Overview: CVE-2025-55182 and Its Rapid Exploitation

CVE-2025-55182 (informally dubbed React2Shell) is a critical remote code execution (RCE) vulnerability in the React Server Components (RSC) Flight protocol used by React and some Next.js deployments. It allows unauthenticated attackers to send specially crafted requests that trigger unsafe deserialization, resulting in arbitrary code execution on the server. NVD+1

The vulnerability carries a CVSS score of 10.0 and has been added to the U.S. CISA Known Exploited Vulnerabilities Catalog because of widespread active exploitation. NVD

Within hours of public disclosure, automated scanners and adversaries began widespread exploitation attempts against exposed React RSC endpoints, demonstrating how quickly high-severity flaws can go from zero-day to high-volume attacks. cyble.com

 How Attackers Weaponize CVE-2025-55182 in the Wild

1) Remote Code Execution to Deploy Payloads

The unsafe deserialization flaw lets attackers execute shell commands on vulnerable servers with the privileges of the web application process. Researchers have seen exploitation chains where an attacker:

• Sends a malicious JSON HTTP POST request exploiting the unsafe payload parsing.

• Uses that RCE to run shell commands such as curl or wget to fetch additional scripts or binaries.

• Executes downloaded scripts to set up persistence, launch bot code, or pivot inside the environment. Amazon Web Services, Inc.+1

This pattern effectively turns a web server into a launchpad for further compromise — the same mechanism high-speed Mirai-style automation uses for infection.

2) Dropping Malware and Botnet Components

Security researchers observing honeypots have seen attackers chain CVE-2025-55182 exploitation into scripts that download malicious payloads using command-line tools and execute them. These payloads include:

• Mirai-based botnet variants,

• Crypto miners,

• RondoDox and other multi-architecture malware loaders. Securelist

Mirai-style malware typically scans for vulnerable hosts and uses automated brute-force and exploitation routines to grow its botnet infrastructure — and now CVE-2025-55182 is being used as a fast infection vector for similar campaigns.

 Mirai and Its Descendants: Botnets Evolving

Mirai itself was designed to turn vulnerable devices (especially IoT) into bots that communicate with a central command-and-control server, forming a botnet capable of launching large-scale DDoS attacks. Cloudflare

Since its source code leaked, many variants (e.g., Okiru, Satori) repurpose its scanning and self-propagation model to exploit new vulnerabilities across architectures and platforms. arXiv

What’s different today is that these concepts — scanning, exploitation, payload delivery — are being applied to cloud workloads and enterprise servers via vulnerabilities like CVE-2025-55182. An exploit becomes a vehicle to pull in malware payloads (e.g., Mirai-style bots) directly inside server environments that traditionally were out of IoT botnet scope.

 Signals SOCs Should Monitor

Given this threat activity, defenders should look for behavioral indicators such as:

 External Scanning & Exploit Attempts

• High-volume POST traffic to React Server Component endpoints

• Abnormal HTTP/JSON requests with unusual headers or malformed objects

• Requests followed by wget/curl attempts or unusual CLI-like commands

 Post-Exploit Behavior

• Unexpected processes invoked via shell (e.g., downloader scripts)

• Connections to known malware C2 infrastructure

• Unusual service creation on Linux systems (e.g., systemd units from nonstandard sources)

 Botnet-Related Artifacts

• Processes or binaries resembling Mirai or derivatives

• DNS beacons or C2 traffic patterns common in botnets

• High outbound traffic without clear business justification

 Defensive Controls & Mitigations

 Patch Immediately

Apply vendor patches for React Server Components and associated frameworks (React 19.x and Next.js versions where applicable); mitigate unsafe deserialization. Google Cloud

 Web Application Hardening

Deploy WAF protections with rules tailored to block malformed RSC Flight protocol payloads as interim defense while patching. Vercel

 Network and Endpoint Monitoring

• IDS/IPS signatures to detect exploitation attempts

• Endpoint process monitoring for anomalous command execution

• SIEM correlations across HTTP logs and endpoint telemetry

 Threat Intel Integration

Ingest indicators from honeypots and global exploitation telemetry into detection pipelines to block or alert on malicious activity.

 Why This Matters

CVE-2025-55182 is a textbook example of the modern zero-day to zero-hour paradigm — where public exploit code and automated tooling enable massive scanning and exploitation in minutes, not weeks. cyble.com

Mirai-like weaponization of such widespread vulnerabilities shows defenders must:

• Prioritize rapid patching

• Build behavioral detection rather than signature reliance

• Integrate enriched telemetry across web, network, and endpoint layers

This multi-layer view is essential to detect and mitigate automated botnet recruitment and post-exploit payload deployment.

 Summary

• CVE-2025-55182 is a critical RCE in React Server Components being actively exploited in the wild. NVD

• Attacks leverage this flaw to deliver botnet and malware payloads, including Mirai-style variants. Securelist

• SOC teams must monitor exploit attempts, patch systems quickly, and correlate telemetry to detect post-exploit behavior.