External risk intelligence

Mirai Botnet Resource Exhaustion Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2024-45163

The vulnerability exists within the Command and Control (CNC) server component of the Mirai botnet itself, which is malicious infrastructure rather than a legitimate service, product, or application deployed in common, authorized enterprise or public internet environments.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Mirai botnet's command and control server, allowing unauthenticated sessions to remain open and consume resources. This could potentially disrupt the botnet's operations. The main concern at this time is confirming if any part of our environment is exposed or relevant to this specific threat.

Botnet can be disrupted by resource exhaustion.
Malicious infrastructure, likely not affecting our systems.
Focus on confirming relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could target the Mirai botnet's command and control server by sending simultaneous TCP connections. This would exploit a flaw in how the server handles these connections, leading to resource exhaustion. The vulnerability can result in a denial-of-service condition, potentially disrupting the botnet's operations.

No authentication required.
Malformed or recognized connection data.
Resource exhaustion leading to denial of service.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated sessions to remain open on Mirai botnet command and control servers, leading to resource consumption. This occurs when an attacker sends a recognized username or arbitrary data to the server.

Resource consumption on CNC servers.
Unauthenticated sessions remain open.
Botnet operational disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Mirai botnet's command and control (CNC) server is the affected technology. Responsibility for remediation likely falls to security operations or incident response teams, as this is malicious infrastructure rather than a deployed product. The first step is to confirm the presence and reachability of any CNC infrastructure, assess its criticality if any, and then coordinate appropriate incident response actions.

Security operations teams should own the issue.
Verify CNC infrastructure presence and reachability.
Plan incident response and containment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Mirai botnet software?

Mirai is a type of malicious software designed to infect networked devices, such as IoT hardware, to form a botnet. This botnet is controlled by a central Command and Control (CNC) server, which sends instructions to the infected devices to perform coordinated actions, such as launching large-scale network attacks.

What does CVE-2024-45163 mean by resource exhaustion?

This vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption). It means the Mirai CNC server fails to properly manage simultaneous TCP connections. By opening many sessions, an attacker can overwhelm the server's memory or processing capacity, effectively causing a denial-of-service that disrupts the botnet's ability to operate.

How can an attacker trigger this vulnerability?

An attacker triggers the flaw by initiating multiple simultaneous TCP connections to the CNC server. Because the server does not require authentication to handle these sessions, the attacker can send arbitrary data or recognized usernames to keep connections open. Importantly, this issue relies on the server's inability to close idle or excessive connections; it is not triggered by legitimate, authenticated command traffic.

Is my network relevant to this vulnerability?

According to Halo Surface Signal, this vulnerability is very unlikely to be relevant to your organization. The flaw exists specifically within the malicious CNC server infrastructure itself, rather than within standard enterprise products or software services that your team would typically deploy or manage.

What should I do if I find evidence of this technology?

Since this involves malicious infrastructure, you should not attempt to manage it like a typical software update. Instead, prioritize identifying why such infrastructure is present in your environment. Coordinate with your incident response or security operations team to verify its reachability and follow established procedures for containing and removing unauthorized, malicious systems.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.