CVE-2024-45721: NTT DOCOMO Routers RCE Vulnerability

CVE-2024-45721 Overview

CVE-2024-45721 is an operating system command injection vulnerability affecting Sharp home 5G HR02, Wi-Fi STATION SH-52B, and Wi-Fi STATION SH-54C wireless routers. The flaw resides in the HOST name configuration screen of the device management interface. An authenticated administrative user can inject arbitrary operating system commands that execute with root privileges. The weakness is classified under CWE-78: Improper Neutralization of Special Elements used in an OS Command.

Critical Impact
An administrative user can execute arbitrary OS commands with root privileges on the affected routers, resulting in full device compromise.

Affected Products

Sharp home 5G HR02
Sharp Wi-Fi STATION SH-52B
Sharp Wi-Fi STATION SH-54C

Discovery Timeline

2024-12-23 - CVE-2024-45721 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-45721

Vulnerability Analysis

The vulnerability exists in the HOST name configuration screen exposed by the router's administrative web interface. The interface accepts user-supplied host name input and passes it to an underlying operating system command without adequate neutralization of shell metacharacters. An attacker who has already authenticated as an administrator can embed shell separators or command substitution sequences within the host name field. The injected payload runs in the context of the process handling the configuration change, which executes as root on the embedded Linux firmware of the affected devices.

Successful exploitation grants complete control over the router, including the ability to read configuration secrets, modify DNS and routing behavior, intercept traffic traversing the device, and persist malicious binaries across reboots. Because the attack vector is network-based via the management interface, exposure is amplified when administrative access is reachable from untrusted network segments.

Root Cause

The root cause is the failure to sanitize or validate input supplied to the host name configuration parameter before it is concatenated into an OS command invocation. This pattern maps directly to CWE-78, where user input is passed unsafely to a command shell.

Attack Vector

Exploitation requires valid administrative credentials and network reachability to the router's management interface. The attacker submits a crafted host name value through the configuration screen. When the firmware processes the value, injected shell metacharacters cause additional commands to execute as root. See the JVN Security Advisory JVN61635834 and Sharp Product Support Information for vendor details.

No public proof-of-concept code has been released, so the vulnerability is described in prose only.

Detection Methods for CVE-2024-45721

Indicators of Compromise

Unexpected outbound connections originating from the router's management plane.
Host name configuration values containing shell metacharacters such as ;, |, &&, or backticks.
Unauthorized changes to DNS resolvers, firewall rules, or firmware artifacts on affected devices.
Administrative logins from unfamiliar source addresses preceding configuration changes.

Detection Strategies

Inspect administrative HTTP requests targeting the HOST name configuration endpoint for suspicious characters in parameter values.
Correlate configuration change events with subsequent process or network anomalies on the router.
Alert on any administrative session originating from outside approved management networks.

Monitoring Recommendations

Forward router administrative logs and syslog output to a centralized logging platform for retention and analysis.
Monitor DNS query patterns from clients behind the router for signs of tampering.
Track firmware version and configuration baselines to identify unauthorized modifications.

How to Mitigate CVE-2024-45721

Immediate Actions Required

Apply firmware updates published by Sharp for home 5G HR02, Wi-Fi STATION SH-52B, and Wi-Fi STATION SH-54C as documented in the Sharp Product Support Information.
Rotate administrative credentials on all affected devices after patching.
Restrict access to the router's administrative interface to trusted management networks only.
Audit recent host name configuration changes for suspicious values.

Patch Information

Sharp has published firmware update guidance through its product support portal. Refer to the Sharp Product Support Information and the JVN Security Advisory JVN61635834 for the fixed firmware versions applicable to each affected model.

Workarounds

Disable remote management on the WAN interface and permit administrative access only from a wired LAN segment.
Enforce strong, unique administrator passwords and enable any available account lockout controls.
Segment IoT and consumer network equipment away from sensitive enterprise assets until firmware updates are deployed.

bash

# Configuration example: restrict management access at an upstream firewall
# Replace <mgmt_subnet> and <router_ip> with your environment values
iptables -A FORWARD -s <mgmt_subnet> -d <router_ip> -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d <router_ip> -p tcp --dport 443 -j DROP