CVE-2025-55182 Exploitation Hits the Smart Home

The article discusses the exploitation of the CVE-2025-55182 vulnerability, known as React2Shell, which affects Node.js applications that mishandle user-supplied JSON data, allowing remote command execution for attackers. Exploit attempts are reported to exceed 150,000 daily, targeting various smart devices like plugs, smartphones, NAS systems, and more. The primary source of these attacks is traced to a datacenter in Poland, resembling behavior seen in Mirai botnets.

Two main payloads are identified: Mirai loaders and Rondo cryptocurrency miners. Organizations using Node.js are urged to apply patches immediately and implement network segregation to protect vulnerable devices from being exploited.