InfoSecBulletin Cybersecurity for mankind
CVE-2024-7029 is a remote code execution (RCE) vulnerability in AVTECH IP cameras. It allows attackers to run commands remotely and gain higher system privileges. By exploiting this vulnerability, attackers could spread the Mirai botnet malware quickly.
Although the affected camera models are no longer being produced, they are still used in many different areas, including critical infrastructure. This shows the ongoing difficulty of handling older systems and the possible negative outcomes if their security flaws are not addressed. The Cybersecurity and Infrastructure Security Agency (CISA) has warned about the seriousness of this vulnerability, mentioning how easy it is to exploit and the potential for significant consequences.
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
Cl0p Ransomware Listed 40+ Victims of PTC Windchill Campaign
Oracle Issues 943 Security Patches, Including Critical WebLogic Flaw
500+ critical infrastructure hit by Medusa ransomware
Critical WordPress Plugin Flaw Exposes 600,000 Sites to Attacks
The botnet attack using CVE-2024-7029 is not the only one. Akamai researchers found that the attackers are also going after other vulnerabilities, including ones in AVTECH devices, a Hadoop YARN RCE, CVE-2014-8361, and CVE-2017-17215.
The botnet in question is spreading a Mirai variant, named “Corona,” which has been linked to the COVID-19 pandemic since 2020. Upon infection, this variant aggressively scans and attempts to exploit additional vulnerabilities, including those in Huawei devices, to expand its reach and reinforce its command and control infrastructure.
On March 18, 2024, the Akamai SIRT detected the first active botnet campaign. The activity began in December 2023. The proof of concept (PoC) for CVE-2024-7029 has been available since 2019, but it was officially assigned a CVE in August 2024.
