CVE-2024-7469: Raisecom MSG2300 Firmware RCE Vulnerability

CVE-2024-7469 Overview

CVE-2024-7469 is an OS command injection vulnerability affecting Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 gateway devices running firmware version 3.90. The flaw resides in the sslvpn_config_mod function within /vpn/list_vpn_web_custom.php in the Web Interface component. Attackers can manipulate the template and stylenum arguments to inject arbitrary operating system commands. The attack can be initiated remotely and requires low privileges. The exploit details have been publicly disclosed under VulDB identifier VDB-273562. The vendor was contacted prior to disclosure but did not respond.

Critical Impact

Authenticated remote attackers can execute arbitrary operating system commands on affected Raisecom MSG gateway devices through the SSL VPN web interface, potentially compromising network perimeter security.

Affected Products

• Raisecom MSG1200 firmware version 3.90
• Raisecom MSG2100E firmware version 3.90
• Raisecom MSG2200 and MSG2300 firmware version 3.90

Discovery Timeline

• 2024-08-05 - CVE-2024-7469 published to NVD
• 2024-08-06 - Last updated in NVD database

Technical Details for CVE-2024-7469

Vulnerability Analysis

The vulnerability is classified as OS Command Injection [CWE-78]. It affects the sslvpn_config_mod function in the /vpn/list_vpn_web_custom.php script, which is part of the SSL VPN configuration interface on Raisecom MSG series gateway devices.

The affected script fails to properly sanitize user-supplied input passed through the template and stylenum parameters. An authenticated attacker can append shell metacharacters to these parameters, which the underlying PHP code passes to a system shell. The injected commands execute with the privileges of the web server process on the gateway device.

The attack surface is reachable over the network via the device's web management interface. Successful exploitation enables attackers to run arbitrary commands on a perimeter network device, undermining its role as a network security control.

Root Cause

The root cause is improper neutralization of special elements used in OS commands. The sslvpn_config_mod function concatenates the template and stylenum request parameters into a shell command string without input validation, escaping, or use of safe execution APIs.

Attack Vector

Exploitation requires network access to the device's web interface and valid low-privilege credentials. An attacker sends a crafted HTTP request to /vpn/list_vpn_web_custom.php containing malicious payload data in the template or stylenum parameter. Shell metacharacters such as semicolons, pipes, or backticks allow command chaining. The command injection executes within the SSL VPN configuration handler, granting attackers a foothold on the gateway.

The vulnerability mechanism is documented in the public GitHub Command Injection Report and the corresponding VulDB entry #273562.

Detection Methods for CVE-2024-7469

Indicators of Compromise

• HTTP POST or GET requests to /vpn/list_vpn_web_custom.php containing shell metacharacters (;, |, &, `, $()) in the template or stylenum parameters.
• Unexpected child processes spawned by the web server process on Raisecom MSG gateway devices.
• Outbound network connections from the gateway to unfamiliar hosts following SSL VPN configuration requests.

Detection Strategies

• Inspect web server access logs for requests targeting list_vpn_web_custom.php with non-standard characters in the template or stylenum query string values.
• Deploy network intrusion detection signatures that flag HTTP parameter values containing OS command syntax against the SSL VPN configuration endpoint.
• Correlate authentication events on the gateway with subsequent VPN configuration changes to identify abuse of low-privilege accounts.

Monitoring Recommendations

• Forward gateway web interface and system logs to a centralized logging platform for retention and analysis.
• Alert on any process execution chain originating from the PHP handler on gateway devices, since legitimate operation should not require shell command invocation.
• Monitor management interface exposure and restrict access to the SSL VPN administrative endpoints to trusted source addresses.

How to Mitigate CVE-2024-7469

Immediate Actions Required

• Restrict network access to the gateway web management interface using firewall rules or access control lists, allowing only trusted administrator IP ranges.
• Disable the SSL VPN web customization feature if it is not in active use within the environment.
• Rotate credentials for all accounts with access to the gateway web interface, and remove any unused or default accounts.
• Audit Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 devices running firmware 3.90 for signs of unauthorized configuration changes.

Patch Information

No vendor advisory or patch is available for CVE-2024-7469 at the time of writing. According to the public disclosure, the vendor was contacted prior to release but did not respond. Operators of affected devices should contact Raisecom directly for remediation guidance and consult the VulDB entry for updates.

Workarounds

• Place affected gateways behind a separate management network or VPN, eliminating direct exposure of the web interface to untrusted networks.
• Apply a reverse proxy or web application firewall in front of the device to filter requests containing shell metacharacters in the template and stylenum parameters.
• Consider replacing or decommissioning unsupported firmware versions where no vendor patch is forthcoming.