React2Shell CVE-2025-55182

[warrentc3 47]

When will there be a release to address this vulnerability?

My firewall had a few instances of this signature being blocked over the weekend?

[TMCsw 246]

What does this have to do with Emby?

[warrentc3 47]

i suppose there’s a way to exploit with a javascript client.  

CEF:0|Ubiquiti|UniFi Network|10.0.162|200|Threat Detected|9|proto=TCP src=NGINX-DMZ spt=37940 dst=EMBYSERVER dpt=8096 act=allowed app=Other UNIFIcategory=Security UNIFIsubCategory=Intrusion Prevention UNIFIhost=UDM-Pro UNIFIsite=unifi UNIFIrisk=high UNIFIpolicyName=Web Applications UNIFIpolicyType=IDS/IPS UNIFIdirection=incoming deviceInboundInterface=NGINGTUNNEL

deviceOutboundInterface=SERVER-SUBNET

UNIFIdeviceMac=XX:XX:XX:XX:XX:XX

UNIFIdeviceName=UDM-Pro UNIFIdeviceModel=UDM-Pro UNIFIdeviceIp=192.168.1.1 UNIFIdeviceVersion=4.4.6 UNIFIsrcZone=Vpn UNIFIdstZone=Internal UNIFIdstDomain=XXXXXXXX

UNIFItotalBytes=12221 UNIFItotalPackets=25 UNIFIpacketsReceived=12 UNIFIpacketsSent=13 UNIFIbytesReceived=1033 UNIFIbytesSent=11188 UNIFIflowCount=1 UNIFIflowId=null UNIFIflowStartTime=Jan 19, 2026 at 2:02:30.159 AM UNIFIipsSessionId=635637292494358 UNIFIipsSignature=ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182) UNIFIipsSignatureId=2066027 UNIFIutcTime=2026-01-19T07:02:31.694Z msg=A network intrusion attempt from NGINX-DMZ to EMBYSERVER has been detected.

 

Edited January 19 by warrentc3
codeblock log

[TMCsw 246]

3 hours ago, warrentc3 said:

i suppose there’s a way to exploit with a javascript client.  

WOW, hacker go away..........