CVE-2021-30230
📋 TL;DR
This CVE describes a command injection vulnerability in China Mobile An Lianbao WF-1 routers that allows remote attackers to execute arbitrary commands via shell metacharacters in the zonename parameter of the set_time_zone API interface. Attackers can gain full control of affected routers without authentication. This affects organizations and individuals using the vulnerable router model.
💻 Affected Systems
- China Mobile An Lianbao WF-1 router
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router compromise leading to network takeover, data exfiltration, lateral movement to internal networks, and persistent backdoor installation.
Likely Case
Router compromise allowing traffic interception, DNS hijacking, credential theft, and use as attack platform.
If Mitigated
Limited impact if network segmentation isolates router management interface and strict firewall rules prevent external access.
🎯 Exploit Status
Public proof-of-concept demonstrates simple command injection via HTTP POST requests to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: http://iot.10086.cn/?l=en-us
Restart Required: No
Instructions:
Check vendor website for firmware updates. If available, download latest firmware and apply through router web interface.
🔧 Temporary Workarounds
Block API Interface Access
linuxUse firewall rules to block external access to the router's management interface and API endpoints.
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
Disable Remote Management
allTurn off remote management features in router configuration if not required.
🧯 If You Can't Patch
- Segment router management interface to isolated VLAN with strict access controls
- Implement network monitoring for unusual API requests to /api/ZRFirmware/set_time_zone
🔍 How to Verify
Check if Vulnerable:
Test if HTTP POST requests to /api/ZRFirmware/set_time_zone with shell metacharacters in zonename parameter execute commands.Check Version:
Check router web interface or use nmap/curl to identify firmware versionVerify Fix Applied:
Verify that command injection attempts no longer succeed and that the interface validates/sanitizes input properly.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /api/ZRFirmware/set_time_zone
- Shell command execution in router logs
- Multiple failed authentication attempts
Network Indicators:
- HTTP requests containing shell metacharacters (;, |, &, $, etc.)
- Unexpected outbound connections from router
SIEM Query:
source="router_logs" AND (uri="/api/ZRFirmware/set_time_zone" OR command="*sh*" OR zonename="*;*" OR zonename="*|*")🔗 References
- http://iot.10086.cn/?l=en-us
- https://github.com/pokerfacett/MY_REQUEST/blob/master/China%20Mobile%20An%20Lianbao%20WF-1%20router%20Command%20Injection5.md
- https://www.cnvd.org.cn/flaw/show/CNVD-2021-03520
- http://iot.10086.cn/?l=en-us
- https://github.com/pokerfacett/MY_REQUEST/blob/master/China%20Mobile%20An%20Lianbao%20WF-1%20router%20Command%20Injection5.md
- https://www.cnvd.org.cn/flaw/show/CNVD-2021-03520
