CVE-2024-52033

Executive Summary

CVE-2024-52033 is a medium-severity information disclosure vulnerability affecting the Rakuten Turbo 5G router firmware version V1.3.18 and earlier. The flaw allows a remote unauthenticated attacker to obtain sensitive system information about other devices connected through the Wi-Fi network. This exposure of device information (such as MAC addresses, IP addresses, and hostnames) can be leveraged for network reconnaissance and subsequent targeted attacks. The vulnerability is classified under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere) and has a CVSS v3.1 base score of 5.3. No public proof-of-concept exploit or patch is currently available, but the risk is elevated due to the lack of authentication required for exploitation.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N) – Exploitable remotely over the network.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited information disclosure.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: None (A:N) – No service disruption.

Threat Level: Medium. The vulnerability is easy to exploit remotely without authentication, but the impact is limited to information disclosure. However, the leaked data can facilitate further attacks.

Deep Dive & Mechanics

The vulnerability resides in the web management interface of the Rakuten Turbo 5G router. The device exposes an API endpoint or web page that lists connected Wi-Fi clients without requiring authentication. This endpoint returns sensitive information such as MAC addresses, IP addresses, device names, and connection status for all devices currently connected to the router’s Wi-Fi network.

Root Cause: The router fails to enforce authentication or authorization checks on the endpoint that provides the list of connected devices. This oversight allows any unauthenticated remote attacker to query the endpoint and retrieve the data.

Attack Scenario: An attacker on the same network (or able to reach the router’s management interface from the internet if exposed) sends a simple HTTP GET request to the vulnerable endpoint. The router responds with a JSON or HTML list of connected devices. The attacker can then use this information to identify targets for further exploitation, such as vulnerable IoT devices or personal computers.

Affected Component: The web server running on the router (likely a lightweight HTTP server) serves the device list without proper access controls.

Vulnerable vs. Patched Code

No official patch has been released. The vulnerable code is presumed to be in the router’s web management interface. A patched version would require authentication before serving the device list.

Vulnerable Code (Conceptual):

# Example of vulnerable endpoint in router firmware
@app.route('/api/connected_devices')
def get_connected_devices():
    # No authentication check
    devices = get_wifi_clients()
    return jsonify(devices)

Patched Code (Conceptual):

# Example of patched endpoint requiring authentication
@app.route('/api/connected_devices')
@login_required
def get_connected_devices():
    devices = get_wifi_clients()
    return jsonify(devices)

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

1. Obtain a Rakuten Turbo 5G router with firmware V1.3.18 or earlier.
2. Connect the router to a network and ensure its web interface is accessible (default IP often 192.168.1.1).
3. Connect multiple Wi-Fi clients (e.g., smartphones, laptops) to the router.

Exploitation Steps:

1. Identify the vulnerable endpoint. Based on common router interfaces, it may be at /api/connected_devices, /wifi_clients, or /status.
2. Send an unauthenticated HTTP GET request to the endpoint:

   curl http://192.168.1.1/api/connected_devices
   

3. The response will contain a list of connected devices with details like MAC addresses, IP addresses, and hostnames.
4. Use this information for further reconnaissance or targeted attacks.

Example Output:

[
  {"mac": "AA:BB:CC:DD:EE:FF", "ip": "192.168.1.100", "hostname": "Johns-iPhone"},
  {"mac": "11:22:33:44:55:66", "ip": "192.168.1.101", "hostname": "Office-PC"}
]

Blue Team (Detection & Defense)

Detection:

• Monitor for unauthenticated requests to router management endpoints, especially those returning lists of connected devices.
• Look for anomalous HTTP GET requests to paths like /api/connected_devices, /wifi_clients, or /status from unknown IPs.
• Use network monitoring tools to detect scanning activity targeting the router’s web interface.

Defense:

• Restrict access to the router’s management interface to trusted IPs only (e.g., via firewall rules).
• Disable remote management if not required.
• Apply vendor patches when available.
• Use strong, unique passwords for router administration.
• Enable logging and alerting on the router for unauthorized access attempts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /api/connected_devices, /wifi_clients, or /status without authentication.
  • Source IPs scanning for Rakuten Turbo 5G routers (e.g., Shodan dorks).
• File IOCs:
  • Log entries showing repeated failed authentication attempts followed by successful data retrieval.
• Behavioral IOCs:
  • Unusual outbound connections from the router to unknown IPs after data exfiltration.

Detection Engineering

YARA Rule

rule CVE_2024_52033_Rakuten_Turbo_5G_Info_Disclosure {
    meta:
        description = "Detects HTTP responses containing connected device info from Rakuten Turbo 5G router"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-52033"
    strings:
        $json_mac = /"mac"\s*:\s*"[A-Fa-f0-9:]{17}"/ nocase
        $json_ip = /"ip"\s*:\s*"\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}"/ nocase
        $json_hostname = /"hostname"\s*:\s*"[^"]+"/ nocase
        $endpoint1 = "/api/connected_devices" ascii
        $endpoint2 = "/wifi_clients" ascii
        $endpoint3 = "/status" ascii
    condition:
        any of ($json_mac, $json_ip, $json_hostname) and any of ($endpoint1, $endpoint2, $endpoint3)
}

Sigma Rule

title: CVE-2024-52033 - Rakuten Turbo 5G Unauthenticated Device Info Disclosure
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthenticated HTTP requests to Rakuten Turbo 5G router endpoints that expose connected device information.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-52033
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem:
            - '/api/connected_devices'
            - '/wifi_clients'
            - '/status'
    condition: selection
falsepositives:
    - Legitimate administrative access from trusted IPs
level: medium
tags:
    - attack.t1046
    - cve.2024.52033

Suricata Rule

alert http any any -> $HOME_NET any (msg:"CVE-2024-52033 - Rakuten Turbo 5G Unauthenticated Device Info Disclosure"; flow:to_server,established; content:"GET"; http_method; content:"/api/connected_devices"; http_uri; nocase; content:"/wifi_clients"; http_uri; nocase; content:"/status"; http_uri; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Mitigation:

• Restrict access to the router’s web interface to trusted IPs only using firewall rules.
• Disable remote management if not required.
• Change default administrator credentials.
• Monitor logs for unauthorized access attempts.

Long-Term Remediation:

• Apply vendor firmware updates when available.
• Implement network segmentation to isolate IoT devices.
• Use VPN for remote management.
• Consider replacing the router with a more secure model if no patch is released.

Vendor Contact: Rakuten has not yet released a patch. Users should monitor Rakuten’s support page for updates.

Valters IT