New Mirai Variant Targets Zyxel Network-Attached Storage Devices
Summary: Unit 42 reported that a new Mirai variant called Mukashi abused CVE-2020-9054, a pre-authentication command injection flaw in Zyxel NAS devices running firmware up to 5.21, after a public proof-of-concept appeared last month. The first incident was caught on a Palo Alto Networks firewall at 19:07 UTC on March 12, 2020, and the malware brute forces logins with default credentials, reports successful attempts to its C2 server at 45[.]84[.]196[.]75, and can launch DDoS attacks.
Key Takeaway: The vulnerability carries a CVSS v3.1 score of 9.8 for being trivial to exploit, and the exploit was initially sold as a 0-day before the vendor was told - meaning devices on firmware up to 5.21 were exposed before any patch existed.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2020-9054
- Related
- Zyxel Fixes 0day in Network Storage Devices Cyber Risks ·CVE-2020-9054: Zyxel Multiple NAS Devices OS Command Injection Vulnerability Known Exploited Vulnerabilities · Mar 25, 2022Threat Source newsletter (April 2, 2020) Cyber Risks ·