Critical
KEV + Ransomware
CVE-2025-55182
Dysphoria Botnet Uses Blockchain for C2 and Exploits IoT Devices
Vendor / product: IoT devices, routers, cameras, Huawei
Event date: 2026-03-01
Victim organization: not stated
Public PoC: Yes
First tracked by RiskWire: 2026-07-28
CISA KEV catalog
Added to KEV
Federal remediation due
2025-12-12 (282 days overdue)
Ransomware campaign use
Known
CISA description
Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Sources & citations (3)
- Rebuilt in Six Days: Dysphoria IoT Botnet Hides on Blockchain to Defy Seizure techtimes.com · 2026-07-29
- Dysphoria Botnet Uses Blockchain Domains to Hide C2 Infrastructure securityaffairs.com · 2026-07-28
- Dysphoria botnet infects 200,000 IoT devices dataconomy.com · 2026-07-28
References
See CVE-2025-55182 in context
RiskWire tracks every exploited CVE this week, cross-referenced against CISA KEV with federal remediation deadlines. Filtered to your vendor stack.
Book a 20-min demo →