A week in security (April 6 – April 12)

Last week on Malwarebytes Labs: Fake Claude site installs malware that gives attackers access to your computer ClickFix finds a new way to infect Macs Scammers pose as Amazon support to steal your account NSFW app leak exposes 70,000 prompts linked to individual users 30,000 private Facebook imag...

Russian Forest Blizzard Hackers Hijack Home Routers for Global Spying

Microsoft Threat Intelligence reveals how Russian hacking group Forest Blizzard uses home routers for DNS hijacking and spying...

Sanctioned Bulletproof Host Linked to Hijacking of Old Home Routers

Compromised home routers in 30+ countries had DNS traffic redirected, sending users to malicious sites while normal browsing appeared unaffected...

CVE-2025-50681

igmpproxy 0.4 before commit 2b30c36 allows remote attackers to cause a denial of service application crash via a crafted IGMPv3 membership report packet with a malicious source address. Due to insufficient validation in the recvigmp function in src/igmpproxy.c, an invalid group record type can...

CVE-2025-50681

igmpproxy 0.4 before commit 2b30c36 allows remote attackers to cause a denial of service application crash via a crafted IGMPv3 membership report packet with a malicious source address. Due to insufficient validation in the recvigmp function in src/igmpproxy.c, an invalid group record type can...

UBUNTU-CVE-2025-50681

igmpproxy 0.4 before commit 2b30c36 allows remote attackers to cause a denial of service application crash via a crafted IGMPv3 membership report packet with a malicious source address. Due to insufficient validation in the recvigmp function in src/igmpproxy.c, an invalid group record type can...

PT-2025-52453

igmpproxy 0.4 before commit 2b30c36 allows remote attackers to cause a denial of service application crash via a crafted IGMPv3 membership report packet with a malicious source address. Due to insufficient validation in the recv igmp function in src/igmpproxy.c, an invalid group record type can...

CVE-2025-50681

Summary: CVE-2025-50681 affects igmpproxy 0.4 before commit 2b30c36, allowing remote attackers to cause a denial of service (application crash) by sending crafted IGMPv3 membership reports with a malicious source address. The root cause is insufficient validation in recv_igmp() in src/igmpproxy.c...

Tunneling Flaws Put VPNs, CDNs and Routers at Risk Globally

Millions of devices, including home routers, VPN servers, and CDNs are vulnerable to exploitation due to critical flaws…...

PT-2025-1235 · Gre +1 · Gre +1

Name of the Vulnerable Software and Affected Versions: GRE and GRE6 protocols RFC2784 affected versions not specified Description: The GRE and GRE6 protocols do not validate or verify the source of a network packet, allowing an attacker to spoof and route arbitrary traffic via an exposed network...

Huawei connection hijacking vulnerability in some home routers

The Huawei WS8700, among others, is a router from the Chinese company Huawei Huawei. Some of Huawei's home routers are vulnerable to connection hijacking, which can be exploited by attackers to cause a DoS or information disclosure...

CVE-2023-52718

A connection hijacking vulnerability exists in some Huawei home routers. Successful exploitation of this vulnerability may cause DoS or information leakage.Vulnerability ID:HWPSIRT-2023-34408 This vulnerability has been assigned a CVEID:CVE-2023-52718...

CVE-2023-52718

A connection hijacking vulnerability exists in some Huawei home routers. Successful exploitation of this vulnerability may cause DoS or information leakage.Vulnerability ID:HWPSIRT-2023-34408 This vulnerability has been assigned a CVEID:CVE-2023-52718...

CVE-2023-52718

A connection hijacking vulnerability exists in some Huawei home routers. Successful exploitation of this vulnerability may cause DoS or information leakage.Vulnerability ID:HWPSIRT-2023-34408 This vulnerability has been assigned a CVEID:CVE-2023-52718...

CVE-2023-52718

A connection hijacking vulnerability exists in some Huawei home routers. Successful exploitation of this vulnerability may cause DoS or information leakage.Vulnerability ID:HWPSIRT-2023-34408 This vulnerability has been assigned a CVEID:CVE-2023-52718...

CVE-2023-7266

Some Huawei home routers have a connection hijacking vulnerability. Successful exploitation of this vulnerability may cause DoS or information leakage.Vulnerability ID:HWPSIRT-2023-76605 This vulnerability has been assigned a CVEID:CVE-2023-7266...

Huawei多款产品 安全漏洞

The Huawei WS8700, among others, is a router from the Chinese company Huawei Huawei. Some of Huawei's home routers are vulnerable to connection hijacking, which can be exploited by attackers to cause a DoS or information disclosure...

Linksys E1500 Directory Traversal

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Linksys E1500 Directory Traversal Vulnerability', 'Description' = %q This module exploits a directory traversal vulnerability which is present in...

PT-2024-4675 · Huawei · Huawei Ws7206-10 +3

Name of the Vulnerable Software and Affected Versions: Huawei home routers affected versions not specified Huawei TC7001-10, WS7200-10, and WS7206-10 affected versions not specified Description: The issue is related to a connection hijacking vulnerability in some Huawei home routers. This...

Security Advisory - Connection Hijacking Vulnerability in Some Huawei Home Routers

Some Huawei home routers have a connection hijacking vulnerability. Successful exploitation of this vulnerability may cause DoS or information leakage.Vulnerability ID:HWPSIRT-2023-76605 This vulnerability has been assigned a CVEID:CVE-2023-7266...