CVE-2023-20118Vulnerability
Cisco Small Business RV Series Routers Command Injection Vulnerability
Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on .
Reported by 1 independent source · first reported by Sekoia.io · last reported
Last reported 4 months ago
CISA KEVAdded 3 Mar 2025
Fix due 24 Mar 2025
Used by ransomware: not knownCISA KEV catalogue
Fix due 24 Mar 2025
Used by ransomware: not knownCISA KEV catalogue
EPSS54.1%
higher than 99% of CVEsFIRST EPSS, as of 23 Oct 2026
higher than 99% of CVEsFIRST EPSS, as of 23 Oct 2026
What the reports say
3 reports, newest first · the exact sentence from each-
PolarEdge Backdoor on QNAP: CVE-2023-20118 Analysis“PolarEdge Backdoor on QNAP: CVE-2023-20118 Analysis”
-
ViciousTrap: Turning Edge Devices into Honeypots at Scale“In a previous blogpost, Sekoia's Threat Detection & Research (TDR) team documented the exploitation of the CVE-2023-20118 vulnerability, which was used to deploy two distinct threats: a webshell and the PolarEdge malware.”
-
PolarEdge: Unveiling an uncovered ORB network“Sekoia TDR uncovers PolarEdge, a botnet exploiting CVE-2023-20118 to deploy a stealthy TLS backdoor on edge devices.”
Indicators reported together
named in the same reports- a3e2826090f00969…c8a59c9d9082in 1 report
- 101.99.91[.]151in 1 report
- 111.90.148[.]151in 1 report
- 111.90.148[.]112in 1 report
- 101.99.91[.]239in 1 report
- c15f77d64b7bbfb3…95562b37dec4in 1 report
- 212.232.23[.]217in 1 report
- 155.254.60[.]160in 1 report
- 101.99.94[.]173in 1 report
- 103.43.19[.]61in 1 report
- 103.56.17[.]163in 1 report
- 103.43.18[.]59in 1 report
- 212.232.23[.]168in 1 report
- 212.232.23[.]143in 1 report
- 101.99.90[.]20in 1 report
- d92d2f102e1e4178…a799507e3e77in 1 report
- 20dff1120d968330…4e59474dc6bdin 1 report
- 45.77.152[.]227in 1 report
- 119.8.186[.]227in 1 report
Copy these 19 indicators · defanged
Also named with it: CVE-2021-32030
Thanks — we review every report.