NewsPublished 29 Apr 2026

Today's Odd Web Requests, (Wed, Apr 29th)

Source SANS ISC Handlers Diary

Description

Today, two different "new" requests hit our honeypots. Both appear to be recon requests and not associated with specific vulnerabilities. But as always, please let me know if you have additional information

Impact

No direct exploitation or known active attacks have been observed from these requests. The impact is limited to potential information disclosure that could facilitate future targeted attacks against Broadcom API Gateway deployments or ESP32-based IoT devices. There is no evidence of compromise or vulnerability exploitation at this time.

Defensive guidance

No specific patch or fix is applicable as these are reconnaissance requests rather than exploitation attempts. Monitoring for unusual or repeated requests to these endpoints is advisable to detect potential follow-up attacks. Organizations using Broadcom API Gateway or ESP32 devices should ensure their systems are up to date with the latest security patches and follow best practices for securing API gateways and IoT devices.

Summary

Two distinct reconnaissance web requests were detected: one targeting the Broadcom API Gateway endpoint '/bam/restart/if/required' and another probing the '/esps/' path linked to ESP32 IoT devices. The Broadcom request could reveal the presence of the API Gateway, potentially enabling future targeted attacks. The ESP32-related request may be associated with firmware upload functionality but has not been linked to any active exploitation. Both requests are currently considered information-gathering probes without direct vulnerability exploitation.

References

isc.sans.edu/diary/rss/32934 (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 29 Apr 2026, 13:22 UTC

References

Community reviews

Related threats