CVE-2024-39226: GL-iNet MT6000 Firmware RCE Vulnerability

CVE-2024-39226 Overview

CVE-2024-39226 is a critical command injection vulnerability affecting multiple GL-iNet router products. The vulnerability exists in the s2s (site-to-site) API interface, which fails to properly sanitize user-supplied input before passing it to shell command execution. This flaw allows remote unauthenticated attackers to execute arbitrary shell commands on affected devices, potentially leading to complete device compromise.

Critical Impact
Remote attackers can execute arbitrary shell commands on vulnerable GL-iNet routers without authentication, enabling full device takeover, network pivoting, and persistent backdoor installation.

Affected Products

GL-iNet AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 (firmware v4.3.11)
GL-iNet MT3000/MT2500/AXT1800/AX1800/A1300/X300B (firmware v4.5.16)
GL-iNet XE300 (firmware v4.3.16), E750 (firmware v4.3.12), AP1300/S1300 (firmware v4.3.13)
GL-iNet XE3000/X3000 (firmware v4.4), MT6000 (firmware v4.5.8)
GL-iNet B2200/MV1000/MV1000W/USB150/SF1200/N300/S1300 (firmware v3.216)

Discovery Timeline

August 6, 2024 - CVE-2024-39226 published to NVD
November 12, 2024 - Last updated in NVD database

Technical Details for CVE-2024-39226

Vulnerability Analysis

This vulnerability is classified under CWE-77 (Command Injection) and CWE-22 (Path Traversal). The s2s API interface in GL-iNet router firmware is designed to facilitate site-to-site VPN communication and configuration. However, the implementation fails to properly validate and sanitize input parameters before incorporating them into shell commands executed on the underlying Linux-based operating system.

The vulnerability allows network-based attackers to craft malicious requests to the s2s API endpoint containing shell metacharacters or command separators. When the vulnerable firmware processes these requests, the injected commands are executed with the privileges of the web server process, which typically runs with elevated permissions on embedded router systems.

Root Cause

The root cause of this vulnerability lies in improper input validation within the s2s API handler. The firmware accepts user-controlled input through API parameters and passes this data directly to shell execution functions without adequate sanitization. The absence of input filtering for dangerous characters such as semicolons (;), pipes (|), backticks (`), and command substitution sequences ($(...)) enables attackers to break out of the intended command context and inject arbitrary commands.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker with network access to the router's management interface can send specially crafted HTTP requests to the s2s API endpoint. The malicious payload embedded in API parameters is then processed by the backend, resulting in command execution.

The exploitation flow typically involves:

Identifying a vulnerable GL-iNet router through network scanning or banner grabbing
Crafting a malicious HTTP request targeting the s2s API endpoint
Embedding shell commands within API parameters using command injection techniques
The router executes the injected commands, granting the attacker arbitrary code execution

For detailed technical information about the vulnerability mechanism, see the GL-iNet CVE Issues documentation.

Detection Methods for CVE-2024-39226

Indicators of Compromise

Unusual outbound network connections from the router to unknown external IP addresses
Unexpected processes running on the router that are not part of standard firmware operations
Modifications to router configuration files or the presence of unauthorized user accounts
Anomalous log entries showing malformed s2s API requests with shell metacharacters

Detection Strategies

Monitor HTTP traffic to the router management interface for requests containing shell metacharacters (;, |, `, $()) in s2s API parameters
Implement network intrusion detection rules to flag unusual request patterns targeting GL-iNet router API endpoints
Deploy firmware integrity monitoring to detect unauthorized modifications to system files
Review router access logs for repeated or suspicious API calls from unexpected source addresses

Monitoring Recommendations

Configure network segmentation to isolate router management interfaces from general network traffic
Enable logging on all GL-iNet devices and forward logs to a centralized SIEM for correlation and analysis
Set up alerts for any modifications to critical router configurations or firmware files
Regularly audit network traffic patterns for anomalies indicative of compromised router behavior

How to Mitigate CVE-2024-39226

Immediate Actions Required

Update all affected GL-iNet devices to the latest firmware version available from the vendor immediately
Restrict access to the router management interface to trusted IP addresses only using firewall rules
Disable remote management features if not required for operations
Monitor affected devices for signs of compromise and conduct forensic analysis if suspicious activity is detected

Patch Information

GL-iNet has acknowledged this vulnerability. Administrators should check the GL-iNet official website for the latest firmware releases that address this command injection vulnerability. Review the GL-iNet CVE Issues repository for technical details and update guidance.

Workarounds

Implement strict network access controls to limit which hosts can reach the router management interface
Use a VPN or jump host to access router administration rather than exposing management interfaces directly
Deploy a web application firewall (WAF) or reverse proxy with input validation rules to filter malicious requests
Disable the s2s API functionality if it is not actively used in your deployment

bash

# Example: Restrict management interface access via iptables
# Allow only trusted management IP to access the router web interface
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.100 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 192.168.1.100 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP