{"vulnerability": "cve-2016-1102", "sightings": [{"uuid": "30a6f66b-f341-4f64-a619-481ae42a19ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-11021", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2023-06-14T21:10:03.000000Z"}, {"uuid": "223dbb93-0411-4e57-9143-e15456fde93b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-1102", "type": "exploited", "source": "https://www.exploit-db.com/exploits/39824", "content": "", "creation_timestamp": "2016-05-17T00:00:00.000000Z"}, {"uuid": "fff1dd01-2dfc-4c86-9569-6b623f044b4d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-11021", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971413", "content": "", "creation_timestamp": "2024-12-24T20:28:58.082574Z"}, {"uuid": "b9f0df74-aff1-4146-8c40-92aa58e8c074", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-11021", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:10:10.000000Z"}, {"uuid": "fb5632af-42d8-44c2-97a6-e9f1f7c5eb3f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-11021", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-07-05)", "content": "", "creation_timestamp": "2025-07-05T00:00:00.000000Z"}, {"uuid": "80e8efd7-e625-4bad-b9e2-4cf61b02f7be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-11021", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-07-03)", "content": "", "creation_timestamp": "2025-07-03T00:00:00.000000Z"}, {"uuid": "c5cb8499-1ebb-4401-b364-6af4ad914b1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-11021", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-05-04)", "content": "", "creation_timestamp": "2025-05-04T00:00:00.000000Z"}, {"uuid": "80f25942-ffc6-4ec4-ad56-219d9595b801", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-11021", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-05-05)", "content": "", "creation_timestamp": "2025-05-05T00:00:00.000000Z"}, {"uuid": "d43b7480-233e-491e-a152-7d9514da3ca0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-11021", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-07-02)", "content": "", "creation_timestamp": "2025-07-02T00:00:00.000000Z"}, {"uuid": "d74683ff-a711-4668-869e-81792fa5cb65", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-11021", "type": "seen", "source": "MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7", "content": "", "creation_timestamp": "2025-10-23T21:12:58.000000Z"}, {"uuid": "2a919b3c-a501-409e-9191-148622941626", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-11021", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-08-10)", "content": "", "creation_timestamp": "2025-08-10T00:00:00.000000Z"}, {"uuid": "d9ef2645-e793-4d19-a2fc-04df03da5b3c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-11021", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-11-10)", "content": "", "creation_timestamp": "2025-11-10T00:00:00.000000Z"}, {"uuid": "7ae86ab7-59b8-42a6-b517-4d10a5bddf09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-11021", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-08-21)", "content": "", "creation_timestamp": "2025-08-21T00:00:00.000000Z"}, {"uuid": "06c7c5ab-2398-4e3b-9e51-c3a74f0a1cfa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-11021", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/dlink_dcs_930l_authenticated_remote_command_execution.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "dd239c49-c24f-462e-a1b7-225a0829454b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-11021", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-02-15)", "content": "", "creation_timestamp": "2026-02-15T00:00:00.000000Z"}, {"uuid": "98a8fad6-3e60-43c6-b27f-c5f87c5fdd1e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-11021", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-03-13)", "content": "", "creation_timestamp": "2026-03-13T00:00:00.000000Z"}, {"uuid": "bdf511c8-93e9-4be6-abdd-08c178cfab4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-11021", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-01-18)", "content": "", "creation_timestamp": "2026-01-18T00:00:00.000000Z"}, {"uuid": "c2fdf978-ad13-4abc-b457-cd542dc929bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-11021", