{"vulnerability": "CVE-2020-8958", "sightings": [{"uuid": "8befece8-5187-4e63-beb3-caada3091d89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-8958", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-02-01)", "content": "", "creation_timestamp": "2025-02-01T00:00:00.000000Z"}, {"uuid": "fa4d3689-2fcc-492d-94d6-59ef50d316a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-8958", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-03-08)", "content": "", "creation_timestamp": "2025-03-08T00:00:00.000000Z"}, {"uuid": "fd4cd0d4-4879-4449-901e-a213acc5cd37", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-8958", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-11-23)", "content": "", "creation_timestamp": "2025-11-23T00:00:00.000000Z"}, {"uuid": "39cb0e82-cd28-4dbf-8755-5dc1c99970b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-8958", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-10-29)", "content": "", "creation_timestamp": "2025-10-29T00:00:00.000000Z"}, {"uuid": "9fdba3dd-db58-4409-bc79-339d1646c766", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-8958", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-11-23)", "content": "", "creation_timestamp": "2025-11-23T00:00:00.000000Z"}, {"uuid": "10e5673c-7075-4346-b3e7-48ffcaeebac3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-8958", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-12-11)", "content": "", "creation_timestamp": "2025-12-11T00:00:00.000000Z"}, {"uuid": "01277c9e-b948-4725-82b1-bb76f2e2fe80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-8958", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-12-11)", "content": "", "creation_timestamp": "2025-12-11T00:00:00.000000Z"}, {"uuid": "0c30b8c7-73a3-4d11-b7d9-83005f656130", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-8958", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-03-16)", "content": "", "creation_timestamp": "2026-03-16T00:00:00.000000Z"}, {"uuid": "efbc4a4a-f2a0-46c7-b8c9-3e8303dfb81f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-8958", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/1442", "content": "#exploit\nCVE-2020-8958:\nArbitrary OS Command Injection on V-SOL Home Routers\nhttps://www.karansaini.com/os-command-injection-v-sol/\n]-> PoC: https://github.com/qurbat/gpon", "creation_timestamp": "2024-11-02T16:00:51.000000Z"}, {"uuid": "36b1e7bd-fdaf-415f-b533-e9bb9445cbe0", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-8958", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ad0cff8d-3659-463f-a440-052f749d559b", "content": "", "creation_timestamp": "2026-06-19T12:45:49.239112Z"}, {"uuid": "17c40c95-ec3c-41bc-9bd2-e5745b3f30f6", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-8958", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/6f40e885-6da4-4e9c-95e5-88caab7d65fd", "content": "", "creation_timestamp": "2026-06-23T14:03:16.583459Z"}, {"uuid": "1d16a892-6fbd-4da7-861a-0ae22dff9755", "vulnerability_lookup_origin": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2020-8958", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/05254fe1-7b94-4d08-b914-55a722c23bd6", "content": "", "creation_timestamp": "2026-06-30T09:42:24.836389Z"}, {"uuid": "016fa9c6-7688-46c1-a117-50ba6abe87b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-8958", "type": "seen", "source": "https://t.me/hacking_Attack/31088", "content": "Black Hat Ethical Hacking\nBotenaGo botnet targets millions of IoT devices with 33 exploits\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png BotenaGo botnet targets millions of IoT devices with 33 exploitsPost Views: 141 \nReading Time: 1 Minute\nThe new\u00a0BotenaGo malware botnet has been discovered using over thirty exploits to attack millions of routers and IoT devices.\nBotenaGo was written in Golang (Go), which has been exploding in popularity in recent years, with malware authors loving it for making payloads that are harder to detect and reverse engineer.\n\nIn the case of BotenaGo, only six out of 62 AV engines on VirusTotal flag the sample as malicious, and some identify it as Mirai.\nhttps://www.bleepstatic.com/images/news/u/1220909/Security/scan.jpg \n<figcaptionBotenaGo goes primarily unnoticed by AV scanners\nSource: AT&T \nSee Also: Complete Offensive Security and Ethical Hacking Course Targeting millions of devicesBotenaGo incorporates 33 exploits for a variety of routers, modems, and NAS devices, with some notable examples given below:\n\n* CVE-2015-2051, CVE-2020-9377, CVE-2016-11021: D-Link routers\n* CVE-2016-1555, CVE-2017-6077, CVE-2016-6277, CVE-2017-6334: Netgear devices\n* CVE-2019-19824: Realtek SDK based routers\n* CVE-2017-18368, CVE-2020-9054: Zyxel routers and NAS devices\n* CVE-2020-10987: Tenda products\n* CVE-2014-2321: ZTE modems\n* CVE-2020-8958: Guangzhou 1GE ONU\n\nResearchers at AT&T\u00a0who analyzed the new botnet found that it targets millions of devices with functions that exploit the above flaws.\n\nAn example given is the search string for Boa, which is a discontinued open-source web server used in embedded applications and one that still returns nearly two million internet-facing devices on Shodan.\nhttps://www.bleepstatic.com/images/news/u/1220909/Security/botenago_shodan.jpg \n<figcaptionShodan search returned 2 million results on Boa\nSource: AT&T \nSee Also: All Windows versions impacted by new LPE zero-day vulnerability Another notable example is the targeting of CVE-2020-10173, a command-injection flaw in Comtrend VR-3033 gateway devices, of which 250,000 are still exploitable.