End-of-Life Network Devices Exploited in Active Botnet Campaign
Written by AI from the linked story. Not reviewed by an editor. How this works
Cybercriminals are actively exploiting a 13-month-old command injection vulnerability (CVE-2025-29635) in end-of-life D-Link routers to build Mirai botnets for DDoS attacks. The vulnerability was publicly disclosed over a year ago, but many organizations failed to patch or replace these devices, leaving them exposed to attack. This incident demonstrates how unpatched network infrastructure becomes a critical attack vector, especially when devices reach end-of-life status and no longer receive security updates. The widespread exploitation across multiple router brands shows that attackers systematically target known vulnerabilities in consumer and small business network equipment.
Tactical Insight
Immediate actions
- Replace all end-of-life network devices that no longer receive security updates
- Apply emergency patches to supported devices with known vulnerabilities
- Scan network perimeter for exposed devices using the affected firmware versions
Long-term improvements
- Establish lifecycle management policies for all network infrastructure equipment
- Implement automated vulnerability scanning for internet-facing network devices
- Create hardware refresh schedules that replace devices before end-of-life dates
Detection measures
- Monitor network traffic for unusual outbound connections indicative of botnet activity
- Deploy network segmentation to isolate IoT and network devices from critical systems