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-01-22)", "content": "", "creation_timestamp": "2026-01-22T00:00:00.000000Z"}, {"uuid": "e45a442b-8b02-4b3d-bac1-15c04dcf9f3f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-11021", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-03-23)", "content": "", "creation_timestamp": "2026-03-23T00:00:00.000000Z"}, {"uuid": "4ce711c4-8771-414b-8855-59eaa6ebe44c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2016-11021", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/a81be918-433d-4fc0-a3ea-1f40151c2efc", "content": "", "creation_timestamp": "2026-02-02T12:28:03.996180Z"}, {"uuid": "4f04829b-8252-4816-87cf-fde9f6ce4d01", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-11021", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-04-14)", "content": "", "creation_timestamp": "2026-04-14T00:00:00.000000Z"}, {"uuid": "4f83d1a1-0f50-47f1-95da-db91cdbdade9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-11021", "type": "seen", "source": "Telegram/TJ_tqxJhsjsLXwRQXrqWjZrQT7RtbIwioGV1D_BQIl7H8XuF", "content": "", "creation_timestamp": "2025-02-06T02:42:30.000000Z"}, {"uuid": "165fc55d-844e-4bbe-9d2a-d95307cbd299", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-11029", "type": "seen", "source": "https://t.me/cibsecurity/11079", "content": "ATENTION\u203c New - CVE-2016-11029\n\nAn issue was discovered on Samsung mobile devices with L(5.0/5.1), M(6.0), and N(7.0) software. Attackers can read the password of the Mobile Hotspot in the log because of an unprotected intent. The Samsung ID is SVE-2016-7301 (December 2016).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-04-07T19:18:28.000000Z"}, {"uuid": "b748e59b-6683-436c-8ed5-d91d582a26ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-11022", "type": "seen", "source": "https://t.me/cibsecurity/10679", "content": "ATENTION\u203c New - CVE-2016-11022\n\nNETGEAR Prosafe WC9500 5.1.0.17, WC7600 5.1.0.17, and WC7520 2.5.0.35 devices allow a remote attacker to execute code with root privileges via shell metacharacters in the reqMethod parameter to login_handler.php.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-03-23T17:51:28.000000Z"}, {"uuid": "7a3f9373-0469-4b0f-8b62-c063c967e318", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-11021", "type": "seen", "source": "https://t.me/cibsecurity/10362", "content": "ATENTION\u203c New - CVE-2016-11021\n\nsetSystemCommand on D-Link DCS-930L devices before 2.12 allows a remote attacker to execute code via an OS command in the SystemCommand parameter.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-03-09T07:13:23.000000Z"}, {"uuid": "842c8349-0641-4707-aa66-6bcd4ff69700", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-11024", "type": "seen", "source": "https://t.me/cibsecurity/10851", "content": "ATENTION\u203c New - CVE-2016-11024 (odata4j)\n\nodata4j 0.7.0 allows ExecuteJPQLQueryCommand.java SQL injection. NOTE: this product is apparently discontinued.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-03-31T01:17:06.000000Z"}, {"uuid": "b4ff8360-4205-4a52-9c42-7edaa52a378c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-11023", "type": "seen", "source": "https://t.me/cibsecurity/10852", "content": "ATENTION\u203c New - CVE-2016-11023 (odata4j)\n\nodata4j 0.7.0 allows ExecuteCountQueryCommand.java SQL injection. NOTE: this product is apparently discontinued.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-03-31T01:17:07.000000Z"}, {"uuid": "714a539d-a297-4a27-a39f-814a907099f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-11028", "type": "seen", "source": "https://t.me/cibsecurity/11080", "content": "ATENTION\u203c New - CVE-2016-11028\n\nAn issue was discovered on Samsung mobile devices with software through 2016-09-13 (Exynos AP chipsets). There is a stack-based buffer overflow in the OTP TrustZone trustlet. The Samsung IDs are SVE-2016-7173 and SVE-2016-7174 (December 2016).