UnknownPublished 24 May 2026

tlp clear · KRVTZ-NET IDS alerts for 2026-05-24

Affects tlp clearSource CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

Mentions 2 CVEs

Mentioned vulnerabilities

Description

KRVTZ-NET IDS alerts for 2026-05-24

Impact

The impact is limited to reconnaissance and potential exploit attempts without confirmed successful exploitation. The presence of known exploit attempts against Fortigate VPN and React Server Components vulnerabilities suggests scanning or probing activity but no confirmed compromise. No known exploits in the wild have been reported for these indicators in this alert. The overall risk to affected systems is low based on the available information.

Defensive guidance

Organizations should verify that Fortigate VPN and React Server Components are updated according to vendor advisories for CVE-2023-27997 and CVE-2025-55182 to mitigate potential exploitation risks. Monitoring for unusual repeated GET requests to /remote/logincheck and suspicious React component access is advisable. Since this alert primarily indicates reconnaissance and scanning activity, no urgent action is required beyond standard vulnerability management for the referenced CVEs.

Indicators of compromise

IP addresses 16

116.179.32.15ETPRO INFO Baidu Spider Crawler User-Agent Outbound
116.179.37.250ETPRO INFO Baidu Spider Crawler User-Agent Outbound
116.179.37.187ETPRO INFO Baidu Spider Crawler User-Agent Outbound
116.179.37.172ETPRO INFO Baidu Spider Crawler User-Agent Outbound
116.179.37.222ETPRO INFO Baidu Spider Crawler User-Agent Outbound
116.179.37.12ETPRO INFO Baidu Spider Crawler User-Agent Outbound
220.181.108.166ETPRO INFO Baidu Spider Crawler User-Agent Outbound
220.181.108.155ETPRO INFO Baidu Spider Crawler User-Agent Outbound
116.179.37.68ETPRO INFO Baidu Spider Crawler User-Agent Outbound
64.62.197.107ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 24 May 2026, 08:31 UTC

Indicators of compromise

IP addresses 16

Community reviews

Related threats