A new botnet RondoDox has been discovered, exploiting 56 vulnerabilities in over 30 different devices.

The malicious actors are targeting a wide range of internet-accessible devices, including digital video recorders (DVRs), network video recorders (NVRs), video surveillance systems, and web servers.

The following are the vulnerabilities exploited by the RondoDox botnet:

• Digiever – CVE-2023-52163;
• Qnap – CVE-2023-47565;
• LB-LINK – CVE-2023-26801;
• TRENDnet – CVE-2023-51833;
• D-Link – CVE-2024-10914;
• TBK – CVE-2024-3721;
• Four-Faith – CVE-2024-12856;
• Netgear – CVE-2024-12847;
• AVTECH – CVE-2024-7029;
• TOTOLINK – CVE-2024-1781;
• Tenda – CVE-2025-7414;
• TOTOLINK – CVE-2025-1829;
• Meteobridge – CVE-2025-4008;
• Edimax – CVE-2025-22905;
• Linksys – CVE-2025-34037;
• TOTOLINK – CVE-2025-5504;
• TP-Link – CVE-2023-1389.

Analysts report that RondoDox exploits 18 command injection vulnerabilities that have not yet been assigned CVE identifiers. These vulnerabilities affect D-Link and NAS devices, TVT and LILIN DVRs, Fiberhome, ASMAX, and Linksys routers, Brickcom cameras, and other unspecified devices.

To protect against RondoDox attacks, researchers recommend installing the latest available firmware updates and promptly replacing hardware that has reached its support deadline. Additionally, it is recommended to segment the network, isolate critical data from internet-facing IoT devices and from guest connections, and replace default credentials and use strong passwords.

Source: bleepingcomputer.com