Thousands of industrial routers vulnerable to command injection flaw  – djohnson

– [[{“value”:”

Thousands of industrial routers from a Chinese telecommunications equipment manufacturer are vulnerable to a post-authentication vulnerability, with indications it is already being exploited in the wild to infect devices with Mirai malware.

On Dec. 27, VulnCheck detailed the vulnerability, tracked as CVE-2024-12856, wherein an attacker can leverage default credentials in Four-Faith F3x24 and F3x36 routers to remotely inject commands into the operating system. 

Meanwhile, a malicious IP was observed attempting to leverage the vulnerability. VulnCheck Chief Technology Officer Jacob Baines wrote that his team identified the same user agent referenced in a November blog by DucklingStudio attempting to use the vulnerability to deploy a different malware payload.

Baines also posted a video demonstration of the flaw being exploited on X.

The vulnerability appears to be connected to the spread of a variant of Mirai, the infamous malware and botnet known to target Internet of Things devices. DucklingStudio used a honeypot to detect the malware on Nov. 9, and an update on Dec. 28 explicitly connected it to the listed CVE for Four-Faith’s industrial routers.

Variants of Mirai —first observed in 2016 and originally written by a group of teenagers to create botnets — remain one of the most popular forms of malware attacking IoT devices worldwide. According to Zscaler, Mirai was identified in over a third of all IoT malware attacks between June 2023 and May 2024, far outpacing other malware families, while more than 75% of blocked IoT transactions were linked to the malicious code.

VulnCheck wrote up a rule for detecting instances of infected routers using the open-source threat detection tool Suricata:

According to Censys, there are at least 15,000 connected routers potentially vulnerable to the flaw, and VulnCheck left open the possibility that additional router products may be affected. The National Institute of Standards and Technology’s National Vulnerability Database lists the severity of the bug at 7.2 and notes that firmware version 2.0 (and possibly others) allows for authenticated and remote command injection attacks over HTTP.

The listed CVE does not yet include details about patching or remediation. Baines noted in his blog that VulnCheck notified Four-Faith of the vulnerability and affected routers on Dec. 20, and directed further questions about remediation to the company. Four-Faith did not return a request for comment sent through its website prior to publication.

According to the company’s website, Four-Faith is headquartered in Xiamen, a city in the Southeastern province of Fujian, China. It specializes in manufacturing industrial routers, Internet of Things devices, modems and other wireless communications technologies, and claims to have exported its technologies to over 100 countries.

The post Thousands of industrial routers vulnerable to command injection flaw  appeared first on CyberScoop.

“}]]  – Read More  – CyberScoop