CVE-2024-47865

Executive Summary

CVE-2024-47865 is a critical missing authentication vulnerability in Rakuten Turbo 5G firmware versions V1.3.18 and earlier. This flaw allows a remote unauthenticated attacker to update or downgrade the firmware on the device, potentially enabling persistent compromise, backdoor installation, or bricking of the device. The vulnerability has a CVSS score of 5.3 (Medium) due to its high impact on integrity but no direct impact on confidentiality or availability. No public proof-of-concept or exploit code is currently available, and the patch status remains unknown.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – impact confined to the device.
• Confidentiality Impact: None (C:N) – no data exposure.
• Integrity Impact: High (I:H) – firmware can be modified.
• Availability Impact: None (A:N) – no direct denial of service.

Threat Level: Medium. While the CVSS score is moderate, the ability to remotely and unauthenticatedly alter firmware poses a severe risk to device integrity and network security.

Deep Dive & Mechanics

The vulnerability resides in the firmware update mechanism of the Rakuten Turbo 5G router. The device exposes an endpoint or service that accepts firmware update requests without requiring any authentication. An attacker can craft a malicious firmware image (e.g., containing a backdoor or downgrading to a vulnerable version) and send it to the device. The device processes the update without verifying the identity of the requester, leading to unauthorized firmware modification.

Attack Flow:

1. Attacker identifies a Rakuten Turbo 5G device on the network (e.g., via Shodan or local scanning).
2. Attacker crafts a malicious firmware image or obtains a legitimate older version.
3. Attacker sends a firmware update request to the device's update endpoint (e.g., HTTP POST to /firmware/update).
4. Device accepts the update without authentication, flashing the new firmware.
5. Device reboots with attacker-controlled firmware, granting persistent access.

Root Cause: Missing authentication check in the firmware update handler. The code likely lacks a token, password, or certificate verification before processing the update.

Vulnerable vs. Patched Code

Since no patch is available, we can only hypothesize the vulnerable code pattern.

Vulnerable Code (Conceptual):

# Vulnerable: No authentication check
@app.route('/firmware/update', methods=['POST'])
def firmware_update():
    firmware_data = request.files['firmware']
    # Directly flash firmware without verification
    flash_firmware(firmware_data)
    return "Update successful"

Patched Code (Conceptual):

# Patched: Authentication required
@app.route('/firmware/update', methods=['POST'])
def firmware_update():
    # Verify authentication token
    token = request.headers.get('Authorization')
    if not token or not verify_token(token):
        return "Unauthorized", 401
    firmware_data = request.files['firmware']
    # Verify firmware signature
    if not verify_signature(firmware_data):
        return "Invalid firmware", 400
    flash_firmware(firmware_data)
    return "Update successful"

Exploitation & Lab Setup

Red Team

Lab Setup:

• Target: Rakuten Turbo 5G device with firmware V1.3.18 (or earlier).
• Attacker machine: Kali Linux with network access to the device.
• Tools: curl, binwalk, firmware-mod-kit, metasploit (if module available).

Exploitation Steps:

1. Scan for device: Use Shodan or Nmap to find vulnerable devices.

   nmap -p 80,443,8080 --open <target_ip>
   

2. Identify firmware update endpoint: Use directory brute-forcing or manual inspection.

   gobuster dir -u http://<target_ip> -w /usr/share/wordlists/dirb/common.txt
   

3. Craft malicious firmware: Use binwalk to extract a legitimate firmware, modify it (e.g., add a backdoor), and repack.

   binwalk -e original_firmware.bin
   # Modify filesystem, e.g., add SSH server
   mkimage -A arm -O linux -T firmware -C none -a 0x8000 -e 0x8000 -n "Malicious" -d rootfs malicious_firmware.bin
   

4. Send malicious update:

   curl -X POST -F "firmware=@malicious_firmware.bin" http://<target_ip>/firmware/update
   

5. Verify compromise: Connect to backdoor (e.g., SSH on port 22).

Blue Team

Detection & Response:

• Monitor for unexpected firmware update requests (e.g., large POST requests to /firmware/update).
• Enable logging on the device (if possible) to capture update attempts.
• Use network segmentation to isolate IoT devices from critical assets.
• Implement firmware integrity checks (e.g., TPM or secure boot) if supported.

Hunting Queries:

• Search for devices with open ports 80/443 and known Rakuten Turbo 5G banners.
• Look for anomalous outbound connections from the device after an update.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /firmware/update or similar endpoints.
  • Large binary payloads in HTTP requests (firmware images).
  • Unusual outbound connections from the device (e.g., to attacker C2).
• Host:
  • Modified firmware version string (e.g., V1.3.18 changed to V1.3.18-MOD).
  • Presence of unexpected services (e.g., SSH, Telnet) on the device.
  • Changes to device configuration (e.g., DNS, admin credentials).
• File:
  • Firmware images with unexpected signatures or hashes.
  • New binaries in /usr/sbin or /etc/init.d.

Detection Engineering

YARA Rule

rule CVE_2024_47865_Rakuten_Firmware_Update {
    meta:
        description = "Detects malicious firmware images targeting Rakuten Turbo 5G"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-47865"
    strings:
        $s1 = "Rakuten Turbo 5G" ascii wide nocase
        $s2 = "firmware" ascii wide nocase
        $s3 = "update" ascii wide nocase
        $s4 = { 48 54 54 50 2F 31 2E 31 } // HTTP/1.1
    condition:
        uint32(0) == 0x464C457F // ELF magic
        and 2 of ($s1, $s2, $s3)
        or $s4
}

Sigma Rule

title: Rakuten Turbo 5G Unauthenticated Firmware Update Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests to firmware update endpoints without authentication
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/firmware/update'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate firmware updates from authorized sources
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2024-47865 Rakuten Turbo 5G Unauthenticated Firmware Update";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/firmware/update"; http_uri;
    content:"Content-Type|3a| multipart/form-data"; http_header;
    sid:1000001;
    rev:1;
    reference:cve,2024-47865;
    classtype:attempted-admin;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable remote firmware update if possible via device settings.
2. Restrict network access to the device (e.g., firewall rules blocking external access to management interfaces).
3. Monitor for firmware update attempts using the detection rules above.

Long-term Fix:

• Vendor must implement authentication (e.g., token, certificate) for firmware update endpoints.
• Apply firmware signature verification to ensure only signed updates are accepted.
• Release a patched firmware version (V1.3.19 or later) with these fixes.

Workarounds:

• Use a VPN or separate VLAN for IoT devices.
• Regularly check for firmware updates from the vendor.

Valters IT
Securing Digital Frontiers