The KRVTZ-NET IDS alerts for 2026-05-23 report observed network reconnaissance activity identified through OSINT sources. The alerts primarily indicate outbound traffic associated with Baidu Spider Crawler User-Agent IP addresses. No specific vulnerabilities or exploits are identified, and no affected product versions are noted. There is no patch or remediation required as this is an observation of network scanning or crawling activity. The severity is assessed as low given the nature of the activity and lack of confirmed exploitation.
This report details IDS alerts from 2026-05-21 indicating reconnaissance activity targeting Fortigate VPN devices. Multiple IP addresses were observed making repeated GET requests to the /remote/logincheck endpoint, associated with CVE-2023-27997, a heap-based buffer overflow vulnerability in Fortinet FortiOS and FortiProxy SSL-VPN. Additional IPs showed suspicious or test user-agent strings, suggesting scanning or probing behavior. No active exploitation or confirmed compromises were reported. The activity is assessed as low severity due to its reconnaissance nature without evidence of exploitation.
The KRVTZ-NET IDS alerts for 2026-05-17 report multiple network reconnaissance and scanning activities, including repeated exploit attempts against Fortigate VPN (CVE-2023-27997) and a React Server Components vulnerability (CVE-2025-55182). Several IP addresses were observed making suspicious requests such as repeated GET requests to /remote/logincheck and attempts to access hidden environment files. These activities are indicative of preliminary probing rather than confirmed exploitation. No known exploits in the wild or confirmed breaches have been reported. The overall severity is assessed as low due to the absence of confirmed successful attacks.
The KRVTZ-NET IDS alerts for 2026-05-13 report network reconnaissance activity primarily involving scanning by Exabot webcrawler user agents. Some IP addresses are associated with attempts to probe known vulnerabilities, including CVE-2023-27997 targeting Fortigate VPN's /remote/logincheck endpoint and CVE-2025-55182 related to unsafe property access in React Server Components (React2Shell). There is no evidence of confirmed exploitation or active attacks in this data. The activity is informational and categorized as low severity.