13

I am getting this HTTP request line on my server (simple http server). The normal action for this request on my server is to simply close the socket connection. I am asking this question because when I web search what is /boaform/admin/formLogin HTTP/1.1, it gives me some vulnerability. Is there anything I need to do if I am getting this request but my server is just closing the connection?

POST /boaform/admin/formLogin HTTP/1.1

Is this an active zero-day exploit? I don't know what it means.

Improve this question
2
  • 2
    "...but my server is just closing the connection" - that would seem to be the best response.
    – MrWhite
    Oct 8, 2021 at 17:16
  • 4
    They are fishing, likely sequentially through IP addresses, hoping to find a router that has that exploit open.
    – Steve
    Oct 8, 2021 at 22:21

1 Answer 1

Reset to default
10

This appears to be related to a cluster of exploits that target fiber optic routers. If you are running a simple HTTP website and you are not maintaining fiber optic router equipment, I believe you can ignore those requests.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.