I'm seeing notifications from my antivirus software that scans are being blocked. Some are from external IP addresses, but others are coming from my router. For example, here's the text from one notification from my antivirus about a scan that, apparently, came from my router.
Attack: an intrusion attempt was blocked.
Risk Level | Medium
Attacker Computer
{router internal ip address}:53768
Destination Computer
{webserver internal ip address}:80
Protocol
TCP
Attack Signature
Web Attack: Malicious Scan Request
Attack URL
{webserver external ip address}/cgi/common.cgi
Targeted Application
SYSTEM
Status
Blocked
Action
Resolved - No Action Required
Date & Time
12/4/2017 3:07 PM
Does anyone have any idea of what is going on here?