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-04-07T19:18:28.000000Z"}, {"uuid": "0e853ddf-4f22-48a3-8547-75ba12cf7641", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-11027", "type": "seen", "source": "https://t.me/cibsecurity/11081", "content": "ATENTION\u203c New - CVE-2016-11027\n\nAn issue was discovered on Samsung mobile devices with M(6.0) software. In the Shade Locked state, a physically proximate attacker can read notifications on the lock screen. The Samsung ID is SVE-2016-7132 (December 2016).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-04-07T19:18:29.000000Z"}, {"uuid": "054b6e94-cc13-4f6d-82e9-1ec877c5e343", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-11026", "type": "seen", "source": "https://t.me/cibsecurity/11082", "content": "ATENTION\u203c New - CVE-2016-11026\n\nAn issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), and M(6.0) software. BootReceiver allows attackers to trigger a system crash because of incorrect exception handling. The Samsung ID is SVE-2016-7118 (December 2016).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-04-07T19:18:31.000000Z"}, {"uuid": "fa785e14-d925-4953-b203-0f3082f2f386", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-11025", "type": "seen", "source": "https://t.me/cibsecurity/11083", "content": "ATENTION\u203c New - CVE-2016-11025\n\nAn issue was discovered on Samsung mobile devices with software through 2016-09-13 (Exynos AP chipsets). There is a memcpy heap-based buffer overflow in the OTP service. The Samsung ID is SVE-2016-7114 (December 2016).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-04-07T19:18:32.000000Z"}, {"uuid": "9a2c6fa8-6223-4890-87b7-784e23607112", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-11021", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-06-06)", "content": "", "creation_timestamp": "2026-06-06T00:00:00.000000Z"}, {"uuid": "a04a15d1-d61e-4a1b-9da2-e2297a5a8599", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-11021", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-08-29)", "content": "", "creation_timestamp": "2026-08-30T10:00:03.970952Z"}, {"uuid": "4b07d9a1-7816-468a-ba56-d27251e0dd10", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-11021", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/29bcaf4b-fa4a-4651-9fe5-a87a9c60a69d", "content": "", "creation_timestamp": "2026-06-19T12:47:23.667881Z"}, {"uuid": "171d4c1a-f2ba-4742-a54d-6d6220b31f25", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-11021", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/82129a0b-15bc-4486-8b81-f6e7cc6c5a83", "content": "", "creation_timestamp": "2026-06-23T14:05:10.161200Z"}, {"uuid": "e9829b96-ea63-4967-90af-c52f7b016feb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-11023", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mp43citki42k", "content": "\ud83d\udccc CVE-2016-11023 - odata4j 0.7.0 allows ExecuteCountQueryCommand.java SQL injection. NOTE: this product is apparently discontinued. https://www.cyberhub.blog/cves/CVE-2016-11023", "creation_timestamp": "2026-06-25T09:07:06.662831Z"}, {"uuid": "da23ca8b-8cdb-4a11-a443-0344b5e3a7b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-11024", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mp44y5i6cp2d", "content": "\ud83d\udccc CVE-2016-11024 - odata4j 0.7.0 allows ExecuteJPQLQueryCommand.java SQL injection. NOTE: this product is apparently discontinued. https://www.cyberhub.blog/cves/CVE-2016-11024", "creation_timestamp": "2026-06-25T09:37:07.128072Z"}, {"uuid": "00d89852-5cb9-429e-96de-cc31e70d0d52", "vulnerability_lookup_origin": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2016-11021", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/e5f2ea80-e1a4-464f-b55f-d544fac60cd3", "content": "", "creation_timestamp": "2026-06-30T09:40:13.660728Z"}, {"uuid": "6ce037f7-a2ed-4c17-a63b-a65941ca433c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-11021", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-07-07)", "content": "", "creation_timestamp": "2026-07-08T10:00:13.843663Z"}, {"uuid": "ac9047d0-fc2b-4ac5-b3c2-0a21b2be0191", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-11021", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-07-08)", "content": "", "creation_timestamp": "2026-07-09T10:00:05.790621Z"}, {"uuid": "730d74e5-7ec5-48a3-98cb-982eb23c8c29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-11021", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-07-08)", "content": "", "creation_timestamp": "2026-07-09T10:15:12.830458Z"}, {"uuid": "c4e5a236-96a0-475a-97b8-20b8338c7d31", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-11021", "type": "seen", "source": "MISP/c6bff539-f10a-42a7-bc8e-83795d457e7a", "content": "", "creation_timestamp": "2026-07-16T12:15:03.299427Z"}, {"uuid": "8efcbaba-21e0-4c5c-a41c-abb99000ac20", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-11021", "type": "seen", "source": "https://t.me/hacking_Attack/31088", "content": "Black