Loading story…
Botnet operators have targeted a critical command-injection flaw in BYTEVALUE Intelligent Flow Control Routers, tracked as CVE-2023-7311 with a CVSS v4.0 score of 9.3. Improper validation of the path parameter at /goform/webRead/open allows remote attackers to execute arbitrary shell commands without authentication or user interaction, potentially compromising the router and its management functions. The CVE record references publicly available exploits and reports that the RondoDox botnet campaign has targeted the vulnerability; VulnCheck also published a dedicated advisory.
Earlier SANS Internet Storm Center honeypot observations documented attempts against the same endpoint, then associated with BYTEVALUE routers but without an identified CVE or located patch. The payload attempted to delete files and download and execute bruh.sh from 192.3.152.183, which subsequently retrieved malware binaries for multiple processor architectures. An examined UPX-packed binary was identified by antivirus engines as a Mirai variant and contained strings referencing other router exploits. Those observations did not establish successful compromise of production routers. Organizations operating affected devices should restrict internet-facing management access, verify remediation options with the vendor, and investigate suspicious downloads or unexpected outbound traffic.
See which actors are running it and whether you're in range.
6 events from the most recent confirmed update back to the earliest known activity.
VulnCheck published CVE-2023-7311 for unauthenticated command injection through the /goform/webRead/open path parameter in BYTEVALUE Intelligent Flow Control Routers. The record assigns a critical CVSS v4.0 score of 9.3, marks the vulnerability as known exploited, and references a public Nuclei exploit template.
VulnCheck reported observing the RondoDox botnet campaign targeting the BYTEVALUE router command-injection vulnerability. The source does not specify when the campaign activity occurred.
Johannes B. Ullrich analyzed a UPX-packed payload containing references to other router exploits and uploaded the previously unlisted sample to VirusTotal, where detections identified it as a Mirai variant. He could not identify a specific CVE or locate a patch for the suspected BYTEVALUE vulnerability.
Honeypots observed shell commands injected through the endpoint's path parameter to delete files and download and execute bruh.sh from 192.3.152.183. The script retrieves and launches binaries for multiple processor architectures; successful compromise of production routers was not confirmed.
SANS honeypot sensors detected requests targeting /goform/webRead/open before observing requests containing a command-injection payload.
A Chinese blog post associated the /goform/webRead/open endpoint with a vulnerability in BYTEVALUE routers. Ullrich later cited the post when investigating exploit attempts.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
4 references tracked. Mallory keeps watching after this page renders.
cve.org
Open sourcevulncheck.com
Open sourceisc.sans.edu
Open sourceisc.sans.edu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A Mirai-based malware campaign is actively exploiting **CVE-2025-29635**, a high-severity command-injection flaw in end-of-life **D-Link DIR-823X** routers, marking the first reported in-the-wild abuse of the vulnerability since its public disclosure and proof-of-concept release in 2025. Akamai said it began seeing attacks in early March 2026 through crafted `POST` requests to the `/goform/set_prohibiting` endpoint, where unsanitized input reaches `system()` and enables remote command execution on affected firmware versions **240126** and **240802**. The activity targets discontinued devices unlikely to receive vendor fixes, increasing exposure for organizations still running the routers. The attackers use the exploit to fetch and run a shell script that installs a Mirai variant dubbed **tuxnokill**, which retains common Mirai strings while using XOR obfuscation with key `0x30`. Akamai linked the same actor to similar Mirai deployment patterns against **TP-Link AX21** devices via **CVE-2023-1389** and against **ZTE ZXV10 H108L** routers through another remote code execution flaw, underscoring continued botnet weaponization of older, publicly documented vulnerabilities. Security advisories recommend replacing unsupported D-Link hardware, restricting exposed administrative interfaces, and rapidly remediating known router flaws before they are folded into botnet operations.
Jun 29, 2026
**RondoDox** has expanded into a large-scale botnet campaign that targets **174 vulnerabilities** across a wide range of internet-exposed devices, with researchers observing up to **15,000 daily exploitation attempts**. Reporting based on **Bitsight** telemetry says the botnet, active since 2025 and built on a **Mirai** code base, is more focused than typical Mirai-derived operations: it is geared toward **denial-of-service activity** and supports **18 architectures**, enabling attacks against routers, DVRs, NVRs, CCTV systems, web servers, and other embedded or Linux-based hardware. Analysts mapped **148 exploits to CVEs**, identified **15 public PoCs without CVEs**, and found **11 exploits with no public PoC**, indicating active exploit collection and rapid weaponization of newly disclosed flaws. The campaign has evolved from earlier exploitation of **TP-Link Archer AX21** flaw `CVE-2023-1389` and later abuse of `CVE-2024-3721`, `CVE-2024-12856`, and the **React2Shell** issue `CVE-2025-55182` affecting **Next.js** servers. Researchers also reported that the operators use **residential IP infrastructure** and traffic patterns that mimic gaming or VPN services to reduce detection, while showing the ability to deploy some exploits within days of disclosure and, in at least one case, exploit `CVE-2025-62593` before its CVE record was formally published. This activity reflects a sustained, strategically managed botnet operation rather than opportunistic scanning, with broad exploit coverage and infrastructure choices designed to improve reach and resilience.
Jun 29, 2026
A botnet campaign is scanning web-exposed router and network-device diagnostic interfaces for command-injection flaws in features such as **ping**, **traceroute**, and other troubleshooting tools. Internet Storm Center observed repeated automated requests against multiple diagnostic-related URL paths tied to known or suspected vulnerabilities, including `CVE-2024-12856` in Four-Faith routers, `CVE-2013-7179` in Seowon Intech WiMAX `SWU-9100` devices, `CVE-2020-8949` in Gocloud devices, and possibly `CVE-2024-48419` in Edimax routers. The activity indicates broad reconnaissance to identify devices where user input can be turned into shell commands, though the reporting does not confirm that every probed endpoint was vulnerable or successfully exploited. The coverage highlights why diagnostic utilities are a recurring weakness: they often pass user-supplied values into operating-system commands through unsafe string concatenation. Defenders are urged to disable remote administration where possible, limit management access to trusted networks, apply firmware updates, and replace unsupported hardware, while developers are advised to use argument-separated execution methods instead of building shell commands directly from web input.
Aug 5, 2026