CVE-2024-4231

Executive Summary

CVE-2024-4231 exposes a critical physical access vulnerability in the Digisol DG-GR1321 router (Hardware version 3.7L, Firmware v3.2.02). The device exposes a root terminal on a serial interface (UART) without any authentication or access control. An attacker with physical access can identify the UART pins, connect a serial adapter, and immediately obtain a root shell on the system. This grants full control over the router, including the ability to extract sensitive configuration data, modify firmware, pivot into the internal network, or install persistent backdoors.

The vulnerability is classified as CWE-1191: On-Chip Debug and Test Interface With Improper Access Control. The CVSS score is 0.0 in the NVD data, but based on the impact and attack vector, a more accurate score is CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (Base: 6.6). The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk is high for targeted physical attacks.

No supply chain or package security implications – this is a hardware/firmware vulnerability in an embedded device.

CVSS Breakdown & Threat Level

Threat Level: Medium (physical access required, but impact is total compromise).

Deep Dive & Mechanics

The Digisol DG-GR1321 router uses a standard embedded Linux system. The UART (Universal Asynchronous Receiver-Transmitter) interface is exposed on the PCB, typically via a 4-pin header (VCC, GND, TX, RX). In a properly secured device, the UART console would either be disabled in production or require authentication (e.g., a login prompt). In this device, the UART directly presents a root shell without any login prompt.

Attack Flow:

1. Physical Access: Attacker gains physical access to the router (e.g., during shipping, in an unattended office, or after theft).
2. Disassembly: The attacker opens the router casing (usually with standard tools).
3. Pin Identification: Using a multimeter or visual inspection, the attacker identifies the UART pins (TX, RX, GND). VCC is often not needed for communication.
4. Connection: The attacker connects a USB-to-UART adapter (e.g., FTDI, CP2102) to the identified pins.
5. Terminal Access: Using a serial terminal program (e.g., PuTTY, screen, minicom) at the correct baud rate (typically 115200 or 57600), the attacker sees a root shell prompt (# or root@router:~#).
6. Exploitation: The attacker can now execute any command as root.

Why it works: The device's bootloader (U-Boot) or kernel command line passes console=ttyS0,115200 and the init process spawns a getty on that serial line without requiring a login. This is a common misconfiguration in embedded devices.

Vulnerable vs. Patched Code

Vulnerable Configuration (firmware v3.2.02): The /etc/inittab or systemd service file likely contains:

ttyS0::respawn:/sbin/getty -L ttyS0 115200 vt100

Or the kernel command line includes console=ttyS0,115200 and the init system starts a shell directly.

Patched Configuration (hypothetical): A patched firmware would either:

• Remove the serial console entirely.
• Add a login prompt (e.g., getty -L ttyS0 115200 vt100 with a login program).
• Disable the UART in the bootloader or kernel device tree.

No official patch is available as of this report.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Digisol DG-GR1321 router (Hardware 3.7L, Firmware v3.2.02)
• USB-to-UART adapter (e.g., FTDI FT232RL)
• Jumper wires
• Screwdriver (to open the case)
• Terminal software (PuTTY, screen, minicom)

Steps:

1. Open the router – remove screws and pry open the case.
2. Locate UART header – look for a 4-pin header near the SoC or flash chip. Pins are usually labeled TX, RX, GND, VCC.
3. Connect UART adapter:
   • Adapter GND → Router GND
   • Adapter RX → Router TX
   • Adapter TX → Router RX
   • (Do not connect VCC unless needed)
4. Open terminal (e.g., screen /dev/ttyUSB0 115200).
5. Power on the router – you should see boot messages and then a root shell prompt.
6. Execute commands – e.g., cat /etc/shadow, ifconfig, iptables -L.

Example terminal output:

U-Boot 2013.07 (Apr 12 2021 - 15:30:00)
...
Starting kernel ...
...
Welcome to Digisol Linux
root@DG-GR1321:~#

Blue Team (Defender)

Detection of Physical Tampering:

• Visual inspection: Check for opened casing, scratches around screw holes, or foreign objects (e.g., wires) near the PCB.
• Tamper-evident seals: Apply tamper-evident stickers over the casing seams.
• Serial port monitoring: If the device is in a controlled environment, monitor for unexpected serial traffic (e.g., using a logic analyzer on the UART lines).

Mitigation:

• Physical security: Place routers in locked racks or enclosures.
• Firmware hardening: Request vendor to provide a patched firmware that disables the UART console or adds authentication.
• Network segmentation: Isolate the router's management interface from the production network.

Indicators of Compromise (IOCs)

File System IOCs (if attacker modifies the device):

• /etc/shadow – modified password hashes.
• /etc/init.d/ or /etc/rc.d/ – new startup scripts.
• /root/.ssh/authorized_keys – unauthorized SSH keys.
• /tmp/ – suspicious binaries or scripts.

Network IOCs:

• Unexpected outbound connections from the router to external IPs (e.g., C2 servers).
• New listening ports (e.g., SSH on port 22 or 2222).
• DNS queries to known malicious domains.

Hardware IOCs:

• Physical damage to the casing or PCB.
• Solder flux residue near UART pins.
• Missing or broken tamper-evident seals.

Detection Engineering

YARA Rule

rule CVE_2024_4231_UART_Root_Shell {
    meta:
        description = "Detects firmware images with exposed UART root shell (CVE-2024-4231)"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-4231"
    strings:
        $inittab = "ttyS0::respawn:/sbin/getty -L ttyS0 115200 vt100"
        $kernel_cmdline = "console=ttyS0,115200"
        $root_prompt = "root@DG-GR1321"
    condition:
        any of them
}

Sigma Rule

title: Detection of UART Root Shell Access on Digisol Router
id: 7b8c3d2e-1f4a-5b6c-7d8e-9f0a1b2c3d4e
status: experimental
description: Detects serial console login without authentication on Digisol DG-GR1321
author: Valters IT
date: 2025-04-10
logsource:
    product: linux
    service: auth
detection:
    selection:
        - Message: "root login on ttyS0"
        - Message: "serial console: root"
    condition: selection
falsepositives:
    - Legitimate administrative access via serial console (if authentication is enabled)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-4231 - Digisol Router UART Root Shell - Potential C2 Traffic"; flow:to_server; content:"|00|"; depth:1; classtype:trojan-activity; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Physical security: Restrict physical access to the router. Place it in a locked room or cabinet.
2. Firmware update: Contact Digisol for a patched firmware. If unavailable, consider replacing the device.
3. Disable UART (if possible): If you have access to the bootloader (e.g., via TFTP), modify the kernel command line to remove console=ttyS0 or set console=null.

Long-term Recommendations:

• Vendor accountability: Demand that Digisol release a security patch that disables the UART console or adds authentication.
• Hardware redesign: Future hardware revisions should not expose UART pins on the PCB, or should require a physical jumper to enable them.
• Monitoring: Implement network monitoring for anomalous traffic from the router.

Workaround (if patching is not possible):

• Physically cut the TX and RX traces on the PCB (permanent, irreversible).
• Apply epoxy over the UART header to prevent access.

Valters IT