CVE-2024-50628

Executive Summary

CVE-2024-50628 is a critical security advisory affecting Digi ConnectPort LTS devices running firmware versions prior to 1.4.12. The vulnerability resides in the web services component and allows an attacker on the local area network (LAN) to achieve unauthorized manipulation of resources. While the CVSS score is currently unassigned (0.0), the advisory indicates that this issue can lead to remote code execution (RCE) when combined with other vulnerabilities. The attack vector is limited to the local network, reducing the immediate exposure but still posing a significant risk to internal network security. No public proof-of-concept (PoC) or exploit code has been released at this time.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unassigned)
• Attack Vector (AV): Adjacent Network (LAN)
• Attack Complexity (AC): Low (likely)
• Privileges Required (PR): None (likely)
• User Interaction (UI): None (likely)
• Scope (S): Unchanged (likely)
• Confidentiality (C): High (likely, due to potential RCE)
• Integrity (I): High (likely)
• Availability (A): High (likely)

Threat Level: High (based on potential for RCE and lack of authentication requirements)

Deep Dive & Mechanics

The vulnerability is located in the web services interface of the Digi ConnectPort LTS device. The web services likely handle configuration, monitoring, and management functions. The issue allows an attacker on the same LAN to manipulate resources without proper authorization. This could be due to insufficient access controls, missing authentication checks, or improper input validation in the web service endpoints.

The attack flow is as follows:

1. An attacker gains access to the local network (e.g., via Wi-Fi, physical connection, or compromised device).
2. The attacker sends crafted HTTP requests to the Digi ConnectPort LTS web service.
3. The web service processes the request without proper authorization, allowing the attacker to modify device settings, upload malicious files, or trigger other actions.
4. When combined with other vulnerabilities (e.g., command injection, path traversal), this unauthorized manipulation can lead to remote code execution.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-1.4.12): The web service endpoints likely lack proper authentication or authorization checks. For example, a configuration endpoint might accept POST requests without verifying the user's identity.

# Vulnerable example (pseudo-code)
@app.route('/api/config/update', methods=['POST'])
def update_config():
    data = request.json
    # No authentication check
    apply_config(data)
    return "Config updated"

Patched Code (1.4.12+): The patched version introduces authentication and authorization checks for all web service endpoints.

# Patched example (pseudo-code)
@app.route('/api/config/update', methods=['POST'])
@require_auth
def update_config():
    data = request.json
    if not is_authorized(current_user, 'config:write'):
        return "Unauthorized", 403
    apply_config(data)
    return "Config updated"

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Obtain a Digi ConnectPort LTS device with firmware version < 1.4.12.
2. Connect the device to a local network.
3. Set up a Kali Linux machine on the same network.

Exploitation Steps:

1. Scan the network to discover the device: nmap -sn 192.168.1.0/24
2. Identify the web service port (typically 80 or 443): nmap -p 80,443 <device_ip>
3. Enumerate web service endpoints: gobuster dir -u http://<device_ip> -w /usr/share/wordlists/dirb/common.txt
4. Attempt unauthorized manipulation by sending crafted requests:

   curl -X POST http://<device_ip>/api/config/update -d '{"setting": "malicious_value"}'
   

5. If successful, combine with other vulnerabilities (e.g., command injection) to achieve RCE.

Note: No public exploit code is available. The above steps are for educational purposes only.

Blue Team

Detection Steps:

1. Monitor network traffic for unusual HTTP requests to Digi ConnectPort LTS devices.
2. Look for requests to sensitive endpoints (e.g., /api/config/update, /api/upload) without prior authentication.
3. Check device logs for unauthorized configuration changes.
4. Use the detection rules provided in the Detection Engineering section.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Unusual HTTP POST requests to /api/config/update or similar endpoints.
  • Requests from unexpected IP addresses on the local network.
  • Large payloads in HTTP requests to the device.

• Host IOCs:

  • Modified configuration files on the device.
  • Presence of unexpected files in the device's filesystem.
  • Unusual processes or services running on the device.

• Log IOCs:

  • Log entries showing unauthorized access attempts.
  • Log entries with error codes related to authentication failures.

Detection Engineering

YARA Rule

rule CVE_2024_50628_Digi_ConnectPort_LTS {
    meta:
        description = "Detects attempts to exploit CVE-2024-50628 in Digi ConnectPort LTS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-50628"
    strings:
        $s1 = "/api/config/update" ascii wide nocase
        $s2 = "/api/upload" ascii wide nocase
        $s3 = "POST" ascii wide nocase
    condition:
        any of ($s1, $s2) and $s3
}

Sigma Rule

title: CVE-2024-50628 Digi ConnectPort LTS Unauthorized Resource Manipulation
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects unauthorized HTTP requests to Digi ConnectPort LTS web services
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-50628
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem:
            - '/api/config/update'
            - '/api/upload'
    condition: selection
falsepositives:
    - Legitimate administrative actions
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-50628 Digi ConnectPort LTS Unauthorized Resource Manipulation"; flow:to_server,established; content:"POST"; http_method; content:"/api/config/update"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade all Digi ConnectPort LTS devices to firmware version 1.4.12 or later.
2. If immediate upgrade is not possible, restrict network access to the device using firewall rules.
3. Disable unnecessary web services on the device.

Long-term Measures:

1. Implement network segmentation to isolate critical devices.
2. Enable logging and monitoring for all web service access.
3. Regularly review and update firmware for all network devices.
4. Conduct periodic security assessments of the network.

Workarounds:

• Use a VPN or dedicated management VLAN to access the device's web interface.
• Implement IP whitelisting for administrative access.

Valters IT
Securing Digital Frontiers