CVE-2015-2794: DotNetNuke 07.04.00 - Administration Authentication Bypass
HoneyLabs honeypots recorded 31 probes matching CVE-2015-2794 from 4 distinct source IP addresses in the last 7 days, of which 11 on interactive sensors. Severity is rated critical.
4 sources probed for CVE-2015-2794 on the interactive sensors. None of them sent the exploit payload.
What the sensors show
Probes arrived on every day of the 7-day window. The busiest day was 2026-11-06, with 12. One address, 172.236.28.161, sent 39% of them. Over the last 90 days the sensors recorded 413 probes for it. Every probing client that negotiated TLS presented one JA4 fingerprint, t13i251000_b78ed14e2fd0_ab7e3b40a677.
Request paths that identify it
- /Install/InstallWizard.aspx
Addresses probing it
| Source IP | Probes | Network | Country |
|---|---|---|---|
| 172.236.28.161 | 12 | Akamai Connected Cloud | United Kingdom |
| 97.107.138.210 | 8 | Akamai Connected Cloud | United States |
| 50.116.58.253 | 7 | Akamai Connected Cloud | United States |
| 172.105.109.85 | 4 | Akamai Connected Cloud | Canada |
Networks it comes from
| ASN | Organisation | Probes | Source IPs |
|---|---|---|---|
| AS63949 | Akamai Connected Cloud | 31 | 4 |
Where it comes from
| Country | Probes |
|---|---|
| United States | 15 |
| United Kingdom | 12 |
| Canada | 4 |
Captured requests
- /Install/InstallWizard.aspx?__VIEWSTATE
Requests the interactive sensors answered
- GET /Install/InstallWizard.aspx?__VIEWSTATE
HTTP client fingerprints
- b11cun050_0004001e_00ecc3a8
CVE report
Open a specific CVE from the CVE tracker.