Grey Noise and Trinity Cyber have observed active exploitation attempts using weaknesses found in CVE-2023-1389 against TP-Link Archer gigabit routers. The blog post provides information about a new Grey Noise tag for this activity as well as details on the exploit attempt and how organizations can keep themselves safe from harm.
Summary: GreyNoise, working with partner Trinity Cyber, published a new tag for scan traffic tied to CVE-2023-1389, a pre-auth command injection weakness in TP-Link Archer routers, and reports no successful injection detected to date. Tenable originally identified the weakness and says successful exploitation is only likely across WAN interfaces under rare conditions, while the Zero Day Initiative reports telemetry suggesting the Mirai botnet has added the exploit to its arsenal.
What's compelling: Trinity Cyber observed IP address 193.32.162.189 actively engaged in current exploitation attempts, and ZDI's telemetry ties the activity to the Mirai botnet - a reminder that a router flaw rated hard to exploit on the WAN is still being tried in the wild against remote workers' home equipment.
Read the original at GreyNoise Blog ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2023-1389
- Related
- CVE-2023-1389: TP-Link Archer AX-21 Command Injection Vulnerability Known Exploited Vulnerabilities · May 01, 2023Anti-DDoS Firm Heaped Attacks on Brazilian ISPs Cyber Risks ·