ClingSTUN Turns Vulnerable IoT Devices Into Proxy Nodes

FortiGuard Labs has discovered a new Linux backdoor called ClingSTUN that compromises Internet-exposed IoT devices by chaining together at least 24 known vulnerabilities, including CVE-2021-36380 in Sunhillo SureLine and the newer CVE-2026-36356 affecting MeiG Smart FORGE_SLT711 hardware. Vulnerable products come from vendors such as D-Link, Realtek, Ivanti, and TP-Link, spanning routers, surveillance systems, and industrial equipment. Rather than relying on a conventional command-and-control server, the malware abuses legitimate public STUN servers to learn how infected devices appear externally and which ports are reachable, blending its traffic with normal VoIP/WebRTC activity. ClingSTUN also carries seven additional hard-coded exploits—ranging from the decade-old CVE-2014-8361 to the recent CVE-2026-87827 in KGUARD DVRs—to spread further and turn compromised devices into proxy nodes, risking IP blocklisting, data exposure, and lateral access into internal networks.