RondoDox exploits vulnerable XWiki servers

The RondoDox targets the XWiki, exploiting a critical security vulnerability that could allow attackers to achieve arbitrary code execution.

The vulnerability is tracked as CVE-2025-24893 (CVSS score: 9.8) and is an eval injection bug, which could allow any guest user to execute code remotely via a request to the “/bin/get/Main/SolrSearch“ endpoint. The maintainers fixed the issue in XWiki versions 15.10.11, 16.4.1, and 16.5.0RC1 in late February 2025.

See also: Ethereum Wallet emerges as a serious threat

Although there were indications that the vulnerability had been exploited since March (at least), the issue gained attention in late October, when VulnCheck revealed that it had observed new attempts to exploit the vulnerability as part of a two-stage attack chain to deploy a cryptocurrency miner.

The U.S. Cybersecurity and Infrastructure Security Administration (CISA) then added the vulnerability to the Known Exploitable Vulnerabilities (KEV) list, requiring federal agencies to implement the necessary mitigations by November 20.

XWiki vulnerability: Multiple abuse attempts and RondoDox

In a new report published on Friday, VulnCheck revealed that it has since observed an increase in exploitation attempts, reaching a new high on November 7, followed by another increase on November 11. This suggests broader scanning activity, likely driven by multiple malicious actors participating in the effort.

See also: NVIDIA NeMo Framework vulnerabilities allow privilege escalation

This includes RondoDox, which rapidly adds new exploit channels to join vulnerable devices into a botnet to conduct attacks denial-of-service using the HTTP, UDP, and TCP protocols. The first RondoDox exploit was observed on November 3, 2025, according to the cybersecurity firm.

Other attacks have also been observed exploiting the vulnerability to deliver cryptocurrency miners, while attempts to install a reverse shell.

The findings once again highlight the need to adopt strong update management to ensure optimal protection.

See also: Attacks on AI Models – Model Inversion and Prompt Injection

“CVE-2025-24893 is a familiar story: one attacker moves first, and many follow,” said VulnCheck’s Jacob Baines. “Within days of the initial exploit, we saw botnets, miners, and opportunistic scanners abusing the same vulnerability.”