Skip to main content
UnknownPublished

tlp clear · KRVTZ-NET IDS alerts for 2026-05-05

Affects tlp clearSource CIRCL OSINT Feed

0

TLP:CLEAR, disclosure is not limited

Mentions 2 CVEs

Mentioned vulnerabilities

Description

The KRVTZ-NET IDS alerts for 2026-05-05 report low-severity network reconnaissance activity involving multiple IP addresses linked to scanning and exploitation attempts. The alert includes indicators related to known vulnerabilities such as CVE-2025-55182 affecting React Server Components and CVE-2023-27997 targeting Fortigate VPN. No affected product versions or active exploitation in the wild are confirmed. Patch availability is not indicated, and no vendor advisories or specific mitigation instructions are provided. The activity primarily represents reconnaissance rather than confirmed successful exploitation.

Indicators of compromise

IP addresses 4

  • 145.223.46.62ET SCAN Exabot Webcrawler User Agent
  • 103.153.183.69ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)
  • 2001:470:1:332::6ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)
  • 139.59.220.152ET WEB_SPECIFIC_APPS Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway - Default Credentials

Community reviews

Loading reviews…