The botnet malware often known as RondoDox has been noticed focusing on unpatched XWiki situations towards a important safety flaw that might enable attackers to attain arbitrary code execution.
The vulnerability in query is CVE-2025-24893 (CVSS rating: 9.8), an eval injection bug that might enable any visitor consumer to carry out arbitrary distant code execution by a request to the “/bin/get/Fundamental/SolrSearch” endpoint. It was patched by the maintainers in XWiki 15.10.11, 16.4.1, and 16.5.0RC1 in late February 2025.
Whereas there was proof that the shortcoming had been exploited within the wild since a minimum of March, it wasn’t till late October, when VulnCheck disclosed it had noticed contemporary makes an attempt weaponizing the flaw as a part of a two-stage assault chain to deploy a cryptocurrency miner.
Subsequently, the U.S. Cybersecurity and Infrastructure Safety Company (CISA) added the vulnerability to its Recognized Exploited Vulnerabilities (KEV) catalog, requiring federal companies to use mandatory mitigations by November 20.
In a contemporary report revealed Friday, VulnCheck revealed that it has since noticed a spike in exploitation makes an attempt, hitting a brand new excessive on November 7, adopted by one other surge on November 11. This means broader scanning exercise probably pushed by a number of risk actors collaborating within the effort.
This consists of RondoDox, a botnet that is quickly including new exploitation vectors to rope inclined units right into a botnet for conducting distributed denial-of-service (DDoS) assaults utilizing HTTP, UDP, and TCP protocols. The primary RondoDox exploit was noticed on November 3, 2025, per the cybersecurity firm.
Different assaults have been noticed exploiting the flaw to ship cryptocurrency miners, in addition to makes an attempt to ascertain a reverse shell and normal probing exercise utilizing a Nuclei template for CVE-2025-24893.
The findings as soon as once more illustrate the necessity for adopting sturdy patch administration practices to make sure optimum safety.
“CVE-2025-24893 is a well-known story: one attacker strikes first, and plenty of comply with,” VulnCheck’s Jacob Baines stated. “Inside days of the preliminary exploitation, we noticed botnets, miners, and opportunistic scanners all adopting the identical vulnerability.”
