Tag: react2shell

8 Attack Reports | 0 Vulnerabilities

Attack reports

RondoDoX Botnet Weaponizes React2Shell

A persistent nine-month RondoDoX botnet campaign has been targeting IoT devices and web applications. The threat actors have recently shifted to weaponizing a critical Next.js vulnerability, deploying malicious payloads like 'React2Shell' and cryptominers. The campaign, spanning from March to Decem…
iot
botnet
mirai
cryptominer
vulnerability exploitation
command and control
next.js
rondodox
react2shell
2025-12-29
rondo
web application
Published: December 29, 2025
Downloadable IOCs: 7

Defending against the CVE-2025-55182 (React2Shell) vulnerability in React Server Components

CVE-2025-55182, also known as React2Shell, is a critical pre-authentication remote code execution vulnerability affecting React Server Components and related frameworks. With a CVSS score of 10.0, it allows attackers to execute arbitrary code on vulnerable servers through a single malicious HTTP re…
vulnerability
remote code execution
vshell
snowlight
CVE-2025-55182
react2shell
2025-12-15
etherrat
Published: December 15, 2025
Linked vulnerabilities : CVE-2021-26855, CVE-2021-26858, CVE-2021-26857, CVE-2021-27065, CVE-2025-55182 (CVSS 10.0), CVE-2025-66478
Downloadable IOCs: 50

Multiple Threat Actors Exploit React2Shell (CVE-2025-55182)

A critical remote code execution vulnerability in React Server Components, CVE-2025-55182, has been widely exploited by various threat actors. China-nexus espionage groups and financially motivated actors have been observed leveraging this vulnerability to deploy malware such as MINOCAT tunneler, S…
remote code execution
CVE-2025-55182
react2shell
2025-12-13
Published: December 13, 2025
Linked vulnerabilities : CVE-2025-55182 (CVSS 10.0), CVE-2025-66478, CVE-2025-55184 (CVSS 7.5), CVE-2025-55183 (CVSS 5.3), CVE-2025-67779 (CVSS 7.5)
Downloadable IOCs: 7

React2Shell flaw (CVE-2025-55182) exploited for remote code execution

A critical vulnerability called 'React2Shell' (CVE-2025-55182) affecting React Server Components has been widely exploited. The flaw allows remote code execution through unsafe handling of incoming data during deserialization. Over 165,000 vulnerable IP addresses have been identified. Post-exploita…
persistence
remote code execution
obfuscated javascript
vshell
snowlight
deserialization
CVE-2025-55182
react2shell
2025-12-12
etherrat
linux loaders
state-sponsored attacks
Published: December 12, 2025
Linked vulnerabilities : CVE-2025-55182 (CVSS 10.0)
Downloadable IOCs: 3

PeerBlight Linux Backdoor Exploits React2Shell CVE-2025-55182

A critical vulnerability in React Server Components (CVE-2025-55182) is being exploited across various organizations. Attackers are deploying cryptominer malware, a Linux backdoor called PeerBlight, a reverse proxy tunnel named CowTunnel, and a Go-based post-exploitation implant dubbed ZinFoq. Peer…
post-exploitation
linux backdoor
CVE-2025-55182
react2shell
2025-12-10
bittorrent dht
cowtunnel
kaiji
peerblight
zinfoq
Published: December 10, 2025
Linked vulnerabilities : CVE-2025-30406, CVE-2025-55182 (CVSS 10.0), CVE-2025-66478
Downloadable IOCs: 36

React2Shell Deep Dive: CVE-2025-55182 Exploit Mechanics

The critical Remote Code Execution vulnerability CVE-2025-55182, dubbed 'React2Shell', affects React Server Components (RSC) and extends beyond Next.js. Attackers are exploiting it for cloud-native initial access, credential harvesting, cryptomining, and deploying sophisticated backdoors. The vulne…
exploit
rce
next.js
deserialization
CVE-2025-55182
react2shell
2025-12-09
react
rsc
Published: December 9, 2025
Linked vulnerabilities : CVE-2021-4034, CVE-2025-55182 (CVSS 10.0)
Downloadable IOCs: 38

Critical React2Shell Vulnerability Under Active Exploitation by Chinese Threat Actors

A critical vulnerability dubbed 'React2Shell' (CVE-2025-55182) in React Server Components is being actively exploited by Chinese threat actors. The flaw affects multiple versions and packages, allowing arbitrary code execution through crafted HTTP requests. Approximately 39% of scanned cloud enviro…
gobrat
chinese threat actors
arbitrary code execution
CVE-2025-55182
react2shell
2025-12-08
active exploitation
react server components
Published: December 8, 2025
Linked vulnerabilities : CVE-2025-55182 (CVSS 10.0)
Downloadable IOCs: 2

China-nexus cyber threat groups rapidly exploit React2Shell vulnerability (CVE-2025-55182)

Within hours of the public disclosure of CVE-2025-55182 (React2Shell) on December 3, 2025, Amazon threat intelligence teams observed active exploitation attempts by multiple China state-nexus threat groups, including Earth Lamia and Jackpot Panda. This critical vulnerability in React Server Compone…
exploit
china-nexus
CVE-2025-1338
next.js
earth lamia
CVE-2025-55182
2025-12-05
jackpot panda
state sponsored
react2shell
react server
app router
Published: December 5, 2025
Linked vulnerabilities : CVE-2025-1338 (CVSS 7.3), CVE-2025-55182 (CVSS 10.0)
Downloadable IOCs: 4
Click here to see more Attack Reports