Have a look at awesome write up about vulnerable DSL routers in Germany: https://isc.sans.edu/forums/diary/Port+7547+SOAP+Remote+Code+Execution+Attack+Against+DSL+Modems/21759/
Looks like another round for Mirai.
Be aware, port 7547 has nothing to do with TR-069, but some kind of a lame webserver.
P.S. If the bad guys were a bit more discrete and not scanning all over the place, that attack might have had a huge impact.
Looks like another round for Mirai.
Be aware, port 7547 has nothing to do with TR-069, but some kind of a lame webserver.
P.S. If the bad guys were a bit more discrete and not scanning all over the place, that attack might have had a huge impact.
No comments:
Post a Comment