Threat Source newsletter for July 23, 2020
Summary: Cisco Talos documented what it believes is the first record of a new botnet it calls "Prometei," which mines for Monero and saps computing power from unsuspecting victims. The same newsletter notes CISA's warning that CVE-2020-6287 in SAP NetWeaver's Java LM Configuration Wizard could give an attacker unrestricted access to create user accounts and execute arbitrary commands, and that Cisco disclosed 33 vulnerabilities in its RV series routers and firewalls, one of which, CVE-2020-3330, lets an adversary take over a device if the pre-installed default admin credentials were never reset.
Why it matters: A miner running quietly in the background is a signal that someone already has a foothold, and the SAP flaw lets an attacker mint their own accounts on systems that run core business processes. The Cisco router bug needs only one unchanged default admin password to hand over the device.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2020-3330CVE-2020-6287
- Related
- CVE-2020-6287: SAP Net Weaver Missing Authentication for Critical Function Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026