Webserver Rce

Webserver RCE is a software vulnerability, a flaw in the design or implementation of software that can be exploited by malicious actors. One such actor is Kyton, a Gafgyt/Mirai hybrid botnet, which reuses code from other Mirai variants to exploit several vulnerabilities including CVE-2017-17215 (Huawei Router HG532), JAWS Webserver RCE, and CVE-2014-8361 (Realtek SDK). These vulnerabilities allow the botnet to gain unauthorized access to systems and potentially cause significant damage. Initial access by the UNSTABLE Botnet, another variant of Mirai, specifically targets the JAWS Webserver RCE vulnerability, also known as CVE-2016-20016. This botnet retrieves the downloader script "jaws" from an identified IP address. The script includes multiple binary files for 13 different architectures, which are executed using the parameter “jaws.exploit”. The UNSTABLE Botnet uses XOR encoding for its configuration, adding an additional layer of complexity to its operations. There has been a notable spike in IPS detections related to MVPower CCTV DVR models, also vulnerable to the JAWS webserver RCE (CVE-2016-20016). This vulnerability was previously seen to be exploited in the wild through 2017 and continues to be a threat. The advisory emphasizes the importance of addressing these vulnerabilities promptly to prevent potential exploitation and subsequent damage.