Beastmode (stylized as B3astmode), a Mirai-based DDoS botnet, has updated its list of exploits and added several new exploits targeting different models of TOTOLINK routers.
The newly added exploits
- Researchers from Fortinet analyzed a recent version of Beastmode to discover newly added flaws targeting TOTOLINK devices, which have been delineated below.
- CVE-2022-26210: A command injection vulnerability allowing execution of arbitrary commands and affecting TOTOLINK A800R, A810R, A830R, A950RG, A3000RU, and A3100R routers.
- CVE-2022-26186: A command injection vulnerability, exploited through export0vpn interface at cstecgi[.]cgi. This vulnerability affects TOTOLINK N600R and A7100RU routers.
- CVE-2022-25075 to 25084 is a set of severity vulnerabilities that allow the execution of arbitrary commands and affect TOTOLINK A810R, A830R, A860R, A950RG, A3100R, A3600R, T6, and T10 routers.
More exploits for different routers
Beastmode has also added some older bugs for a variety of routers from different vendors. All these flaws rated 9.8 on the CVSS scale, allow attackers to take full control of the device.
- CVE-2021-45382: A remote code execution flaw affecting D-Link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L.
- CVE-2021-4045: An unauthenticated remote code execution flaw affecting TP-Link Tapo C200 IP camera.
- CVE-2017-17215: An unauthenticated remote code execution flaw affecting Huawei HG532
- CVE-2016-5674: A remote arbitrary PHP code execution via log parameter, affecting Netgear ReadyNAS product line.
The successful exploitation of these older vulnerabilities allows the malware to download a shell script that registers the device on the botnet to perform various DDoS attacks.
What to do?
TOTOLINK device users should visit the vendor's download center to apply updates. Moreover, manually reset the infected router and configure it with a stronger and more complex password.
Publisher
/https://cyware-ent.s3.amazonaws.com/image_bank/shutterstock_188421089.jpg)
/https://cyware-ent.s3.amazonaws.com/image_bank/a3fc_shutterstock_543226405.jpg)
