CVE-2024-44577

Executive Summary

CVE-2024-44577 is a command injection vulnerability discovered in RELY-PCIe firmware versions v22.2.1 through v23.1.0. The flaw resides in the time_date function, allowing an authenticated attacker to inject arbitrary operating system commands. Given the critical nature of PCIe devices in industrial and enterprise environments, successful exploitation could lead to full device compromise, lateral movement, and persistent access to sensitive networks. No public proof-of-concept or patch is currently available, elevating the risk for unmonitored deployments.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official vector assigned)
• Attack Vector (AV): Likely Network (adjacent or local network)
• Attack Complexity (AC): Low
• Privileges Required (PR): Low (authenticated user)
• User Interaction (UI): None
• Scope (S): Unchanged
• Confidentiality (C): High
• Integrity (I): High
• Availability (A): High
• Threat Level: Critical (based on impact and lack of patch)

Deep Dive & Mechanics

The vulnerability is a classic command injection flaw in the time_date function of RELY-PCIe firmware. This function likely accepts user-supplied date/time parameters (e.g., via a web interface or API) and passes them unsanitized to a system shell command (e.g., date or hwclock). An attacker with low privileges can inject shell metacharacters such as ;, |, &&, or backticks to execute arbitrary commands.

Attack Flow:

1. Attacker gains access to the RELY-PCIe management interface (e.g., via default credentials or network access).
2. Attacker sends a crafted request to the time_date endpoint with payload like 2024-01-01; id.
3. The firmware executes the injected command, returning output to the attacker.
4. Attacker escalates to full device control, potentially pivoting to other network segments.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

void set_time_date(char *user_input) {
    char cmd[256];
    snprintf(cmd, sizeof(cmd), "date -s '%s'", user_input);
    system(cmd);
}

Patched Code (Conceptual):

void set_time_date(char *user_input) {
    // Validate input: only allow digits, hyphens, colons, spaces
    if (!is_valid_datetime(user_input)) {
        log_error("Invalid datetime format");
        return;
    }
    // Use safe API instead of system()
    set_system_time(user_input);
}

The patch must include input validation (whitelist regex) and replacement of system() with a safe API that does not invoke a shell.

Exploitation & Lab Setup

Red Team

Lab Environment:

• RELY-PCIe device (firmware v22.2.1 to v23.1.0)
• Attacker machine on same network segment
• Tools: Burp Suite, netcat, curl

Exploitation Steps:

1. Identify the management interface (e.g., https://<device-ip>/admin).
2. Authenticate (default credentials often admin:admin).
3. Intercept the time/date configuration request.
4. Inject command: 2024-01-01; id > /tmp/out.txt
5. Retrieve output via another vulnerable endpoint or log file.

Example Payload:

curl -k -X POST "https://<target>/set_time" \
  -d "datetime=2024-01-01;$(id)" \
  -u admin:admin

Blue Team

Detection:

• Monitor for unusual HTTP POST requests to /set_time or similar endpoints.
• Look for shell metacharacters (;, |, &, `) in datetime parameters.
• Alert on unexpected process execution (e.g., id, whoami, nc) from the device.

Hunting:

• Search logs for date -s commands with suspicious arguments.
• Correlate with authentication logs for anomalous admin sessions.

Indicators of Compromise (IOCs)

• Network: HTTP requests containing ;, |, && in datetime fields.
• Host: Unexpected processes like bash, sh, nc, python spawned by the firmware.
• File: Creation of files in /tmp/ or /var/ with attacker-controlled content.
• Logs: Syslog entries showing date -s with non-standard arguments.

Detection Engineering

YARA Rule

rule CVE_2024_44577_CommandInjection {
    meta:
        description = "Detects command injection attempts in RELY-PCIe time_date function"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-44577"
    strings:
        $cmd1 = /date -s '.*[;&|`$].*/'
        $cmd2 = /set_time.*[;&|`$].*/
        $cmd3 = /datetime=.*[;&|`$].*/
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-44577 Command Injection in RELY-PCIe
id: 8a3f7c2e-1b4d-4f6a-9c8e-0d1e2f3a4b5c
status: experimental
description: Detects command injection attempts via time_date function
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - 'datetime='
            - 'set_time'
        cs-uri-query|re: '.*[;&|`$].*'
    condition: selection
falsepositives:
    - Legitimate use of special characters in datetime (unlikely)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-44577 RELY-PCIe Command Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"datetime="; http_client_body;
    pcre:"/[;&|`$]/";
    sid:1000001;
    rev:1;
    reference:cve,2024-44577;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate RELY-PCIe devices on a dedicated management VLAN with strict firewall rules.
2. Disable the time/date configuration interface if not required.
3. Implement network-based detection using the provided Suricata/Sigma rules.

Long-Term Fix:

• Vendor must release a patched firmware version that sanitizes input and avoids system() calls.
• Until then, apply virtual patching via WAF rules blocking shell metacharacters in datetime fields.

Workaround:

• Use a centralized NTP server and disable manual time configuration on the device.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert