{"id":204342,"date":"2025-01-23T02:34:30","date_gmt":"2025-01-23T08:34:30","guid":{"rendered":"https:\/\/lifeboat.com\/blog\/2025\/01\/hackers-exploit-zero-day-in-cnpilot-routers-to-deploy-airashi-ddos-botnet"},"modified":"2025-01-23T02:34:30","modified_gmt":"2025-01-23T08:34:30","slug":"hackers-exploit-zero-day-in-cnpilot-routers-to-deploy-airashi-ddos-botnet","status":"publish","type":"post","link":"https:\/\/lifeboat.com\/blog\/2025\/01\/hackers-exploit-zero-day-in-cnpilot-routers-to-deploy-airashi-ddos-botnet","title":{"rendered":"Hackers Exploit Zero-Day in cnPilot Routers to Deploy AIRASHI DDoS Botnet"},"content":{"rendered":"<p><a class=\"aligncenter blog-photo\" href=\"https:\/\/lifeboat.com\/blog.images\/hackers-exploit-zero-day-in-cnpilot-routers-to-deploy-airashi-ddos-botnet.jpg\"><\/a><\/p>\n<p>Threat actors are exploiting an unspecified zero-day vulnerability in Cambium Networks cnPilot routers to deploy a variant of the AISURU botnet called AIRASHI to carry out distributed denial-of-service (DDoS) attacks.<\/p>\n<p>According to QiAnXin XLab, the attacks have <a href=\"https:\/\/blog.xlab.qianxin.com\/large-scale-botnet-airashi-en\/\" rel=\"noopener\" target=\"_blank\">leveraged<\/a> the security flaw since June 2024. Additional details about the shortcomings have been withheld to prevent further abuse.<\/p>\n<p>Some of the other flaws weaponized by the distributed denial-of-service (DDoS) botnet include <a href=\"https:\/\/www.tenable.com\/cve\/CVE-2013-3307\" rel=\"noopener\" target=\"_blank\">CVE-2013\u20133307<\/a>, <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/cve-2016-20016\" rel=\"noopener\" target=\"_blank\">CVE-2016\u201320016<\/a>, <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/cve-2017-5259\" rel=\"noopener\" target=\"_blank\">CVE-2017\u20135259<\/a>, <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/cve-2018-14558\" rel=\"noopener\" target=\"_blank\">CVE-2018\u201314558<\/a>, <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2020-25499\" rel=\"noopener\" target=\"_blank\">CVE-2020\u201325499<\/a>, <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/cve-2020-8515\" rel=\"noopener\" target=\"_blank\">CVE-2020\u20138515<\/a>, <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/cve-2022-3573\" rel=\"noopener\" target=\"_blank\">CVE-2022\u20133573<\/a>, <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-40005\" rel=\"noopener\" target=\"_blank\">CVE-2022\u201340005<\/a>, <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-44149\" rel=\"noopener\" target=\"_blank\">CVE-2022\u201344149<\/a>, <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/cve-2023-28771\" rel=\"noopener\" target=\"_blank\">CVE-2023\u201328771<\/a>, as well as those impacting AVTECH IP cameras, LILIN DVRs, and Shenzhen TVT devices.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Threat actors are exploiting an unspecified zero-day vulnerability in Cambium Networks cnPilot routers to deploy a variant of the AISURU botnet called AIRASHI to carry out distributed denial-of-service (DDoS) attacks. According to QiAnXin XLab, the attacks have leveraged the security flaw since June 2024. Additional details about the shortcomings have been withheld to prevent further [\u2026]<\/p>\n","protected":false},"author":427,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[34],"tags":[],"class_list":["post-204342","post","type-post","status-publish","format-standard","hentry","category-cybercrime-malcode"],"_links":{"self":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/204342","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/users\/427"}],"replies":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/comments?post=204342"}],"version-history":[{"count":0,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/204342\/revisions"}],"wp:attachment":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/media?parent=204342"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/categories?post=204342"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/tags?post=204342"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}