortiProxy SSL-VPN). F5 also began tracking CVE-2024-12856 in Four-Faith routers. Sensors first saw it on 8 November 2024, before the NVD publication on 27 December 2024, which suggests it was known beforehand. Scanning for CVE-2023-23752 (Joomla!) jumped from single digits to nearly 1,000 events, mostly from one IP.

4 exploits públicos

Há código de exploração publicado no Exploit-DB para CVE-2023-1389, CVE-2023-23752, CVE-2022-22947 e outros. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.

  1. exploit-db.com · EDB-51677 ↗ · remoto · hardware · pub. 10/08/2023 não verificado

    TP-Link Archer AX21 - Unauthenticated Command Injection

    This script exploits CVE-2023-1389, a command injection in the web interface of the TP-Link Archer AX21, where the country setting of the locale handler reaches a shell unsanitized. The attacker needs only network reach to the router's web interface, no login, and firmware older than 1.1.4 Build 20230219. Sending the crafted request twice runs commands as root, and here it opens a reverse shell to the attacker. It is a short but working proof of concept that matches the listed CVE.

    CVE-2023-1389 · autor: Voyag3r · explicação gerada por IA
  2. exploit-db.com · EDB-51334 ↗ · aplicação web · php · pub. 08/04/2023 verificado

    Joomla! v4.2.8 - Unauthenticated information disclosure

    This script exploits CVE-2023-23752, an improper access check in Joomla's REST API web service endpoints, affecting versions 4.0.0 through 4.2.7. An unauthenticated remote attacker with only network access to the site can query two API routes, adding a public flag, and receive data that should require login. It returns the list of registered users with names, usernames, emails and groups, plus the application configuration, including database host, user, password and name. It is a small, working, reliable tool that only reads data, but leaked database credentials can lead to further compromise.

    CVE-2023-23752 · autor: Alexandre ZANNI · explicação gerada por IA
  3. exploit-db.com · EDB-50799 ↗ · aplicação web · java · pub. 07/03/2022 não verificado

    Spring Cloud Gateway 3.1.0 - Remote Code Execution (RCE)

    The script abuses Spring Cloud Gateway's actuator management interface, which lets a remote user create and refresh routes. It plants a route whose filter value is evaluated as a Spring expression, running an operating system command on the server and returning the output. It needs only network access to an exposed actuator without authentication, on versions before 3.0.7 or 3.1.1 (tested on 3.1.0). It is a working exploit that matches CVE-2022-22947 and cleans up its route afterward.

    CVE-2022-22947 · autor: Carlos E. Vieira · explicação gerada por IA

Detalhes técnicos

  • CVE-2023-1389 first appeared in F5 logs in July 2022 and has been in the top 10 since January 2024. Scanning is slowly decreasing but still dominant.
  • CVE-2024-12856 is an authenticated command injection in Four-Faith routers. Default credentials on the affected firmware make it effectively remote and unauthenticated.
  • CVE-2020-11625 allows username enumeration on AvertX webcams (CVSS 5.3), which suggests attackers are also just locating devices. Scanning for it has re-emerged.
  • CVE-2023-23752 (Joomla! 4.0.0 to 4.2.7, unauthorized access) traffic came from about 20 IPs, mainly 66.63.187.168 (Quadranet Enterprises, US hosting provider).
  • Scanning for CVE-2020-8958 dropped after a rise the previous month, and CVE-2018-10561 returned to earlier levels.
  • BotPoke scanner activity continues. Its source IP moved from Lithuania to Hong Kong to the Netherlands, and the Netherlands IP was the top talker with 9% of total traffic. The next two most active IPs belong to a cluster scanning for PHP and credential-exposure URIs.
  • The US government is considering a ban on TP-Link device sales. F5 says this is tied to the devices' prevalence, the company's ties to China and espionage concerns, not to this vulnerability.
  • ATT&CK: Vulnerability Scanning (T1595.002), Exploit Public-Facing Application (T1190).

Remediação

  • Scan the environment for vulnerabilities aggressively and patch high-priority ones as soon as feasible.
  • Use a WAF or similar tool to detect and stop web exploits.
  • Monitor anomalous outbound traffic to find devices participating in DDoS attacks.
  • Engage a DDoS mitigation service.

Linha do tempo

  1. f5.com ↗ · pub. 21/01/2025 14:09 · coletado 19/10 18:02 primeiro registro

    F5 Sensor Intel: CVE-2023-1389 (TP-Link Archer AX21) tops scanning for a fifth month, December 2024

    ler a análise desta fonte

    F5 Labs, using Efflux sensor telemetry, reports that CVE-2023-1389, an RCE in TP-Link Archer AX21 routers, was the most scanned-for CVE in December 2024 for the fifth consecutive month, with traffic far above any other tracked CVE. Other heavily scanned flaws include CVE-2022-24847 (GeoServer), CVE-2022-22947 (Spring Cloud Gateway), CVE-2020-11625 (AvertX webcam) and CVE-2022-42475 (FortiOS/FortiProxy SSL-VPN). F5 also began tracking CVE-2024-12856 in Four-Faith routers. Sensors first saw it on 8 November 2024, before the NVD publication on 27 December 2024, which suggests it was known beforehand. Scanning for CVE-2023-23752 (Joomla!) jumped from single digits to nearly 1,000 events, mostly from one IP.

    Technical Details

    • CVE-2023-1389 first appeared in F5 logs in July 2022 and has been in the top 10 since January 2024. Scanning is slowly decreasing but still dominant.
    • CVE-2024-12856 is an authenticated command injection in Four-Faith routers. Default credentials on the affected firmware make it effectively remote and unauthenticated.
    • CVE-2020-11625 allows username enumeration on AvertX webcams (CVSS 5.3), which suggests attackers are also just locating devices. Scanning for it has re-emerged.
    • CVE-2023-23752 (Joomla! 4.0.0 to 4.2.7, unauthorized access) traffic came from about 20 IPs, mainly 66.63.187.168 (Quadranet Enterprises, US hosting provider).
    • Scanning for CVE-2020-8958 dropped after a rise the previous month, and CVE-2018-10561 returned to earlier levels.
    • BotPoke scanner activity continues. Its source IP moved from Lithuania to Hong Kong to the Netherlands, and the Netherlands IP was the top talker with 9% of total traffic. The next two most active IPs belong to a cluster scanning for PHP and credential-exposure URIs.
    • The US government is considering a ban on TP-Link device sales. F5 says this is tied to the devices' prevalence, the company's ties to China and espionage concerns, not to this vulnerability.
    • ATT&CK: Vulnerability Scanning (T1595.002), Exploit Public-Facing Application (T1190).

    Remediation

    • Scan the environment for vulnerabilities aggressively and patch high-priority ones as soon as feasible.
    • Use a WAF or similar tool to detect and stop web exploits.
    • Monitor anomalous outbound traffic to find devices participating in DDoS attacks.
    • Engage a DDoS mitigation service.