The botnet malware referred to as RondoDox has been noticed concentrating on unpatched XWiki situations in opposition to a important safety flaw that would enable attackers to realize arbitrary code execution.
The vulnerability in query is CVE-2025-24893 (CVSS rating: 9.8), an eval injection bug that would enable any visitor consumer to carry out arbitrary distant code execution by means of a request to the “/bin/get/Predominant/SolrSearch” endpoint. It was patched by the maintainers in XWiki 15.10.11, 16.4.1, and 16.5.0RC1 in late February 2025.
Whereas there was proof that the shortcoming had been exploited within the wild since no less than March, it wasn’t till late October, when VulnCheck disclosed it had noticed contemporary makes an attempt weaponizing the flaw as a part of a two-stage assault chain to deploy a cryptocurrency miner.
Subsequently, the U.S. Cybersecurity and Infrastructure Safety Company (CISA) added the vulnerability to its Identified Exploited Vulnerabilities (KEV) catalog, requiring federal businesses to use essential mitigations by November 20.
In a contemporary report revealed Friday, VulnCheck revealed that it has since noticed a spike in exploitation makes an attempt, hitting a brand new excessive on November 7, adopted by one other surge on November 11. This means broader scanning exercise possible pushed by a number of risk actors collaborating within the effort.
This contains RondoDox, a botnet that is quickly including new exploitation vectors to rope inclined units right into a botnet for conducting distributed denial-of-service (DDoS) assaults utilizing HTTP, UDP, and TCP protocols. The primary RondoDox exploit was noticed on November 3, 2025, per the cybersecurity firm.
Different assaults have been noticed exploiting the flaw to ship cryptocurrency miners, in addition to makes an attempt to ascertain a reverse shell and common probing exercise utilizing a Nuclei template for CVE-2025-24893.
The findings as soon as once more illustrate the necessity for adopting sturdy patch administration practices to make sure optimum safety.
“CVE-2025-24893 is a well-recognized story: one attacker strikes first, and plenty of comply with,” VulnCheck’s Jacob Baines mentioned. “Inside days of the preliminary exploitation, we noticed botnets, miners, and opportunistic scanners all adopting the identical vulnerability.”
