CVE-2024-53944: Tuoshi/Dionlink LT15D/LT21B RCE Flaw

CVE-2024-53944 Overview

A critical command injection vulnerability has been identified in Tuoshi/Dionlink 4G Wi-Fi devices, specifically affecting the LT15D and LT21B models. The vulnerability exists in the /goform/formJsonAjaxReq endpoint, which fails to properly sanitize shell metacharacters sent via JSON parameters. This security flaw allows unauthenticated remote attackers with network access to execute arbitrary operating system commands with root privileges, potentially leading to complete device compromise.

Critical Impact

Unauthenticated remote attackers can achieve root-level command execution on affected devices, enabling complete takeover of the 4G Wi-Fi router and potential lateral movement into connected networks.

Affected Products

• Tuoshi/Dionlink LT15D 4G Wi-Fi devices through firmware version M7628NNxlSPv2xUI_v1.0.1802.10.08_P4
• Tuoshi/Dionlink LT21B 4G Wi-Fi devices through firmware version M7628xUSAxUIv2_v1.0.1481.15.02_P0

Discovery Timeline

• 2025-02-27 - CVE-2024-53944 published to NVD
• 2025-03-04 - Last updated in NVD database

Technical Details for CVE-2024-53944

Vulnerability Analysis

This vulnerability is classified as CWE-94 (Improper Control of Generation of Code / Code Injection). The affected Tuoshi/Dionlink 4G Wi-Fi devices expose a web management interface that processes JSON-formatted requests through the /goform/formJsonAjaxReq endpoint. The endpoint fails to implement proper input validation and sanitization for shell metacharacters within JSON parameters before passing user-controlled data to system shell commands.

The attack requires no authentication, meaning any attacker with network access to the device's management interface can exploit this vulnerability. Given that these are 4G Wi-Fi routers that may be exposed to the internet or accessible from connected networks, the attack surface is significant. Successful exploitation grants the attacker root-level privileges on the device, providing complete control over the router's operating system.

Root Cause

The root cause of this vulnerability is improper input validation in the web application's request handling code. The /goform/formJsonAjaxReq endpoint directly incorporates user-supplied JSON parameter values into shell commands without sanitizing dangerous characters such as semicolons (;), pipes (|), backticks (`), dollar signs followed by parentheses ($()), and other shell metacharacters. This allows attackers to break out of the intended command context and inject arbitrary commands.

Attack Vector

The attack is network-based and can be executed remotely without authentication. An attacker sends a crafted HTTP POST request to the /goform/formJsonAjaxReq endpoint containing malicious shell metacharacters within JSON parameters. When the vulnerable firmware processes this request, the injected commands are executed with root privileges.

The exploitation is straightforward: an attacker with network visibility to the device's web interface can craft a malicious JSON payload containing shell metacharacters that, when processed by the backend, result in arbitrary command execution. Technical details and a proof-of-concept demonstration are available in the CVE-2024-53944 Whitepaper and the Firmware Exploit Demonstration.

Detection Methods for CVE-2024-53944

Indicators of Compromise

• Unusual HTTP POST requests to /goform/formJsonAjaxReq containing shell metacharacters such as ;, |, $(), or backticks in JSON parameters
• Unexpected outbound network connections originating from the router device
• Evidence of unauthorized processes running on the device or modifications to system files
• Network traffic anomalies indicating data exfiltration or reverse shell connections from the router

Detection Strategies

• Implement network intrusion detection rules to identify HTTP POST requests to /goform/formJsonAjaxReq containing common command injection patterns
• Monitor for suspicious JSON payloads containing shell metacharacters in web server access logs
• Deploy web application firewall (WAF) rules to block requests containing command injection attempts targeting the vulnerable endpoint
• Establish baseline network behavior for the device and alert on deviations indicating compromise

Monitoring Recommendations

• Enable logging on network security devices to capture all traffic to and from affected Tuoshi/Dionlink devices
• Implement regular integrity checks on device configurations to detect unauthorized modifications
• Monitor for DNS queries or network connections to known malicious infrastructure from IoT device IP addresses
• Consider network segmentation to isolate IoT devices and limit the impact of potential compromise

How to Mitigate CVE-2024-53944

Immediate Actions Required

• Restrict network access to the device management interface using firewall rules, limiting access to trusted IP addresses only
• Disable WAN-side access to the web management interface if not required
• Implement network segmentation to isolate affected devices from critical network resources
• Monitor affected devices for signs of compromise and investigate any suspicious activity

Patch Information

At the time of this writing, no vendor patch information has been published for this vulnerability. Organizations should monitor the Tuoshi product pages for firmware updates addressing this security issue. Consider replacing vulnerable devices with alternative products if no patch is forthcoming.

Workarounds

• Block external access to the device's web management interface at the network perimeter firewall
• Implement a web application firewall (WAF) or reverse proxy that filters requests containing shell metacharacters before they reach the device
• Place affected devices on an isolated network segment with strict egress filtering to limit the impact of potential compromise
• Consider deploying alternative 4G router solutions from vendors with better security track records if the devices cannot be adequately secured

# Example firewall rule to restrict management interface access (iptables)
# Replace 192.168.1.0/24 with your trusted management network
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP