CVE-2024-39226: GL-iNet MT6000 Firmware RCE Vulnerability

CVE-2024-39226 Overview

CVE-2024-39226 is a critical command injection vulnerability affecting multiple GL-iNet router products. The vulnerability exists in the s2s (site-to-site) API interface, which fails to properly sanitize user-supplied input before passing it to shell command execution. This flaw allows remote unauthenticated attackers to execute arbitrary shell commands on affected devices, potentially leading to complete device compromise.

Critical Impact

Remote attackers can execute arbitrary shell commands on vulnerable GL-iNet routers without authentication, enabling full device takeover, network pivoting, and persistent backdoor installation.

Affected Products

• GL-iNet AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 (firmware v4.3.11)
• GL-iNet MT3000/MT2500/AXT1800/AX1800/A1300/X300B (firmware v4.5.16)
• GL-iNet XE300 (firmware v4.3.16), E750 (firmware v4.3.12), AP1300/S1300 (firmware v4.3.13)
• GL-iNet XE3000/X3000 (firmware v4.4), MT6000 (firmware v4.5.8)
• GL-iNet B2200/MV1000/MV1000W/USB150/SF1200/N300/S1300 (firmware v3.216)

Discovery Timeline

• August 6, 2024 - CVE-2024-39226 published to NVD
• November 12, 2024 - Last updated in NVD database

Technical Details for CVE-2024-39226

Vulnerability Analysis

This vulnerability is classified under CWE-77 (Command Injection) and CWE-22 (Path Traversal). The s2s API interface in GL-iNet router firmware is designed to facilitate site-to-site VPN communication and configuration. However, the implementation fails to properly validate and sanitize input parameters before incorporating them into shell commands executed on the underlying Linux-based operating system.

The vulnerability allows network-based attackers to craft malicious requests to the s2s API endpoint containing shell metacharacters or command separators. When the vulnerable firmware processes these requests, the injected commands are executed with the privileges of the web server process, which typically runs with elevated permissions on embedded router systems.

Root Cause

The root cause of this vulnerability lies in improper input validation within the s2s API handler. The firmware accepts user-controlled input through API parameters and passes this data directly to shell execution functions without adequate sanitization. The absence of input filtering for dangerous characters such as semicolons (;), pipes (|), backticks (`), and command substitution sequences ($(...)) enables attackers to break out of the intended command context and inject arbitrary commands.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker with network access to the router's management interface can send specially crafted HTTP requests to the s2s API endpoint. The malicious payload embedded in API parameters is then processed by the backend, resulting in command execution.

The exploitation flow typically involves:

1. Identifying a vulnerable GL-iNet router through network scanning or banner grabbing
2. Crafting a malicious HTTP request targeting the s2s API endpoint
3. Embedding shell commands within API parameters using command injection techniques
4. The router executes the injected commands, granting the attacker arbitrary code execution

For detailed technical information about the vulnerability mechanism, see the GL-iNet CVE Issues documentation.

Detection Methods for CVE-2024-39226

Indicators of Compromise

• Unusual outbound network connections from the router to unknown external IP addresses
• Unexpected processes running on the router that are not part of standard firmware operations
• Modifications to router configuration files or the presence of unauthorized user accounts
• Anomalous log entries showing malformed s2s API requests with shell metacharacters

Detection Strategies

• Monitor HTTP traffic to the router management interface for requests containing shell metacharacters (;, |, `, $()) in s2s API parameters
• Implement network intrusion detection rules to flag unusual request patterns targeting GL-iNet router API endpoints
• Deploy firmware integrity monitoring to detect unauthorized modifications to system files
• Review router access logs for repeated or suspicious API calls from unexpected source addresses

Monitoring Recommendations

• Configure network segmentation to isolate router management interfaces from general network traffic
• Enable logging on all GL-iNet devices and forward logs to a centralized SIEM for correlation and analysis
• Set up alerts for any modifications to critical router configurations or firmware files
• Regularly audit network traffic patterns for anomalies indicative of compromised router behavior

How to Mitigate CVE-2024-39226

Immediate Actions Required

• Update all affected GL-iNet devices to the latest firmware version available from the vendor immediately
• Restrict access to the router management interface to trusted IP addresses only using firewall rules
• Disable remote management features if not required for operations
• Monitor affected devices for signs of compromise and conduct forensic analysis if suspicious activity is detected

Patch Information

GL-iNet has acknowledged this vulnerability. Administrators should check the GL-iNet official website for the latest firmware releases that address this command injection vulnerability. Review the GL-iNet CVE Issues repository for technical details and update guidance.

Workarounds

• Implement strict network access controls to limit which hosts can reach the router management interface
• Use a VPN or jump host to access router administration rather than exposing management interfaces directly
• Deploy a web application firewall (WAF) or reverse proxy with input validation rules to filter malicious requests
• Disable the s2s API functionality if it is not actively used in your deployment

# Example: Restrict management interface access via iptables
# Allow only trusted management IP to access the router web interface
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.100 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 192.168.1.100 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP