CVE-2024-54082: home 5G HR02 OS Command Injection Flaw

CVE-2024-54082 Overview

CVE-2024-54082 is an operating system (OS) command injection vulnerability [CWE-78] affecting Sharp's home 5G HR02 and Wi-Fi STATION SH-54C mobile routers. The flaw resides in the configuration restore function of the device management interface. An authenticated administrative user can supply crafted input during a configuration restore operation to execute arbitrary OS commands with root privileges. Successful exploitation results in full compromise of the device's confidentiality, integrity, and availability.

Critical Impact
An authenticated administrator can execute arbitrary OS commands as root on the affected router, taking full control of the device and any traffic that traverses it.

Affected Products

Sharp home 5G HR02
Sharp Wi-Fi STATION SH-54C
Refer to the JVN Security Advisory JVN61635834 for the specific affected firmware versions

Discovery Timeline

2024-12-23 - CVE-2024-54082 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-54082

Vulnerability Analysis

The vulnerability is classified as OS Command Injection [CWE-78]. The affected routers expose an administrative configuration restore function that accepts user-supplied input, likely from a backup or configuration archive. This input is passed to an underlying shell or system call without adequate sanitization or safe-argument handling.

An attacker with administrative credentials can embed shell metacharacters or command separators into the restore payload. When the device processes the restore request, those characters are interpreted by the OS shell and executed with root privileges. Because the routers act as the network gateway for connected clients, an attacker who compromises the device can intercept traffic, pivot to internal hosts, and persist across reboots by modifying firmware-resident configuration.

Exploitation requires high privileges (an authenticated administrative session), which reduces the exposure window, but credential reuse, weak default credentials, or a chained authentication flaw would materially raise the risk. The vulnerability is network-reachable through the device's management interface.

Root Cause

The root cause is unsafe construction of an OS command string from attacker-controlled configuration restore input. The application does not enforce input validation, escaping, or use of a safe execution API such as execve with an argument array. As a result, embedded shell metacharacters are executed by the underlying interpreter.

Attack Vector

Exploitation requires network access to the router's administrative interface and valid administrator credentials. The attacker uploads or submits a crafted configuration payload through the restore feature. The device parses the payload, interpolates attacker-controlled fields into a shell command, and executes it as root. No user interaction on the victim side is required. Full technical details are described in the JVN Security Advisory JVN61635834.

// No verified public proof-of-concept is available.
// Vulnerability class: OS command injection via configuration restore input,
// executed with root privileges after administrator authentication.

Detection Methods for CVE-2024-54082

Indicators of Compromise

Unexpected administrative logins to the router management interface, particularly from unfamiliar source IP addresses or outside normal maintenance windows.
Configuration restore events in device logs that are not correlated with a scheduled change or ticketed maintenance activity.
Outbound connections from the router to unknown hosts, or DNS resolution requests originating from the router that deviate from baseline behavior.
Unexpected changes to firewall rules, DNS settings, or administrative account credentials on the device.

Detection Strategies

Monitor administrative authentication logs on the router for brute-force attempts, credential stuffing, and successful logins from unusual geolocations.
Alert on any use of the configuration restore function, and treat it as a high-signal event that requires human validation.
Inspect north-south traffic from the router to detect command-and-control beaconing or tunneling initiated by the device itself.

Monitoring Recommendations

Forward router syslog and administrative event logs to a centralized logging platform for retention and correlation.
Baseline normal management-plane traffic and alert on deviations, especially traffic sourced from the router to external endpoints.
Review device configuration hashes periodically to detect unauthorized modifications.

How to Mitigate CVE-2024-54082

Immediate Actions Required

Apply the vendor firmware update as soon as it is available for your model. Consult the Sharp Information Support Page for release details.
Rotate administrator credentials on affected devices and enforce strong, unique passwords.
Restrict access to the router administrative interface to trusted management networks only.
Review recent configuration restore events and audit device configuration for unauthorized changes.

Patch Information

Sharp publishes firmware update guidance and affected version details on the Sharp Information Support Page. Administrators should identify the running firmware version on each device and apply the fixed release following the vendor's documented procedure.

Workarounds

Disable remote administrative access to the router where it is not required, and require management access only from the local LAN.
Place the router management interface behind an access control list that restricts source IPs to designated administrative workstations.
Limit the number of accounts with administrative privileges, and remove or disable unused administrator accounts.

bash

# Example: restrict management access to a specific admin subnet at the upstream firewall
# Replace 192.0.2.0/24 with your administrative subnet and <router-ip> with the device address
iptables -A FORWARD -s 192.0.2.0/24 -d <router-ip> -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d <router-ip> -p tcp --dport 443 -j DROP