Unpatchable 0-day in surveillance cam is being exploited to install Mirai
A zero-day vulnerability in AVTECH's AVM1203 surveillance camera allows remote command execution and has been exploited to spread Mirai malware. Users are advised to replace unsupported devices and secure IoT systems.
Read original article
A critical zero-day vulnerability, tracked as CVE-2024-7029, has been discovered in the AVM1203 surveillance camera manufactured by AVTECH. This vulnerability, which has been known since at least 2019, allows attackers to remotely execute commands and has been exploited since March 2024 to install a variant of the Mirai malware. The AVM1203 is no longer sold or supported, meaning no updates are available to address this issue. The attacks have been observed targeting various organizations, although there is no evidence that the attackers are monitoring video feeds from the compromised cameras. The vulnerability is exploited through a command injection flaw in the camera's software, specifically in the brightness function of a CGI script. The malware connects to multiple hosts via Telnet and has been linked to other known vulnerabilities. Given the lack of support for the AVM1203, users are advised to replace the device and ensure that all Internet-connected devices are secured with unique credentials.
- A zero-day vulnerability in AVTECH's AVM1203 camera is being exploited to spread Mirai malware.
- The vulnerability allows remote command execution and has been active since March 2024.
- The AVM1203 is no longer supported, leaving users without a fix for the vulnerability.
- Attackers have targeted various organizations but have not been seen monitoring video feeds.
- Users are advised to replace unsupported devices and secure IoT devices with unique credentials.
Related
Telegram zero-day for Android allowed malicious files to masquerade as videos
Researchers found a zero-day exploit in Telegram for Android, named EvilVideo. Telegram fixed it in versions 10.14.5+. Attackers could send malicious files as videos. Exploit sold on forum. Patched version prevents automatic downloads. Threat actor unknown.
The Wild West of Proof of Concept Exploit Code (PoC)
CVE-2024-6387 is a serious unauthenticated remote code execution vulnerability in OpenSSH, with complex exploitation requiring knowledge of system architecture. The exploit code contains malicious elements, emphasizing risks of untrusted code.
Windows 0-day was exploited by North Korea to install advanced rootkit
North Korean hackers exploited a Windows zero-day vulnerability, CVE-2024-38193, to install the undetectable FudModule rootkit, targeting sensitive sectors while Microsoft delayed patching for six months.
New 0-Day Attacks Linked to China's 'Volt Typhoon'
Malicious hackers linked to China's Volt Typhoon group are exploiting a zero-day vulnerability in Versa Director, urging customers to update systems to prevent potential disruptions to critical U.S. infrastructure.
Hackers infect ISPs with malware that steals customers' credentials
Hackers linked to the Chinese government exploited a zero-day vulnerability in the Versa Director platform, affecting U.S. ISPs, allowing credential capture via malware before hashing. The vulnerability was patched.
0 commentsRelated
Telegram zero-day for Android allowed malicious files to masquerade as videos
Researchers found a zero-day exploit in Telegram for Android, named EvilVideo. Telegram fixed it in versions 10.14.5+. Attackers could send malicious files as videos. Exploit sold on forum. Patched version prevents automatic downloads. Threat actor unknown.
The Wild West of Proof of Concept Exploit Code (PoC)
CVE-2024-6387 is a serious unauthenticated remote code execution vulnerability in OpenSSH, with complex exploitation requiring knowledge of system architecture. The exploit code contains malicious elements, emphasizing risks of untrusted code.
Windows 0-day was exploited by North Korea to install advanced rootkit
North Korean hackers exploited a Windows zero-day vulnerability, CVE-2024-38193, to install the undetectable FudModule rootkit, targeting sensitive sectors while Microsoft delayed patching for six months.
New 0-Day Attacks Linked to China's 'Volt Typhoon'
Malicious hackers linked to China's Volt Typhoon group are exploiting a zero-day vulnerability in Versa Director, urging customers to update systems to prevent potential disruptions to critical U.S. infrastructure.
Hackers infect ISPs with malware that steals customers' credentials
Hackers linked to the Chinese government exploited a zero-day vulnerability in the Versa Director platform, affecting U.S. ISPs, allowing credential capture via malware before hashing. The vulnerability was patched.