CVE-2024-7120: Raisecom Msg2300 Firmware RCE Vulnerability

CVE-2024-7120 Overview

A critical OS command injection vulnerability has been identified in Raisecom gateway devices, specifically affecting the MSG1200, MSG2100E, MSG2200, and MSG2300 series running firmware version 3.90. The vulnerability exists within the list_base_config.php file of the Web Interface component, where improper handling of the template argument allows attackers to inject and execute arbitrary operating system commands.

This vulnerability is particularly concerning as it can be exploited remotely over the network by authenticated users. The exploit has been publicly disclosed and documented, significantly increasing the risk of active exploitation against vulnerable devices. With an EPSS score of 92.68% (99.7th percentile), this vulnerability has an exceptionally high probability of being exploited in the wild.

Critical Impact

Remote attackers can execute arbitrary OS commands on vulnerable Raisecom gateway devices through the web interface, potentially leading to complete device compromise, network pivoting, and persistent access to network infrastructure.

Affected Products

• Raisecom MSG1200 Firmware 3.90
• Raisecom MSG2100E Firmware 3.90
• Raisecom MSG2200 Firmware 3.90
• Raisecom MSG2300 Firmware 3.90

Discovery Timeline

• 2024-07-26 - CVE-2024-7120 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-7120

Vulnerability Analysis

CVE-2024-7120 represents a classic OS command injection vulnerability (CWE-78) affecting the web management interface of multiple Raisecom gateway device models. The vulnerability resides in the list_base_config.php file, which fails to properly sanitize user-supplied input for the template parameter before incorporating it into system commands.

The network-accessible nature of this vulnerability combined with low attack complexity makes it particularly dangerous for organizations using these gateway devices. Successful exploitation allows an attacker to execute arbitrary commands with the privileges of the web server process, which typically runs with elevated permissions on embedded devices.

The public availability of exploit information through VulDB and detailed technical analysis significantly lowers the barrier for exploitation.

Root Cause

The root cause of this vulnerability is insufficient input validation and sanitization in the list_base_config.php script. The template parameter accepts user-controlled input that is directly passed to system shell commands without proper escaping or validation. This allows attackers to break out of the intended command context and inject additional commands using shell metacharacters such as semicolons (;), pipes (|), or command substitution syntax.

Attack Vector

The attack is carried out remotely over the network against the web management interface of vulnerable Raisecom gateway devices. An attacker with valid credentials (low privilege requirement) can craft malicious HTTP requests to the list_base_config.php endpoint with specially crafted values in the template parameter containing shell metacharacters and arbitrary commands.

The vulnerability does not require user interaction beyond the initial authentication, making it suitable for automated exploitation. Once command execution is achieved, attackers can establish reverse shells, modify device configurations, exfiltrate sensitive data, or use the compromised device as a pivot point for further network intrusion.

Technical details regarding the exploitation mechanism can be found in the NetSecFish Command Injection Analysis.

Detection Methods for CVE-2024-7120

Indicators of Compromise

• Unusual HTTP requests to list_base_config.php containing shell metacharacters (;, |, &&, $(), backticks) in the template parameter
• Unexpected outbound connections from gateway devices to external IP addresses
• Anomalous process execution on the device, particularly shell processes spawned by the web server
• Modified configuration files or unauthorized user accounts on the device

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing command injection patterns targeting list_base_config.php
• Monitor HTTP access logs for suspicious requests to the vulnerable endpoint with encoded or obfuscated shell commands
• Deploy network intrusion detection signatures to identify exploitation attempts against Raisecom gateway devices
• Conduct regular vulnerability scans to identify devices running affected firmware version 3.90

Monitoring Recommendations

• Enable comprehensive logging on Raisecom gateway devices and forward logs to a centralized SIEM solution
• Monitor for unauthorized configuration changes or new user account creation on gateway devices
• Implement network segmentation to isolate gateway management interfaces from untrusted networks
• Set up alerts for any outbound connections from gateway devices to known malicious infrastructure

How to Mitigate CVE-2024-7120

Immediate Actions Required

• Restrict access to the web management interface to trusted IP addresses only using access control lists (ACLs)
• Place Raisecom gateway devices behind a firewall that blocks direct internet access to management interfaces
• Implement strong authentication credentials and consider multi-factor authentication if supported
• Audit existing device configurations and user accounts for signs of compromise

Patch Information

At the time of publication, no official patch information from Raisecom has been documented in the vulnerability databases. Organizations should contact Raisecom directly to inquire about firmware updates that address CVE-2024-7120. Monitor the VulDB entry for updates on patch availability.

Workarounds

• Disable the web management interface if not required and use alternative management methods such as console access
• Implement network-level access controls to restrict management interface access to specific management workstations
• Deploy a reverse proxy with input validation in front of the web interface to filter malicious requests
• Consider replacing affected devices with alternative solutions if patches are not available

# Example: Restrict access to management interface using iptables on a perimeter firewall
# Allow management access only from trusted admin network (10.0.0.0/24)
iptables -A FORWARD -d <RAISECOM_DEVICE_IP> -p tcp --dport 80 -s 10.0.0.0/24 -j ACCEPT
iptables -A FORWARD -d <RAISECOM_DEVICE_IP> -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A FORWARD -d <RAISECOM_DEVICE_IP> -p tcp --dport 80 -j DROP
iptables -A FORWARD -d <RAISECOM_DEVICE_IP> -p tcp --dport 443 -j DROP