CVE-2024-53944: Tuoshi/Dionlink LT15D/LT21B RCE Flaw

CVE-2024-53944 Overview

A critical command injection vulnerability has been identified in Tuoshi/Dionlink 4G Wi-Fi devices, specifically affecting the LT15D and LT21B models. The vulnerability exists in the /goform/formJsonAjaxReq endpoint, which fails to properly sanitize shell metacharacters sent via JSON parameters. This security flaw allows unauthenticated remote attackers with network access to execute arbitrary operating system commands with root privileges, potentially leading to complete device compromise.

Critical Impact
Unauthenticated remote attackers can achieve root-level command execution on affected devices, enabling complete takeover of the 4G Wi-Fi router and potential lateral movement into connected networks.

Affected Products

Tuoshi/Dionlink LT15D 4G Wi-Fi devices through firmware version M7628NNxlSPv2xUI_v1.0.1802.10.08_P4
Tuoshi/Dionlink LT21B 4G Wi-Fi devices through firmware version M7628xUSAxUIv2_v1.0.1481.15.02_P0

Discovery Timeline

2025-02-27 - CVE-2024-53944 published to NVD
2025-03-04 - Last updated in NVD database

Technical Details for CVE-2024-53944

Vulnerability Analysis

This vulnerability is classified as CWE-94 (Improper Control of Generation of Code / Code Injection). The affected Tuoshi/Dionlink 4G Wi-Fi devices expose a web management interface that processes JSON-formatted requests through the /goform/formJsonAjaxReq endpoint. The endpoint fails to implement proper input validation and sanitization for shell metacharacters within JSON parameters before passing user-controlled data to system shell commands.

The attack requires no authentication, meaning any attacker with network access to the device's management interface can exploit this vulnerability. Given that these are 4G Wi-Fi routers that may be exposed to the internet or accessible from connected networks, the attack surface is significant. Successful exploitation grants the attacker root-level privileges on the device, providing complete control over the router's operating system.

Root Cause

The root cause of this vulnerability is improper input validation in the web application's request handling code. The /goform/formJsonAjaxReq endpoint directly incorporates user-supplied JSON parameter values into shell commands without sanitizing dangerous characters such as semicolons (;), pipes (|), backticks (`), dollar signs followed by parentheses ($()), and other shell metacharacters. This allows attackers to break out of the intended command context and inject arbitrary commands.

Attack Vector

The attack is network-based and can be executed remotely without authentication. An attacker sends a crafted HTTP POST request to the /goform/formJsonAjaxReq endpoint containing malicious shell metacharacters within JSON parameters. When the vulnerable firmware processes this request, the injected commands are executed with root privileges.

The exploitation is straightforward: an attacker with network visibility to the device's web interface can craft a malicious JSON payload containing shell metacharacters that, when processed by the backend, result in arbitrary command execution. Technical details and a proof-of-concept demonstration are available in the CVE-2024-53944 Whitepaper and the Firmware Exploit Demonstration.

Detection Methods for CVE-2024-53944

Indicators of Compromise

Unusual HTTP POST requests to /goform/formJsonAjaxReq containing shell metacharacters such as ;, |, $(), or backticks in JSON parameters
Unexpected outbound network connections originating from the router device
Evidence of unauthorized processes running on the device or modifications to system files
Network traffic anomalies indicating data exfiltration or reverse shell connections from the router

Detection Strategies

Implement network intrusion detection rules to identify HTTP POST requests to /goform/formJsonAjaxReq containing common command injection patterns
Monitor for suspicious JSON payloads containing shell metacharacters in web server access logs
Deploy web application firewall (WAF) rules to block requests containing command injection attempts targeting the vulnerable endpoint
Establish baseline network behavior for the device and alert on deviations indicating compromise

Monitoring Recommendations

Enable logging on network security devices to capture all traffic to and from affected Tuoshi/Dionlink devices
Implement regular integrity checks on device configurations to detect unauthorized modifications
Monitor for DNS queries or network connections to known malicious infrastructure from IoT device IP addresses
Consider network segmentation to isolate IoT devices and limit the impact of potential compromise

How to Mitigate CVE-2024-53944

Immediate Actions Required

Restrict network access to the device management interface using firewall rules, limiting access to trusted IP addresses only
Disable WAN-side access to the web management interface if not required
Implement network segmentation to isolate affected devices from critical network resources
Monitor affected devices for signs of compromise and investigate any suspicious activity

Patch Information

At the time of this writing, no vendor patch information has been published for this vulnerability. Organizations should monitor the Tuoshi product pages for firmware updates addressing this security issue. Consider replacing vulnerable devices with alternative products if no patch is forthcoming.

Workarounds

Block external access to the device's web management interface at the network perimeter firewall
Implement a web application firewall (WAF) or reverse proxy that filters requests containing shell metacharacters before they reach the device
Place affected devices on an isolated network segment with strict egress filtering to limit the impact of potential compromise
Consider deploying alternative 4G router solutions from vendors with better security track records if the devices cannot be adequately secured

bash

# Example firewall rule to restrict management interface access (iptables)
# Replace 192.168.1.0/24 with your trusted management network
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP