Satori: Mirai Botnet Variant Targeting Vantage Velocity Field Unit RCE Vulnerability
Summary: On Feb. 20, 2021, Unit 42 researchers observed exploit attempts against CVE-2020-9020, a remote command execution vulnerability in Iteris' Vantage Velocity field unit versions 2.3.1, 2.4.2 and 3.0, rated CVSS 3.1 9.8. The exploit spread Satori, a Mirai botnet variant, by downloading the file arm7 from server 198[.]23[.]238[.]203 via wget and changing its permissions so it could execute with current user privileges.
Why it matters: The vulnerable devices lack a check on the htmlNtpServer parameter of /cgi-bin/timeconfig.py, letting crafted HTTP requests run commands on the device - and the hosting server held nine samples built for multiple mainstream architectures, so the same infrastructure can be repointed at other targets.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- OT / ICS & Critical Infrastructure
- Mentions
- CVE-2020-9020
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026