CVE-2021-36705
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary commands on ProLink PRC2402M routers by injecting malicious commands into the TR069_local_port parameter. Attackers can gain full control of affected devices, potentially compromising network security. All users running firmware V1.0.18 or older are affected.
💻 Affected Systems
- ProLink PRC2402M
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover leading to network compromise, data exfiltration, lateral movement to other systems, and persistent backdoor installation.
Likely Case
Router compromise allowing traffic interception, DNS manipulation, credential theft, and use as attack platform.
If Mitigated
Limited impact if device is behind firewall with restricted access to adm.cgi endpoint.
🎯 Exploit Status
Simple curl command injection demonstrated in public disclosure; trivial to weaponize.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Consider replacing device or implementing strict network controls.
🔧 Temporary Workarounds
Network Segmentation
allIsolate affected routers in separate VLAN with strict firewall rules blocking access to adm.cgi endpoint.
Access Restriction
linuxConfigure firewall to block external access to router web interface (port 80/443).
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Replace affected devices with supported models from different vendors
- Implement strict network monitoring and anomaly detection for router traffic
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface at http://router-ip/status.cgi or via SSH if available.Check Version:
curl -s http://router-ip/status.cgi | grep FirmwareVerify Fix Applied:
No fix available; verify device replacement or workaround implementation.📡 Detection & Monitoring
Log Indicators:
- Unusual commands in system logs
- Multiple failed login attempts to adm.cgi
- Suspicious process execution
Network Indicators:
- Unexpected outbound connections from router
- Traffic to unusual ports
- DNS queries to malicious domains
SIEM Query:
source="router-logs" AND (uri="/cgi-bin/adm.cgi" AND params="TR069_local_port=*")