CVE-2021-30232
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary commands on China Mobile An Lianbao WF-1 routers via command injection in the IGMP_PROXY_WAN_CONNECT parameter. Attackers can gain full control of affected routers without authentication. All users of the vulnerable router version are affected.
💻 Affected Systems
- China Mobile An Lianbao WF-1 router
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router compromise allowing attackers to intercept all network traffic, install persistent malware, pivot to internal networks, and use the router as part of botnets.
Likely Case
Router takeover leading to DNS hijacking, credential theft, network surveillance, and participation in DDoS attacks.
If Mitigated
Limited impact if routers are behind firewalls with strict inbound filtering, though internal attacks remain possible.
🎯 Exploit Status
The exploit requires sending a crafted HTTP POST request to the vulnerable endpoint with shell metacharacters in the IGMP_PROXY_WAN_CONNECT parameter.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: http://iot.10086.cn/?l=en-us
Restart Required: No
Instructions:
Check vendor website for firmware updates. If available, download latest firmware and apply through router web interface under System Tools > Firmware Upgrade.
🔧 Temporary Workarounds
Disable remote management
allDisable WAN access to router management interface
Network segmentation
allPlace routers in isolated network segments with strict firewall rules
🧯 If You Can't Patch
- Replace vulnerable routers with supported models
- Implement strict network access controls to limit exposure
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in web interface. If version is 1.0.1, the device is vulnerable.Check Version:
curl -s http://router-ip/ | grep -i firmwareVerify Fix Applied:
Verify firmware version has been updated to a version later than 1.0.1📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /api/ZRIGMP/set_IGMP_PROXY
- Shell command execution in router logs
- Unexpected process creation
Network Indicators:
- HTTP POST requests to router IP on port 80/443 with shell metacharacters in parameters
- Outbound connections from router to suspicious IPs
SIEM Query:
source="router_logs" AND (uri="/api/ZRIGMP/set_IGMP_PROXY" OR command="*sh*" OR process="*/bin/*")🔗 References
- http://iot.10086.cn/?l=en-us
- https://github.com/pokerfacett/MY_REQUEST/blob/master/China%20Mobile%20An%20Lianbao%20WF-1%20router%20Command%20Injection6.md
- https://www.cnvd.org.cn/flaw/show/CNVD-2021-03520
- http://iot.10086.cn/?l=en-us
- https://github.com/pokerfacett/MY_REQUEST/blob/master/China%20Mobile%20An%20Lianbao%20WF-1%20router%20Command%20Injection6.md
- https://www.cnvd.org.cn/flaw/show/CNVD-2021-03520
