Mirai Variant Nexcorium Exploits CVE-2024-3721 to Hijack TBK DVRs for DDoS Botnet
Summary: Fortinet FortiGuard Labs and Palo Alto Networks Unit 42 reported threat actors exploiting CVE-2024-3721, a medium-severity command injection flaw (CVSS 6.3) in TBK DVR-4104 and DVR-4216 devices, to deliver a Mirai variant called Nexcorium that displays the message "nexuscorp has taken control." Nexcorium carries XOR-encoded configuration, a watchdog module, a DDoS attack module, an exploit for CVE-2017-17215 against Huawei HG532 devices, and hard-coded credentials for Telnet brute-forcing, setting persistence via crontab and systemd before deleting its downloaded binary.
What's compelling: The same CVE-2024-3721 has now been used to deploy both Mirai and the newer RondoDox botnet over the past year, and the affected TBK DVRs and end-of-life TP-Link routers carry no patch path - leaving replacement, not remediation, as the only real option.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2017-17215CVE-2023-33538CVE-2024-3721
- Related
- CVE-2023-33538: TP-Link Multiple Routers Command Injection Vulnerability Known Exploited Vulnerabilities · Jun 16, 2025