CVE-2024-28326

Executive Summary

CVE-2024-28326 identifies an Incorrect Access Control vulnerability in ASUS RT-N12+ B1 and RT-N12 D1 routers. The flaw allows a local attacker with physical access to the device to obtain a root terminal via the UART (Universal Asynchronous Receiver-Transmitter) interface. This is a hardware-level attack vector that bypasses authentication and grants full system control. The vulnerability is unpatched, and no official fix has been released by ASUS. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk is significant for targeted physical attacks.

Supply Chain & Package Security

This vulnerability is not related to software supply chain or package management; it is a hardware-level access control issue in embedded firmware.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official CVSS vector assigned)
• Attack Vector (AV): Local (requires physical access)
• Attack Complexity (AC): Low (UART pins are exposed on the PCB)
• Privileges Required (PR): None (no authentication needed)
• User Interaction (UI): None
• Scope (S): Unchanged
• Confidentiality (C): High (full filesystem access)
• Integrity (I): High (can modify firmware)
• Availability (A): High (can brick device)
• Threat Level: High for physical access scenarios; Low for remote exploitation.

Deep Dive & Mechanics

The vulnerability stems from the router’s UART interface being left unprotected. UART is a serial communication protocol used for debugging and firmware flashing. On the affected ASUS models, the UART pins are exposed on the printed circuit board (PCB) and are accessible without authentication. By connecting a USB-to-UART adapter (e.g., FTDI cable) to the correct pins (TX, RX, GND), an attacker can initiate a serial console session. The bootloader (CFE) does not enforce any password or access control, allowing the attacker to interrupt the boot process and drop into a root shell.

Key technical details:

• The UART interface runs at 115200 baud (common default).
• The bootloader (CFE) allows interruption via a keypress (e.g., Ctrl+C) during boot.
• Once in the bootloader, the attacker can issue commands to read/write flash memory, dump credentials, or load a custom firmware.
• The vulnerability is present in both the RT-N12+ B1 and RT-N12 D1 hardware revisions.

Vulnerable vs. Patched Code

Since this is a hardware-level vulnerability, there is no code diff. The vulnerable configuration is the absence of UART authentication in the bootloader. A patched version would require:

• Adding a password prompt in the bootloader before granting shell access.
• Disabling UART console in production firmware.
• Physically depopulating UART pins on the PCB.

No patched firmware exists from ASUS.

Exploitation & Lab Setup

Red Team

Prerequisites:

• ASUS RT-N12+ B1 or RT-N12 D1 router
• USB-to-UART adapter (e.g., FT232RL)
• Terminal software (e.g., PuTTY, screen, minicom)
• Jumper wires

Steps:

1. Disassemble the router to expose the PCB.
2. Locate the UART header (usually 4 pins: VCC, TX, RX, GND). Refer to the router’s schematic or online resources for pinout.
3. Connect the USB-to-UART adapter:
   • Adapter TX → Router RX
   • Adapter RX → Router TX
   • Adapter GND → Router GND
   • Do NOT connect VCC (power) to avoid damage.
4. Open terminal software with settings: 115200 baud, 8 data bits, no parity, 1 stop bit (8N1).
5. Power on the router. Immediately press Ctrl+C repeatedly to interrupt the boot process.
6. You will be dropped into the CFE bootloader prompt (e.g., CFE>).
7. Issue commands to gain root access:

   # Example: Dump firmware
   CFE> flash -noheader 192.168.1.100:/firmware.bin
   # Or drop to shell
   CFE> go
   

8. Alternatively, if the bootloader does not provide a shell, you can modify the bootargs to boot into a custom initramfs.

Expected output:

CFE> version
CFE version 1.0.38-112.54 for BCM947XX (32bit,SP,LE)
Build Date: Mon Oct 12 15:23:45 CST 2020
...
CFE> 

Blue Team

Detection:

• Monitor for physical tampering: check for opened chassis, loose screws, or foreign objects near UART pins.
• Use tamper-evident seals on the router casing.
• Implement network monitoring for unusual traffic patterns (e.g., firmware downloads from unknown IPs).
• Enable logging on the router (if possible) to capture serial console activity.

Mitigation:

• Physically secure routers in locked enclosures.
• Disable UART by removing the header pins or applying epoxy over the pads.
• Use a bootloader that requires authentication (e.g., custom CFE build).
• Apply firmware updates if ASUS releases a patch in the future.

Indicators of Compromise (IOCs)

• Physical: Opened router casing, exposed PCB, connected UART adapter.
• Network: Unusual outbound connections to IPs hosting firmware images (e.g., 192.168.1.100 in the example).
• Firmware: Modified bootloader or firmware hash mismatch.
• Logs: Serial console logs showing CFE commands (e.g., flash, go, boot).
• File System: Presence of unauthorized files in /tmp or /var (if attacker gains shell access).

Detection Engineering

YARA Rule

rule CVE_2024_28326_UART_Access {
    meta:
        description = "Detects UART access patterns in ASUS RT-N12 routers"
        author = "Valters IT"
        date = "2024-03-01"
        reference = "CVE-2024-28326"
    strings:
        $cfeprompt = "CFE>"
        $uart_baud = "115200"
        $boot_interrupt = { 43 54 52 4C 2B 43 } // "Ctrl+C" in hex
    condition:
        any of them
}

Sigma Rule

title: ASUS Router UART Root Shell Access
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects serial console activity on ASUS RT-N12 routers via UART
author: Valters IT
logsource:
    product: linux
    service: kernel
detection:
    selection:
        EventID: 1
        CommandLine|contains: "CFE>"
    condition: selection
falsepositives:
    - Legitimate debugging by authorized personnel
level: high

Suricata Rule

alert tcp any any -> any 23 (msg:"CVE-2024-28326 ASUS Router UART Access via Telnet"; flow:to_server; content:"CFE>"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Physical Security: Place routers in locked cabinets or enclosures to prevent physical access.
2. UART Disable: Remove or disable the UART header on the PCB. This can be done by desoldering the pins or applying non-conductive epoxy.
3. Bootloader Hardening: If you have access to the firmware source, modify the CFE bootloader to require a password before dropping into a shell.
4. Firmware Updates: Monitor ASUS support page for any future firmware updates that address this issue.
5. Network Segmentation: Isolate affected routers from critical network segments to limit lateral movement.
6. Monitoring: Implement physical intrusion detection (e.g., tamper switches) and network monitoring for anomalous traffic.

Valters IT
Securing digital frontiers, one vulnerability at a time.