#IoT Security — insecure by design

high1 sourceCVE-2022-36553 CVE-2023-46805 +5

ClingSTUN Malware Abuses Legitimate Public STUN Servers to Build Covert IoT Proxy Network

Security researchers have uncovered an evolving Linux proxy backdoor named ClingSTUN that targets unpatched, internet-facing IoT and enterprise edge devices. The campaign was observed across three distinct operational phases, with the threat actors continuously expanding their exploit repertoire. Initial waves relied on a single flaw, `CVE-2022-36553` affecting Hytec Inter routers, before expanding to target `CVE-2025-34035` in EnGenius IoT cloud services and `CVE-2024-23625` in D-Link UPnP components. The malware then leveraged command injection vulnerabilities across multiple vendors, including Linear, Realtek, TP-Link, AVTECH, and D-Link hardware. By its third phase, ClingSTUN integrated an exploit catalog spanning 24 vulnerabilities, incorporating high-profile bugs such as Ivanti Connect Secure flaws `CVE-2023-46805` and `CVE-2024-21887`, alongside newer entries like `CVE-2026-36356` and `CVE-2025-67038`. Technically, ClingSTUN functions as a back-connect proxy node designed to bypass network firewalls and NAT environments. It dispatches STUN binding requests to legitimate, public STUN servers—using up to 24 servers in version two and 13 in version three—to determine its external IP address and port mappings while keeping firewall sessions alive. The compromised node periodically reports its unique group identifier and mapped ports back through these legitimate STUN channels. Because these endpoints are trusted public utilities, the outbound traffic blends seamlessly into legitimate VoIP and WebRTC traffic patterns. Upon establishing a foothold, the binary executes aggressive anti-tampering routines, killing competitor malware processes and terminating hardware watchdog timers. For persistence, ClingSTUN drops itself into standard system directories and alters host boot scripts. To evade discovery by local administrators, the malware disguises its execution footprint by spoofing process information copied directly from the host system's `init` process. The backdoor provides operators with full remote command execution and bundles seven internal exploits targeting Realtek SDKs and digital video recorders to propagate autonomously across local network segments.

medium1 source

France Ramps Up Cyber Resilience Act Enforcement with ANSSI and ANFR Mandates for Connected Hardware and Software

French regulatory and cybersecurity agencies, including ANSSI, the ANFR, and the DGE, hosted an industry alignment event in Paris focused on the operational rollout of the European Union's Cyber Resilience Act (CRA). Key European and French officials convened to emphasize the necessity of the CRA, framing the framework as an indispensable regulatory baseline for any vendor shipping hardware or software with digital components. Regulators highlighted that widespread vulnerabilities documented between 2025 and 2026 stemmed directly from absent baseline security hygiene that the CRA now mandates by law. Crucially, the regulatory machinery is already active, as hardware and software manufacturers have been required under Article 14 of the CRA to actively notify authorities of exploited vulnerabilities and severe security incidents since September 11, 2026. The broader compliance horizon is approaching rapidly, requiring all products containing digital elements sold across the European single market to satisfy essential CRA cybersecurity requirements by December 11, 2027. To enforce these standards domestically, France has divided regulatory responsibilities between market surveillance and national CSIRT oversight. The ANFR will operate as the designated national market surveillance authority, conducting direct technical assessments and teardowns of connected devices to confirm real-world compliance. Should vendors fail to meet baseline standards, the ANFR holds administrative policing powers to issue steep financial penalties or mandate full market recalls. Concurrently, ANSSI will fulfill the dual role of national CSIRT for vulnerability intake and the notifying authority tasked with auditing, vetting, and certifying Conformity Assessment Bodies (CABs/OECs). Officials concluded by presenting compliance roadmaps, trusted third-party resources, and designated testing bodies to assist manufacturers in overhauling their product development lifecycles ahead of the 2027 deadline.