Bundle - A Mirai botnet is attempting exploitation in the wild using a new (at least to us) set of CVEs

GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

Bundle

A Mirai botnet is attempting exploitation in the wild using a new (at least to us) set of CVEs

Created on 2025-02-12 13:38, updated on 2025-02-12 13:38, by Cédric Bonhomme

JSON

References

https://www.linkedin.com/posts/the-shadowserver-foundation_high-honeypot-http-scanner-events-report-activity-7295374394028154880-ASW-

Description

A Mirai botnet is attempting exploitation in the wild using a new set of CVEs, focusing mostly on IoT devices. Includes:

Tenda CVE-2024-41473
Draytek CVE-2024-12987
HuangDou UTCMS V9 CVE-2024-9916
Totolink CVE-2024-2353 CVE-2024-24328 CVE-2024-24329
(likely) Four-Faith CVE-2024-9644

Source: The Shadowserver Foundation

Vulnerabilities included in this bundle

Meta

[
  {
    "ref": [
      "https://www.linkedin.com/posts/the-shadowserver-foundation_high-honeypot-http-scanner-events-report-activity-7295374394028154880-ASW-"
    ]
  }
]

Combined detection rules

Detection rules are retrieved from Rulezet.

Combined sightings

Sightings 143 total Confirmed: 1 Exploited: 29 Published Proof of Concept: 3 Seen: 110

Author	Vulnerability	Source	Type	Date