I am getting this HTTP request line on my server (simple http server). The normal action for this request on my server is to simply close the socket connection. I am asking this question because when I web search what is /boaform/admin/formLogin HTTP/1.1, it gives me some vulnerability. Is there anything I need to do if I am getting this request but my server is just closing the connection?

POST /boaform/admin/formLogin HTTP/1.1

Is this an active zero-day exploit? I don't know what it means.

  • 1
    "...but my server is just closing the connection" - that would seem to be the best response.
    – MrWhite
    Oct 8 at 17:16
  • 2
    They are fishing, likely sequentially through IP addresses, hoping to find a router that has that exploit open.
    – Steve
    Oct 8 at 22:21

This appears to be related to a cluster of exploits that target fiber optic routers. If you are running a simple HTTP website and you are not maintaining fiber optic router equipment, I believe you can ignore those requests.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.