Loading story…
Attackers exploited CVE-2017-17215, a command-injection vulnerability in Huawei HG532 home routers, to distribute the Mirai-derived Satori/Okiru malware. Check Point reported hundreds of thousands of exploitation attempts worldwide in 2017. The flaw exposed a TR-064 service on WAN port 37215, allowing attackers to abuse the DeviceUpgrade process to download and execute malware. Infected routers could launch command-and-control-directed UDP and TCP floods against individual targets or subnets. Researchers linked the campaign to the suspected operator Nexus Zeta, but attribution remained unconfirmed. Huawei patched the vulnerability following coordinated disclosure and recommended firewall protections and changing default passwords.
GreyNoise data dated October 9, 2026, lists 1,545 scanner IP addresses matching its Huawei HG532 CVE-2017-17215 remote-code-execution attempt tag, all classified as malicious and not spoofable. Pakistan accounts for 1,146 source IPs, and every listed scanner targeted the United States. Overlapping signatures include Mirai scanning and exploitation attempts against GPON routers and CCTV devices; the ten displayed records were last seen that day and had unknown actor attribution. These observations establish continued scanning and attempted exploitation—not confirmed infections or continuity with the original Satori campaign. Organizations should verify that affected routers are patched or retired, restrict WAN access to management services, and monitor for exploitation attempts against port 37215.
See which actors are running it and whether you're in range.
8 events from the most recent confirmed update back to the earliest known activity.
Ten displayed scanner records matching GreyNoise's CVE-2017-17215 exploitation-attempt query were last seen on October 9, 2026; nine also carried a Mirai TCP Scanner tag. These observations document scanning and attempted exploitation, not confirmed compromises or attribution to the original Satori operator.
Huawei issued an updated notice warning that malicious packets sent to port 37215 could enable remote code execution on vulnerable routers. It recommended configuring the built-in firewall, changing the default password, or using a carrier-side firewall.
During the observed malicious activity, the HackForums user Nexus Zeta posted a request for help compiling Mirai and setting up a Mirai Telnet botnet. Researchers later cited this activity when assessing the suspected operator's experience.
Check Point first detected attacks delivering the Mirai variant OKIRU/SATORI through CVE-2017-17215 on November 23, 2017. Researchers reported hundreds of thousands of exploitation attempts worldwide, with notable activity in the United States, Italy, Germany, and Egypt.
Researchers linked the registration email for nexusiotsolutions[.]net to Nexus Zeta's HackForums account and associated online accounts. Attribution remained unconfirmed, and researchers could not determine how the suspected operator obtained the exploit.
Researchers documented command injection through DeviceUpgrade parameters in the WAN-exposed TR-064 service on port 37215, allowing malware download and execution. They also published payload hashes and described Satori's command-and-control protocol and UDP/TCP flooding capabilities.
Huawei patched CVE-2017-17215 and updated customers after receiving Check Point's private disclosure. The supplied content does not specify the patch release date.
After confirming its findings, Check Point privately disclosed the Huawei HG532 command-injection vulnerability to Huawei.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 14 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
viz.greynoise.io
Open sourcethreatpost.com
Open sourceresearch.checkpoint.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Check Point Research disclosed active exploitation of a zero-day command injection flaw in Huawei HG532 home routers, tracked as **CVE-2017-17215**, after detecting widespread attacks against port `37215`. The exploit was used to install **OKIRU/SATORI**, an updated **Mirai** variant that converts compromised routers into DDoS bots and communicates with its command-and-control infrastructure over a custom protocol. Researchers said the activity was observed globally, with notable concentrations in the United States, Italy, Germany, and Egypt. Huawei issued a patch after coordinated disclosure, while Check Point linked the campaign to a suspected actor using the nickname **"Nexus Zeta"** based on domain registration and online persona overlaps. The researchers assessed the operator as relatively unskilled despite leveraging a zero-day exploit, underscoring how leaked botnet code and exposed IoT devices can enable large-scale botnet recruitment and downstream denial-of-service operations.
Jul 12, 2026
A threat actor using the alias **Anarchy** reportedly assembled a botnet of roughly **18,000 compromised Huawei HG532 routers in a single day** by exploiting **`CVE-2017-17215`**, a remote command execution flaw that had already been abused by Mirai-derived malware and Satori variants. The campaign highlighted how long-known weaknesses in internet-facing SOHO and IoT devices continue to provide attackers with a large pool of systems for botnet growth and potential **DDoS** or other criminal activity. Public exploit details for **`CVE-2017-17215`** showed that attackers could send a crafted **SOAP** request to the router's **UPnP `WANPPPConnection` service on port `37215`** and inject shell commands through the `NewStatusURL` field of the `Upgrade` action, using the default credentials **`dslf-config/admin`**. Reporting also indicated that the actor planned to expand operations by targeting **`CVE-2014-8361`** in **Realtek-based routers** via **port `52869`**, suggesting broader efforts to scale router-based botnet infections across poorly secured edge devices.
Sep 3, 2026
CUJO AI’s IoT botnet research found a sharp increase in malware carrying vulnerability exploits, while an older Huawei router flaw remained overwhelmingly dominant. Across protected consumer networks monitored from July 2022 through January 2023, researchers identified 6,471 malicious ELF binaries, including 1,685 containing exploits. The exploit-bearing share rose from 8% in the company’s 2021 study to 26%, and the number of targeted vulnerabilities increased from 20 to 55. **CVE-2017-17215**, affecting Huawei HG532 routers, appeared in 1,625 exploit-bearing binaries. Zerobot carried the largest exploit set, with 22 entries; Sysrv, Enemybot and an unnamed Go-based sample also incorporated relatively recent vulnerabilities. The findings highlight persistent exposure from unpatched legacy devices alongside newer attack paths. Separate references identify security issues in Eir’s D1000 modem and Realtek SDK components used across hundreds of thousands of downstream devices, underscoring the need to track both device firmware and embedded dependencies. Qualys’ PwnKit advisory covers **CVE-2021-4034**, a local privilege-escalation flaw in polkit’s pkexec, rather than a standalone remote entry point. Defenders should prioritize exposed-device inventories, firmware remediation, replacement of unsupported equipment and network segmentation. CUJO AI also documented malformed or potentially nonfunctional exploit implementations: **an exploit’s presence in malware does not establish successful compromise**.
Oct 9, 2026