Hat Ethical Hacking\nBotenaGo botnet targets millions of IoT devices with 33 exploits\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png BotenaGo botnet targets millions of IoT devices with 33 exploitsPost Views: 141 \nReading Time: 1 Minute\nThe new\u00a0BotenaGo malware botnet has been discovered using over thirty exploits to attack millions of routers and IoT devices.\nBotenaGo was written in Golang (Go), which has been exploding in popularity in recent years, with malware authors loving it for making payloads that are harder to detect and reverse engineer.\n\nIn the case of BotenaGo, only six out of 62 AV engines on VirusTotal flag the sample as malicious, and some identify it as Mirai.\nhttps://www.bleepstatic.com/images/news/u/1220909/Security/scan.jpg \n<figcaptionBotenaGo goes primarily unnoticed by AV scanners\nSource: AT&T \nSee Also: Complete Offensive Security and Ethical Hacking Course Targeting millions of devicesBotenaGo incorporates 33 exploits for a variety of routers, modems, and NAS devices, with some notable examples given below:\n\n* CVE-2015-2051, CVE-2020-9377, CVE-2016-11021: D-Link routers\n* CVE-2016-1555, CVE-2017-6077, CVE-2016-6277, CVE-2017-6334: Netgear devices\n* CVE-2019-19824: Realtek SDK based routers\n* CVE-2017-18368, CVE-2020-9054: Zyxel routers and NAS devices\n* CVE-2020-10987: Tenda products\n* CVE-2014-2321: ZTE modems\n* CVE-2020-8958: Guangzhou 1GE ONU\n\nResearchers at AT&T\u00a0who analyzed the new botnet found that it targets millions of devices with functions that exploit the above flaws.\n\nAn example given is the search string for Boa, which is a discontinued open-source web server used in embedded applications and one that still returns nearly two million internet-facing devices on Shodan.\nhttps://www.bleepstatic.com/images/news/u/1220909/Security/botenago_shodan.jpg \n<figcaptionShodan search returned 2 million results on Boa\nSource: AT&T \nSee Also: All Windows versions impacted by new LPE zero-day vulnerability Another notable example is the targeting of CVE-2020-10173, a command-injection flaw in Comtrend VR-3033 gateway devices, of which 250,000 are still exploitable.\n\nWhen installed, the malware will listen on two ports (31412 and 19412), where it waits for an IP address to be sent to it. Once one is received, the bot will exploit each vulnerability on that IP address to gain access.\nhttps://www.bleepstatic.com/images/news/u/1220909/Security/mapping.jpg \n<figcaptionBotenaGo mapping attack functions.\nSource: AT&T \nOnce BotenaGo gains access, it will execute remote shell commands to recruit the device into the botnet.\n\nDepending on which device is targeted, the malware uses different links to fetch a matching payload.\n\nAt the time of the analysis, though, there were no payloads on the hosting server, so none could be retrieved for analysis.\nSee Also: Offensive Security Tool: DotDotPwn \u2013 The Directory Traversal Fuzzer Furthermore, the researchers didn\u2019t find an active C2 communication between BotenaGo and an actor-controlled server, so they give three potential explanations on how it operates:\n\n1. BotenaGo is only one part (module) of a multi-stage modular malware attack, and it\u2019s not the one responsible for handling communications.\n2. BotenaGo is a new tool used by Mirai operators on certain machines, a scenario that is backed by common payload dropping links.\n3. The malware isn\u2019t ready to operate yet, and a sample from its early development phase leaked in the wild accidentally.