React Server Components Exploitation Consolidates as Two IPs Generate Majority of Attack Traffic
Summary: Two months after CVE-2025-55182, a CVSS 10.0 pre-authentication remote code execution flaw in React Server Components disclosed December 3, 2025, GreyNoise telemetry shows two IP addresses now account for 56% of all exploitation attempts, down from 1,083 unique sources. One source (87.121.84[.]24) retrieves an XMRig cryptomining binary from staging servers, while the other (193.142.147[.]209) opens a reverse shell to the scanner IP on port 12323, and GreyNoise recorded 1,419,718 exploitation attempts over the seven-day period.
Bottom line: Exploitation requires only a single HTTP POST request and a public Metasploit module has been available since shortly after disclosure, so any unpatched React Server Components instance should be assumed already targeted. The cryptomining staging server at 205.185.127[.]97 has hosted attacker-controlled domains since at least 2020, and adjacent IPs in the same /24 are serving Mirai and Gafgyt variants against MIPS and ARM architectures.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-55182
- Related
- CVE-2025-55182: Meta React Server Components Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Dec 05, 2025How to detect React2Shell with Burp Suite Cyber Risks ·