CVE-2023-25717

Vulnerability updated 7 days ago (2024-11-29T14:04:27.395Z)
Download STIX
Preview STIX
CVE-2023-25717 is a software vulnerability, specifically a flaw in the design or implementation of the Ruckus AP remote code execution. In April 2023, FortiGuard Labs observed a unique botnet leveraging this vulnerability, utilizing the SOCKS protocol for distribution. This incident represents a significant cybersecurity concern as it allows malicious actors to exploit the vulnerability to gain unauthorized access and control over affected systems. The impact of CVE-2023-25717 was severe enough that the Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities (KEV) catalog in May 2023. The inclusion in the KEV catalog indicates that the vulnerability has been actively exploited in the wild and poses a significant risk to unpatched systems. CISA's acknowledgment underscores the need for immediate attention and remediation from organizations using the vulnerable software. Alongside CVE-2023-25717, CISA added six other vulnerabilities to its KEV catalog. These include a Red Hat Polkit privilege escalation (CVE-2021-3560), two Linux kernel privilege escalations (CVE-2014-0196 and CVE-2010-3904), a Jenkins UI information disclosure (CVE-2015-5317), an Apache Tomcat remote code execution (CVE-2016-8735), and an Oracle Java SE and JRockit issue (CVE-2016-3427). The addition of these vulnerabilities to the catalog highlights the ongoing need for organizations to remain vigilant and proactive in their cybersecurity efforts.
Description last updated: 2024-05-04T16:36:12.513Z
What's your take? (Question 1 of 4)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Aliases We are not currently tracking any aliases
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Vulnerability
Botnet
Ddos
Fortiguard
Analyst Notes & Discussion
Be the first to leave your mark here! Log in to share your views and vote.
Associated Malware
To see the evidence that has resulted in these malware associations, create a free account
Alias DescriptionAssociation TypeVotes
The Andoryubot Malware is associated with CVE-2023-25717. AndoryuBot is a relatively new botnet malware that first appeared in February 2023. It exploits vulnerabilities in Ruckus devices, enabling it to gain unauthorized access and compromise the target device. The malware contains DDoS attack modules for different protocols and communicates with its commUnspecified
3
Source Document References
Information about the CVE-2023-25717 Vulnerability was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
PreviewSource LinkCreatedAtTitle
CERT-EU
a year ago
CERT-EU
a year ago
CERT-EU
a year ago
CERT-EU
a year ago
CERT-EU
2 years ago
Fortinet
2 years ago
CERT-EU
2 years ago
CERT-EU
2 years ago
CERT-EU
2 years ago
Securityaffairs
2 years ago
InfoSecurity-magazine
2 years ago
CERT-EU
2 years ago
CERT-EU
2 years ago
CERT-EU
2 years ago
CERT-EU
2 years ago
CERT-EU
2 years ago
CERT-EU
2 years ago
CERT-EU
2 years ago
CERT-EU
2 years ago
CISA
2 years ago