CVE-2021-36707
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary commands on ProLink PRC2402M routers by injecting malicious commands into the led_cmd parameter. Attackers can gain full system control without authentication. All users running affected firmware versions are vulnerable.
💻 Affected Systems
- ProLink PRC2402M router
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to install persistent backdoors, pivot to internal networks, steal credentials, or use the device for botnet activities.
Likely Case
Remote code execution leading to device takeover, network reconnaissance, and potential lateral movement within the network.
If Mitigated
Limited impact if device is behind strict firewall rules with no external access, though internal threats remain.
🎯 Exploit Status
Simple command injection with publicly available proof-of-concept. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Check vendor website for firmware updates beyond V1.0.18.
🔧 Temporary Workarounds
Network Isolation
linuxPlace affected routers behind strict firewall rules to block external access to web interface
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
Access Restriction
linuxRestrict web interface access to trusted IP addresses only
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Replace affected devices with supported models from vendors with active security updates
- Implement network segmentation to isolate vulnerable routers from critical systems
🔍 How to Verify
Check if Vulnerable:
Access http://[router-ip]/adm.cgi?page=ledonoff&led_cmd=;id and check if command output appearsCheck Version:
Check web interface login page or system information page for firmware versionVerify Fix Applied:
Test the same payload after applying workarounds - should receive error or no command execution📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /adm.cgi with page=ledonoff
- Commands containing semicolons or pipes in led_cmd parameter
- Multiple failed login attempts followed by ledonoff access
Network Indicators:
- HTTP requests with suspicious parameters like ;id, ;ls, or ;cat
- Outbound connections from router to unknown IPs
SIEM Query:
source="router_logs" AND uri="/adm.cgi" AND (query="*page=ledonoff*" OR query="*led_cmd=*;*")