Botnet Is Hunting Router Ping Tools That Can Turn User Input Into Shell Commands

A botnet campaign is probing routers for weak spots in diagnostic features This article explores commands suggesting botnet. . Similar exposure from older router botnets occurred when unsupported hardware remained online.

Analysts at Internet Storm Center observed recurring patterns in requests for diagnostic-tool URLs, revealing sources frequently requesting routes associated with known router command-injection vulnerabilities and unaddressed paths. It demonstrates automated operators probing routers to find devices where diagnostic fields can be manipulated into executing shell commands, suggesting botnet activity targeting ping tool availability on compromised systems. Users should remove remote administration access unless it is essential, install available firmware updates, change default credentials, and replace equipment that no longer receives fixes.

Indicators of Compromise (IoCs):- Type Indicator Description URL path / Root-path reconnaissance request observed 20 times URL path /apply.cgi Route associated with CVE-2024-12856, observed 20 times URL path /cgi-bin/adv_ping.cgi? Diagnostic endpoint requests totaling 20 occurrences URL: /cgi-bin/ping.cgi - Ping diagnostic endpoint requested 20 times URL: /cgi-bin/system_mgr.cgi - System-management endpoint requested 20 times URL: /cgi-bin/traceroute.cgi - Traceroute diagnostic endpoint requested 20 times URL: /diag_ping.cgi - Ping diagnostic endpoint requested 20 times URL: /goform/diagTool - Route potentially linked to CVE-2020-8949, observed 20 times URL: /goform/ping - Ping endpoint requested 20 times URL: /ping_test.cgi - Ping test endpoint requested 20 times URL: /sys_diag.html - Route potentially related to CVE-2024-48419, observed 20 times