Hackers Exploit D-Link, Ubiquiti and SAP Flaws to Hijack Devices for Proxy Networks
Hackers exploited flaws in D-Link, Ubiquiti, and SAP products to compromise 143 devices in 34 countries, installing proxy software without consent. GreyNoise linked the campaign to actor 'skynox7,' using vulnerabilities in D-Link NAS, Ubiquiti NVRs, and SAP NetWeaver. The affected products include D-Link ShareCenter, Ubiquiti UniFi Video, and SAP NetWeaver Visual Composer.
How this was made
The 30-second read
Why it matters
The disclosure may prompt immediate security patches, affect customer confidence, and create short‑term stock pressure for the three firms.
Market read
First public report of a coordinated proxy‑jacking campaign targeting major tech vendors; may influence short‑term sentiment and security‑spending decisions.
What to watch
Rapid patch releases and strong support contracts could mitigate long‑term impact on revenues.
Background
A newly identified cybercrime campaign exploited known CVEs in D‑Link, Ubiquiti and SAP products to turn devices into residential proxy nodes.
Ticker impact
SAP NetWeaver Visual Composer’s Metadata Uploader component (CVE-2025-31324) was used in the attack.
moderate downside as enterprise customers may pause deployments pending patches.
Enterprise customers view security breaches seriously; first report of a campaign targeting SAP may affect short‑term sentiment.
Market effects
Highlights broader cybersecurity risk for networking and enterprise‑software vendors.
Potential short‑term pressure on US‑listed tech stocks with exposed hardware/software.
Raises awareness of supply‑chain security across global device manufacturers.
Counterpoint
Investors may view the disclosed vulnerabilities as already priced in, limiting further downside.
Key entities
- companyD‑Link Corp
Network‑attached storage and networking hardware vendor.
- companyUbiquiti Inc.
Provider of wireless networking and video surveillance equipment.
- companySAP SE
Enterprise‑software giant.