\n\nIn conclusion, the appearance of BotenaGo in the wild is unusual given its incomplete operational status, but its underlying capabilities are leaving no doubt about the int[...]", "creation_timestamp": "2026-09-01T20:02:09.925099Z"}, {"uuid": "cfe312ac-0927-42eb-9d88-663d0ad04c70", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-11021", "type": "seen", "source": "https://t.me/hacking_Attack/31088", "content": "Black Hat Ethical Hacking\nBotenaGo botnet targets millions of IoT devices with 33 exploits\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png BotenaGo botnet targets millions of IoT devices with 33 exploitsPost Views: 141 \nReading Time: 1 Minute\nThe new\u00a0BotenaGo malware botnet has been discovered using over thirty exploits to attack millions of routers and IoT devices.\nBotenaGo was written in Golang (Go), which has been exploding in popularity in recent years, with malware authors loving it for making payloads that are harder to detect and reverse engineer.\n\nIn the case of BotenaGo, only six out of 62 AV engines on VirusTotal flag the sample as malicious, and some identify it as Mirai.\nhttps://www.bleepstatic.com/images/news/u/1220909/Security/scan.jpg \n<figcaptionBotenaGo goes primarily unnoticed by AV scanners\nSource: AT&T \nSee Also: Complete Offensive Security and Ethical Hacking Course Targeting millions of devicesBotenaGo incorporates 33 exploits for a variety of routers, modems, and NAS devices, with some notable examples given below:\n\n* CVE-2015-2051, CVE-2020-9377, CVE-2016-11021: D-Link routers\n* CVE-2016-1555, CVE-2017-6077, CVE-2016-6277, CVE-2017-6334: Netgear devices\n* CVE-2019-19824: Realtek SDK based routers\n* CVE-2017-18368, CVE-2020-9054: Zyxel routers and NAS devices\n* CVE-2020-10987: Tenda products\n* CVE-2014-2321: ZTE modems\n* CVE-2020-8958: Guangzhou 1GE ONU\n\nResearchers at AT&T\u00a0who analyzed the new botnet found that it targets millions of devices with functions that exploit the above flaws.\n\nAn example given is the search string for Boa, which is a discontinued open-source web server used in embedded applications and one that still returns nearly two million internet-facing devices on Shodan.\nhttps://www.bleepstatic.com/images/news/u/1220909/Security/botenago_shodan.jpg \n<figcaptionShodan search returned 2 million results on Boa\nSource: AT&T \nSee Also: All Windows versions impacted by new LPE zero-day vulnerability Another notable example is the targeting of CVE-2020-10173, a command-injection flaw in Comtrend VR-3033 gateway devices, of which 250,000 are still exploitable.\n\nWhen installed, the malware will listen on two ports (31412 and 19412), where it waits for an IP address to be sent to it. Once one is received, the bot will exploit each vulnerability on that IP address to gain access.\nhttps://www.bleepstatic.com/images/news/u/1220909/Security/mapping.jpg \n<figcaptionBotenaGo mapping attack functions.\nSource: AT&T \nOnce BotenaGo gains access, it will execute remote shell commands to recruit the device into the botnet.\n\nDepending on which device is targeted, the malware uses different links to fetch a matching payload.\n\nAt the time of the analysis, though, there were no payloads on the hosting server, so none could be retrieved for analysis.\nSee Also: Offensive Security Tool: DotDotPwn \u2013 The Directory Traversal Fuzzer Furthermore, the researchers didn\u2019t find an active C2 communication between BotenaGo and an actor-controlled server, so they give three potential explanations on how it operates:\n\n1. BotenaGo is only one part (module) of a multi-stage modular malware attack, and it\u2019s not the one responsible for handling communications.\n2. BotenaGo is a new tool used by Mirai operators on certain machines, a scenario that is backed by common payload dropping links.\n3. The malware isn\u2019t ready to operate yet, and a sample from its early development phase leaked in the wild accidentally.\n\nIn conclusion, the appearance of BotenaGo in the wild is unusual given its incomplete operational status, but its underlying capabilities are leaving no doubt about the int[...]", "creation_timestamp": "2026-09-02T01:02:36.212116Z"}]}