\n\nWhen installed, the malware will listen on two ports (31412 and 19412), where it waits for an IP address to be sent to it. Once one is received, the bot will exploit each vulnerability on that IP address to gain access.\nhttps://www.bleepstatic.com/images/news/u/1220909/Security/mapping.jpg \n<figcaptionBotenaGo mapping attack functions.\nSource: AT&T \nOnce BotenaGo gains access, it will execute remote shell commands to recruit the device into the botnet.\n\nDepending on which device is targeted, the malware uses different links to fetch a matching payload.\n\nAt the time of the analysis, though, there were no payloads on the hosting server, so none could be retrieved for analysis.\nSee Also: Offensive Security Tool: DotDotPwn \u2013 The Directory Traversal Fuzzer Furthermore, the researchers didn\u2019t find an active C2 communication between BotenaGo and an actor-controlled server, so they give three potential explanations on how it operates:\n\n1. BotenaGo is only one part (module) of a multi-stage modular malware attack, and it\u2019s not the one responsible for handling communications.\n2. BotenaGo is a new tool used by Mirai operators on certain machines, a scenario that is backed by common payload dropping links.\n3. The malware isn\u2019t ready to operate yet, and a sample from its early development phase leaked in the wild accidentally.\n\nIn conclusion, the appearance of BotenaGo in the wild is unusual given its incomplete operational status, but its underlying capabilities are leaving no doubt about the int[...]", "creation_timestamp": "2026-09-01T20:02:10.191290Z"}, {"uuid": "d26d75aa-419a-40ca-a85e-57d41da8aae2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-8958", "type": "seen", "source": "https://t.me/hacking_Attack/31088", "content": "Black Hat Ethical Hacking\nBotenaGo botnet targets millions of IoT devices with 33 exploits\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png BotenaGo botnet targets millions of IoT devices with 33 exploitsPost Views: 141 \nReading Time: 1 Minute\nThe new\u00a0BotenaGo malware botnet has been discovered using over thirty exploits to attack millions of routers and IoT devices.\nBotenaGo was written in Golang (Go), which has been exploding in popularity in recent years, with malware authors loving it for making payloads that are harder to detect and reverse engineer.\n\nIn the case of BotenaGo, only six out of 62 AV engines on VirusTotal flag the sample as malicious, and some identify it as Mirai.\nhttps://www.bleepstatic.com/images/news/u/1220909/Security/scan.jpg \n<figcaptionBotenaGo goes primarily unnoticed by AV scanners\nSource: AT&T \nSee Also: Complete Offensive Security and Ethical Hacking Course Targeting millions of devicesBotenaGo incorporates 33 exploits for a variety of routers, modems, and NAS devices, with some notable examples given below:\n\n* CVE-2015-2051, CVE-2020-9377, CVE-2016-11021: D-Link routers\n* CVE-2016-1555, CVE-2017-6077, CVE-2016-6277, CVE-2017-6334: Netgear devices\n* CVE-2019-19824: Realtek SDK based routers\n* CVE-2017-18368, CVE-2020-9054: Zyxel routers and NAS devices\n* CVE-2020-10987: Tenda products\n* CVE-2014-2321: ZTE modems\n* CVE-2020-8958: Guangzhou 1GE ONU\n\nResearchers at AT&T\u00a0who analyzed the new botnet found that it targets millions of devices with functions that exploit the above flaws.\n\nAn example given is the search string for Boa, which is a discontinued open-source web server used in embedded applications and one that still returns nearly two million internet-facing devices on Shodan.\nhttps://www.bleepstatic.com/images/news/u/1220909/Security/botenago_shodan.jpg \n<figcaptionShodan search returned 2 million results on Boa\nSource: AT&T \nSee Also: All Windows versions impacted by new LPE zero-day vulnerability Another notable example is the targeting of CVE-2020-10173, a command-injection flaw in Comtrend VR-3033 gateway devices, of which 250,000 are still exploitable.\n\nWhen installed, the malware will listen on two ports (31412 and 19412), where it waits for an IP address to be sent to it. Once one is received, the bot will exploit each vulnerability on that IP address to gain access.\nhttps://www.bleepstatic.com/images/news/u/1220909/Security/mapping.jpg \n<figcaptionBotenaGo mapping attack functions.\nSource: AT&T \nOnce BotenaGo gains access, it will execute remote shell commands to recruit the device into the botnet.\n\nDepending on which device is targeted, the malware uses different links to fetch a matching payload.\n\nAt the time of the analysis, though, there were no payloads on the hosting server, so none could be retrieved for analysis.\nSee Also: Offensive Security Tool: DotDotPwn \u2013 The Directory Traversal Fuzzer Furthermore, the researchers didn\u2019t find an active C2 communication between BotenaGo and an actor-controlled server, so they give three potential explanations on how it operates:\n\n1. BotenaGo is only one part (module) of a multi-stage modular malware attack, and it\u2019s not the one responsible for handling communications.\n2. BotenaGo is a new tool used by Mirai operators on certain machines, a scenario that is backed by common payload dropping links.\n3. The malware isn\u2019t ready to operate yet, and a sample from its early development phase leaked in the wild accidentally.\n\nIn conclusion, the appearance of BotenaGo in the wild is unusual given its incomplete operational status, but its underlying capabilities are leaving no doubt about the int[...]", "creation_timestamp": "2026-09-02T01:02:36.470842Z"}]}