TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

F5 Labs

The Prevalence of Web-Based RCE Vulnerabilities

2025-08-27 · Read original ↗

ATT&CK techniques detected

8 predictions
T1190Exploit Public-Facing Application
96%
"- 9082 : http interface vulnerability resulting in rce via command execution - cve - 2022 - 22947 : http interface vulnerability resulting in rce via command execution - cve - 2020 - 8958 : http interface vulnerability resulting in rce via command execution - cve - 2025 - 31324 :…"
T1190Exploit Public-Facing Application
95%
"the prevalence of web - based rce vulnerabilities the sensor intel series is created in partnership with efflux, who maintains a globally distributed network of sensors from which we derive attack telemetry. additional insights and contributions provided by the f5 threat campaign…"
T1190Exploit Public-Facing Application
92%
"which are the direct result of foundational coding mistakes in web management interfaces. cve - 2023 - 1389, consistently in our top 10 since its first appearance, is a prime example of this recurring pattern. here ’ s cve - 2023 - 1389 in detail : “ tp - link archer ax21 ( ax180…"
T1190Exploit Public-Facing Application
92%
". this vulnerability is critical for home and small business networks, and users should apply firmware updates provided by tp - link. cve - 2022 - 24847 affects geoserver, allowing remote code execution through jndi lookup. administrators should update geoserver to the latest ver…"
T1190Exploit Public-Facing Application
89%
"it ’ s not surprising that attackers gravitate toward this type of flaw — rce vulnerabilities, specifically tied to http interfaces, provide a direct and often trivial means to compromise devices. evidence of prevalence in our data a review of july ’ s top scanned cves shows a st…"
T1190Exploit Public-Facing Application
79%
"attention to all the components of devices and software packages needs to prioritized much more than it has been in the past. one weak link or unprotected interface is the difference between a strong, well performing iot device and one that will end up populating the most recentl…"
T1190Exploit Public-Facing Application
69%
"as log4shell, continues to exhibit activity in july 2025, as shown in figure 2. this vulnerability, which affects the apache log4j library, has been a significant concern since its discovery due to its ease of exploitation and widespread impact. although its activity has decrease…"
T1105Ingress Tool Transfer
52%
"simple commands like ` echo ( md5 ( cve - 2017 - 9841 ) ) ` ). this verifies the viability of exploitation without immediately deploying malware — an approach that minimizes detection risks, although such activity may be the result of various “ web survey ” activities conducted b…"

Summary

Sensor Intel Series: July 2025 CVE Trends