Hackers Exploit Zero-Day in cnPilot Routers to Deploy AIRASHI DDoS Botnet - The Hacker News

As of January 22, 2025, here are the latest developments and details regarding the zero-day exploit in Cambium Networks cnPilot routers, the deployment of the AIRASHI DDoS botnet, and associated vulnerabilities:

Zero-Day Exploit in cnPilot Routers

Threat actors have been exploiting an unspecified zero-day vulnerability in Cambium Networks cnPilot routers. This exploit is being used to deploy a variant of the AISURU botnet, specifically referred to as AIRASHI34.

AIRASHI DDoS Botnet

The AIRASHI botnet is a variant of the AISURU botnet, which is known for its involvement in Distributed Denial of Service (DDoS) attacks. The exploitation of the zero-day vulnerability in cnPilot routers allows attackers to compromise these devices and enlist them into the botnet. This botnet is likely used for launching DDoS attacks, which can significantly impact network availability and security34.

Cambium Networks Vulnerabilities

The vulnerability being exploited is described as a zero-day, meaning it is a previously unknown flaw that has not been patched by the vendor at the time of its discovery. This highlights a critical security risk for organizations using Cambium Networks cnPilot routers, as these devices can be compromised without any prior warning or mitigation measures in place.

Impact and Mitigation

Given the severity of this exploit, it is crucial for organizations using cnPilot routers to take immediate action. This includes monitoring network traffic for signs of compromise, implementing additional security measures such as intrusion detection systems, and awaiting a patch or advisory from Cambium Networks. Users should also consider segregating affected devices from critical network segments to minimize potential damage4.

Ongoing Risks

The exploitation of zero-day vulnerabilities in network devices like routers underscores the ongoing risks associated with unpatched vulnerabilities. It emphasizes the need for robust cybersecurity practices, including regular updates, thorough network monitoring, and the implementation of best practices for device security13.

For the most current and detailed information, it is advisable to follow updates from Cambium Networks and cybersecurity advisory services, as well as to monitor reputable cybersecurity news sources.