CVE-2021-30228
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary commands on China Mobile An Lianbao WF-1 routers via command injection in the iandlink_proc_enable parameter of the api/ZRAndlink/set_ZRAndlink interface. Attackers can gain full control of affected routers, potentially compromising network traffic and connected devices. All users of the affected router model with vulnerable firmware are at risk.
💻 Affected Systems
- China Mobile An Lianbao WF-1 router
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router compromise allowing attackers to intercept all network traffic, install persistent malware, pivot to internal networks, and use the router as a botnet node.
Likely Case
Router takeover leading to DNS hijacking, credential theft from network traffic, and installation of cryptocurrency miners or other malware.
If Mitigated
Limited impact if routers are behind firewalls with strict inbound filtering and network segmentation.
🎯 Exploit Status
Public proof-of-concept exists on GitHub showing command injection via shell metacharacters. The CVSS 9.8 score suggests trivial exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: http://iot.10086.cn/?l=en-us
Restart Required: No
Instructions:
Check vendor website for firmware updates. If unavailable, consider replacing the router with a secure alternative.
🔧 Temporary Workarounds
Disable vulnerable interface via firewall
linuxBlock access to the api/ZRAndlink/set_ZRAndlink endpoint using router firewall rules
iptables -A INPUT -p tcp --dport 80 -m string --string "api/ZRAndlink/set_ZRAndlink" --algo bm -j DROP
iptables -A INPUT -p tcp --dport 443 -m string --string "api/ZRAndlink/set_ZRAndlink" --algo bm -j DROP
External firewall blocking
allUse external firewall to block all inbound access to router web interface
Block TCP ports 80, 443, 8080, 8443 to router WAN IP
🧯 If You Can't Patch
- Replace router with a secure alternative from a vendor with better security practices
- Place router behind a dedicated firewall that blocks all inbound internet access to router management interfaces
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via web interface at http://[router-ip]/ or using command: curl -s http://[router-ip]/api/ZRAndlink/set_ZRAndlinkCheck Version:
Login to router web interface and check firmware version in settings, or check response headers from web interfaceVerify Fix Applied:
Test if command injection is possible by attempting exploitation with safe payloads (e.g., '; echo test;')📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /api/ZRAndlink/set_ZRAndlink
- Commands with shell metacharacters in iandlink_proc_enable parameter
- Unexpected process execution from web interface
Network Indicators:
- HTTP requests containing shell metacharacters like ;, |, &, $, (, ) in parameters
- Outbound connections from router to suspicious IPs
SIEM Query:
source="router_logs" AND (uri="/api/ZRAndlink/set_ZRAndlink" AND (param="iandlink_proc_enable" AND value MATCH "[;|&$()]"))🔗 References
- http://iot.10086.cn/?l=en-us
- https://github.com/pokerfacett/MY_REQUEST/blob/master/China%20Mobile%20An%20Lianbao%20WF-1%20router%20Command%20Injection2.md
- https://www.cnvd.org.cn/flaw/show/CNVD-2021-03520
- http://iot.10086.cn/?l=en-us
- https://github.com/pokerfacett/MY_REQUEST/blob/master/China%20Mobile%20An%20Lianbao%20WF-1%20router%20Command%20Injection2.md
- https://www.cnvd.org.cn/flaw/show/CNVD-2021-03520
