RondoDox Exploits Unpatched XWiki Servers to Pull More Devices Into Its Botnet

RondoDox, a botnet malware, has been observed exploiting unpatched XWiki instances against CVE-2025-24893, an eval injection flaw that could permit arbitrary remote code execution via requests to /bin/get/Main/SolrSearch. The vulnerability was patched by XWiki in late February 2025 across versions 15.10.11, 16.4.1, and 16.5.0RC1, but exploitation in the wild continued from at least March, with fresh attempts disclosed by VulnCheck in a two-stage attack chain to deploy a cryptocurrency miner.

CISA subsequently added CVE-2025-24893 to its Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to apply mitigations by 20 November. A VulnCheck report published on 7 November 2025 noted a spike in exploitation attempts, followed by a further surge on 11 November, indicating broader scanning activity by multiple threat actors.

The report also notes RondoDox is rapidly adding new exploitation vectors to pull devices into a botnet for distributed denial-of-service attacks using HTTP, UDP and TCP, with the first exploit observed on 3 November 2025. In addition, other attacks have been seen delivering cryptocurrency miners and performing probing activity via a Nuclei template for CVE-2025-24893, underscoring the need for robust patch management. according to The Hacker News