At The Edge Clear: March 23-30, 2026

Summary: GreyNoise reported that four source IPs from AS215925 collectively exploited 22+ vulnerabilities against Hikvision cameras, MikroTik routers, TP-Link devices, D-Link NAS, and consumer DVRs across 3,347,443 combined sessions in a botnet recruitment operation. Six AWS-hosted IPs sharing identical fingerprints and rDNS (scan.visionheight[.]com) mapped management interfaces across Palo Alto, Sophos, Ivanti, Citrix, F5, and ConnectWise platforms in 5,892,055 combined sessions checking for authentication bypass vulnerabilities.
Bottom line: Daily sessions quadrupled from 8.5M to 36.6M between Tuesday and Thursday as at least four independent scanning operations, including ICS/SCADA protocol reconnaissance, activated new infrastructure at once - and CVE-2025-55182 (CVSS 10.0) is now chained with Next.js CVE-2025-29927 (CVSS 9.1) to defeat authentication and application security layers in a single operation.

Read the original at GreyNoise Blog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2025-55182
Related: CVE-2025-55182: Meta React Server Components Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Dec 05, 2025
React Server Components remote code execution (React2Shell) Cyber Risks ·
How to detect React2Shell with Burp Suite Cyber Risks ·