Botnet Hunting for Vulnerabilities in Diagnostic Tools
A botnet has been actively scanning for vulnerabilities in diagnostic tools used by various network devices. Multiple URLs linked to these tools were observed being probed, including those tied to known vulnerabilities like CVE-2024-12856 (Four-Faith routers) and others such as CVE-2020-8949 and CVE-2024-48419. These types of tools are particularly prone to command injection flaws due to improper handling of user inputs when invoking system commands. Experts recommend using safer APIs like Python's subprocess.run over direct shell execution methods to mitigate risks.
This morning, I noticed specific sources "hunting" for vulnerabilities in URLs that I haven't noticed before. All of these URLs appear to be associated with diagnostic tools:
URL Count Vulnerability / 1 (simple recon for index page) /apply.cgi 20 CVE-2024-12856 Four-Faith router command injection /cgi-bin/adv_ping.cgi 20 ? /cgi-bin/diagnostic.cgi 20 CVE-2013-7179 Seowon Intech WiMAX SWU-9100 mobile route /cgi-bin/DiagnosticsMsg.cgi 20 ? /cgi-bin/ping.cgi 20 /cgi-bin/system_mgr.cgi 20 /cgi-bin/traceroute.cgi 20 /diag_ping.cgi 20 CVE-2020-8949 (maybe.. slightly different URL) Gocloud devices /goform/diagTool 20 CVE-2024-48419 (maybe..) Edimax Routers /goform/ping 20 /ping_test.cgi 20 /sys_diag.html 20…