CVE-2021-30234
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary commands on China Mobile An Lianbao WF-1 routers via command injection in the MLD_PROXY_WAN_CONNECT parameter. Attackers can gain full control of affected routers without authentication. Users of China Mobile An Lianbao WF-1 routers version 1.0.1 are affected.
💻 Affected Systems
- China Mobile An Lianbao WF-1 router
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router compromise allowing attackers to intercept all network traffic, install persistent malware, pivot to internal networks, and use the router as part of a botnet.
Likely Case
Router takeover leading to DNS hijacking, credential theft from network traffic, and use as a proxy for malicious activities.
If Mitigated
Limited impact if routers are behind firewalls with strict inbound filtering and network segmentation.
🎯 Exploit Status
Public proof-of-concept demonstrates simple HTTP POST requests with shell metacharacters. No authentication required makes exploitation trivial.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: http://iot.10086.cn/?l=en-us
Restart Required: No
Instructions:
Check vendor website for firmware updates. If no patch is available, implement workarounds immediately.
🔧 Temporary Workarounds
Block access to vulnerable interface
linuxUse firewall rules to block access to the /api/ZRIGMP/set_MLD_PROXY endpoint
iptables -A INPUT -p tcp --dport 80 -m string --string "/api/ZRIGMP/set_MLD_PROXY" --algo bm -j DROP
iptables -A INPUT -p tcp --dport 443 -m string --string "/api/ZRIGMP/set_MLD_PROXY" --algo bm -j DROP
Disable MLD proxy feature
allIf MLD proxy functionality is not required, disable it through router administration interface
🧯 If You Can't Patch
- Place routers behind firewalls with strict inbound filtering and disable WAN administration
- Implement network segmentation to isolate routers from critical internal resources
🔍 How to Verify
Check if Vulnerable:
Send a test request to http://[router-ip]/api/ZRIGMP/set_MLD_PROXY with MLD_PROXY_WAN_CONNECT parameter containing shell metacharacters and observe responseCheck Version:
Check router web interface or use nmap/curl to identify firmware versionVerify Fix Applied:
Test the same exploit attempt after implementing workarounds to confirm it's blocked📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /api/ZRIGMP/set_MLD_PROXY containing shell metacharacters like ;, |, &, $, or backticks
- Unusual process execution from web server context
Network Indicators:
- HTTP requests to router administration interface from unexpected sources
- Outbound connections from router to suspicious IPs
SIEM Query:
source="router-logs" AND uri="/api/ZRIGMP/set_MLD_PROXY" AND (request_body="*;*" OR request_body="*|*" OR request_body="*&*" OR request_body="*`*")🔗 References
- http://iot.10086.cn/?l=en-us
- https://github.com/pokerfacett/MY_REQUEST/blob/master/China%20Mobile%20An%20Lianbao%20WF-1%20router%20Command%20Injection7.md
- https://www.cnvd.org.cn/flaw/show/CNVD-2021-03520
- http://iot.10086.cn/?l=en-us
- https://github.com/pokerfacett/MY_REQUEST/blob/master/China%20Mobile%20An%20Lianbao%20WF-1%20router%20Command%20Injection7.md
- https://www.cnvd.org.cn/flaw/show/CNVD-2021-03520
