/
← Voltar ao feed
high exploit público

ClingSTUN Linux backdoor turns exploited IoT devices into proxy nodes via public STUN servers

1 fonte(s) · 1 atualização(ões) · publicado 05/10/2026 10:00 · coletado há 4 dias

FortiGuard Labs describes ClingSTUN, a Linux back-connect proxy backdoor that keeps persistent access and turns compromised devices into remotely controlled proxy nodes. It combines persistence, process termination, watchdog manipulation and remote command execution. It also uses legitimate public STUN servers for NAT traversal, to discover external IP addresses and port mappings. Spread relies on known, unpatched vulnerabilities in Internet-facing devices, including routers, DVRs and VPN appliances from vendors such as Tenda, D-Link, TP-Link, Ivanti, Linksys and EnGenius. Samples are detected as Mirai-family downloaders and Linux agents.

5 exploits públicos

Há código de exploração publicado no Exploit-DB para CVE-2024-10914, CVE-2026-36356, CVE-2023-1389 e outros. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.

  1. exploit-db.com · EDB-52643 ↗ · remoto · hardware · pub. 17/08/2026 não verificado

    D-Link DNS_340L - OS Command Injection

    This script targets an unauthenticated command injection in the account management CGI of end-of-life D-Link NAS devices (DNS-320, 320LW, 325, 340L). The attacker only needs network access to the device's web interface; no login or user interaction is required. A single crafted request to the user-creation function makes the device run arbitrary operating system commands with root privileges. The code is a working exploit: it verifies the target by running a harmless identity command, offers an interactive command shell, and can scan lists of hosts in parallel. D-Link will not patch, so exposed units should be isolated or retired.

    CVE-2024-10914 · autor: Jared Brits · explicação gerada por IA
  2. exploit-db.com · EDB-52581 ↗ · hardware · linux · pub. 27/05/2026 não verificado

    MeiG Smart FORGE_SLT711 - OS Command Injection

    This exploit targets the web management interface of the MeiG FORGE_SLT711 4G LTE router (GoAhead server), specifically a remote-access settings handler that passes the submitted password value into a system shell call. The handler is missing from the authentication list, so an attacker needs only network reach to the device's web port, with no login or user interaction. It gives command execution as root on the router, though output is not returned (blind). The script is a short, working exploit, tested on one firmware build and claimed to affect the whole product line; it matches the listed CVE. Exposed management interfaces should be restricted and firmware updates requested from the carrier.

    CVE-2026-36356 · autor: Daniil Gordeev · explicação gerada por IA
  3. exploit-db.com · EDB-51677 ↗ · remoto · hardware · pub. 10/08/2023 não verificado

    TP-Link Archer AX21 - Unauthenticated Command Injection

    This script exploits CVE-2023-1389, a command injection in the web interface of the TP-Link Archer AX21, where the country setting of the locale handler reaches a shell unsanitized. The attacker needs only network reach to the router's web interface, no login, and firmware older than 1.1.4 Build 20230219. Sending the crafted request twice runs commands as root, and here it opens a reverse shell to the attacker. It is a short but working proof of concept that matches the listed CVE.

    CVE-2023-1389 · autor: Voyag3r · explicação gerada por IA

Detalhes técnicos

  • Public STUN servers are third-party services and should not automatically be treated as attacker-controlled infrastructure.
  • Defenders should correlate STUN activity with suspicious process behavior, unexpected UDP connections and recurring keepalive traffic.
  • FortiGuard AV detections: BASH/Mirai.AEH!tr.dldr, BASH/Dloader.P!tr, Linux/Agent.BHT!tr.
  • FortiGuard IPS signatures cover roughly 30 exploited CVEs, mostly command injection and authentication bypass flaws in IoT and network devices (for example CVE-2023-1389, CVE-2024-21887, CVE-2023-46805, CVE-2025-34037).
  • Three IP addresses and numerous file hashes are published as indicators.

Remediação

  • Inventory Internet-facing devices and track their firmware and support status.
  • Patch promptly, prioritizing actively exploited vulnerabilities.
  • Replace or isolate end-of-life devices that no longer receive updates.
  • Disable or restrict unnecessary Internet-facing services.
  • Monitor for suspicious processes and anomalous UDP/keepalive traffic.
  • Apply FortiGuard AV, IPS, Web Filtering and IP Reputation/Anti-Botnet protections.

Linha do tempo

  1. feeds.fortinet.com ↗ · pub. 05/10/2026 10:00 · coletado 19/10 18:02 primeiro registro

    ClingSTUN Linux backdoor turns exploited IoT devices into proxy nodes via public STUN servers

    ler a análise desta fonte

    FortiGuard Labs describes ClingSTUN, a Linux back-connect proxy backdoor that keeps persistent access and turns compromised devices into remotely controlled proxy nodes. It combines persistence, process termination, watchdog manipulation and remote command execution. It also uses legitimate public STUN servers for NAT traversal, to discover external IP addresses and port mappings. Spread relies on known, unpatched vulnerabilities in Internet-facing devices, including routers, DVRs and VPN appliances from vendors such as Tenda, D-Link, TP-Link, Ivanti, Linksys and EnGenius. Samples are detected as Mirai-family downloaders and Linux agents.

    Technical Details

    • Public STUN servers are third-party services and should not automatically be treated as attacker-controlled infrastructure.
    • Defenders should correlate STUN activity with suspicious process behavior, unexpected UDP connections and recurring keepalive traffic.
    • FortiGuard AV detections: BASH/Mirai.AEH!tr.dldr, BASH/Dloader.P!tr, Linux/Agent.BHT!tr.
    • FortiGuard IPS signatures cover roughly 30 exploited CVEs, mostly command injection and authentication bypass flaws in IoT and network devices (for example CVE-2023-1389, CVE-2024-21887, CVE-2023-46805, CVE-2025-34037).
    • Three IP addresses and numerous file hashes are published as indicators.

    Remediation

    • Inventory Internet-facing devices and track their firmware and support status.
    • Patch promptly, prioritizing actively exploited vulnerabilities.
    • Replace or isolate end-of-life devices that no longer receive updates.
    • Disable or restrict unnecessary Internet-facing services.
    • Monitor for suspicious processes and anomalous UDP/keepalive traffic.
    • Apply FortiGuard AV, IPS, Web Filtering and IP Reputation/Anti-Botnet protections.