Remote buffer overflow in mini_httpd/thttpd htpasswd

Successful exploitation can lead to remote code execution on the affected device. In the observed campaigns described in the content, attackers used this class of flaw to compromise SOHO routers and IoT devices, deploy the ShortLeash backdoor, obtain root-level persistence via a systemd service, and convert the devices into operational relay box infrastructure for long-term espionage support and traffic relaying.

Until patches or updated firmware can be applied, reduce exposure of affected devices by restricting access to the embedded HTTP service to trusted management networks only, disabling unnecessary remote administration, filtering untrusted inbound traffic, and monitoring for signs of compromise or unauthorized web service behavior. Given reported in-the-wild exploitation on unpatched SOHO devices, internet-exposed management interfaces using vulnerable embedded HTTP components should be treated as high risk.

Upgrade mini_httpd to version 1.28 or later and thttpd to version 2.28 or later, or apply vendor firmware updates that incorporate the fixed versions of these components. Because the vulnerable software is often embedded in network appliances and IoT products, remediation may require installing updated firmware from the device manufacturer rather than patching the HTTP daemon directly. Devices that cannot be updated should be replaced.