CVE report
CVE-2020-2551criticalKEV
Oracle WebLogic Server - Remote Code Execution
Events 90d
201
Distinct IPs
64
Severity
critical
CISA KEV
Actively exploited
Detection signature
An event counts toward CVE-2020-2551 when its URL path contains any of these (case-insensitive). This is what our matching is based on.
- · /console/login/LoginForm.jsp
Pre-disclosure activity
all early actors →Analysing probe history around the publication date…
Recent probe volume (last 7 days)
peak: 41 events/dayeventsdistinct IPs
Downloads & integrations
Top sources probing for CVE-2020-2551
- 185.181.229.69131 eventsMoldova· Inovare-Prim SRL
- 104.130.6.744 eventsUnited States· Rackspace Hosting
- 128.185.207.183 eventsIndia· BHARTI Airtel Ltd.
- 159.65.148.752 eventsIndia· DigitalOcean, LLC
- 101.36.125.582 eventsHong Kong· UCLOUD INFORMATION TECHNOLOGY HK LIMITED
- 67.219.23.2191 eventsUnited States· Colocation America Corporation
- 72.57.110.1581 eventsUnited States· B2 Net Solutions Inc.
- 113.124.45.1791 eventsChina· Chinanet
- 72.57.111.2421 eventsUnited States· B2 Net Solutions Inc.
- 186.179.19.2291 eventsUnited States· Corporacion Dana S.A.
- 152.232.61.971 eventsUnited States· B2 Net Solutions Inc.
- 157.254.104.1711 eventsUnited States· M247 Europe SRL
- 161.0.13.2201 eventsUnited States· Corporacion Laceibanetsociety
- 173.211.49.2371 eventsUnited States· Colocation America Corporation
- 152.232.59.311 eventsUnited States· B2 Net Solutions Inc.
- 173.211.32.1221 eventsUnited States· Colocation America Corporation
- 185.193.82.1441 eventsGermany· TerraTransit AG
- 45.73.165.1711 eventsUnited States· Colocation America Corporation
- 185.196.111.421 eventsGermany· TerraTransit AG
- 213.219.255.641 eventsUnited States· Colocation America Corporation
- 185.202.158.451 eventsGermany· TerraTransit AG
- 185.193.80.2431 eventsGermany· TerraTransit AG
- 185.196.108.1841 eventsGermany· TerraTransit AG
- 198.56.7.2181 eventsUnited States· M247 Europe SRL
- 185.169.3.2431 eventsGermany· TerraTransit AG
- 157.20.215.1011 eventsIndia· Micro Hosting Private Limited
- 213.219.255.681 eventsUnited States· Colocation America Corporation
- 67.227.91.2191 eventsUnited States· Colocation America Corporation
- 185.202.158.601 eventsGermany· TerraTransit AG
- 173.211.55.1041 eventsUnited States· Colocation America Corporation
Top networks the attempts come from
- AS60602 Inovare-Prim SRL1 IPs · 131 ev
- AS42366 TerraTransit AG17 IPs · 17 ev
- AS21769 Colocation America Corporation16 IPs · 16 ev
- AS9009 M247 Europe SRL7 IPs · 7 ev
- AS55286 B2 Net Solutions Inc.7 IPs · 7 ev
- AS27357 Rackspace Hosting1 IPs · 4 ev
- AS9498 BHARTI Airtel Ltd.1 IPs · 3 ev
- AS7385 Allstream Business US, LLC3 IPs · 3 ev
- AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED1 IPs · 2 ev
- AS14061 DigitalOcean, LLC1 IPs · 2 ev
Fingerprints of the clients exploiting this
The HTTP (JA4H) and TLS (JA4) fingerprints seen on these attempts. Click one to see the whole population that carries it.
ja4h: ge11nn14en_290448bd461fja4h: ge11nn0500_2d30dc89d981ja4h: ge11nn09en_ad14bfc8ac19ja4h: ge11nn12en_023595b8c6e1ja4h: ge11nn11en_8950ec142097ja4h: ge11nn0400_9c3956fad5daja4: t13i1514h2_8daaf6152771_de4a06bb82e3ja4: t13i1515h2_8daaf6152771_d8a2da3f94cdja4: t13i1714h2_5b57614c22b0_5c2c66f702b0ja4: t13i2013h2_a09f3c656075_14788d8d241bja4: t13i131000_f57a46bbacb6_ab7e3b40a677
Sample request paths observed
- /console/login/LoginForm.jsp