CVE-2023-24048
📋 TL;DR
This CSRF vulnerability in Connectize AC21000 G6 routers allows attackers to change the administrator password via a crafted GET request to /man_password.htm. Attackers can gain full control of the router by tricking authenticated administrators into visiting malicious web pages. All users of affected router versions are vulnerable.
💻 Affected Systems
- Connectize AC21000 G6 Dual-Band Gigabit WiFi Router
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router takeover allowing attacker to reconfigure network settings, intercept traffic, install malware, or use router as attack platform.
Likely Case
Router compromise leading to network eavesdropping, DNS hijacking, or credential theft from connected devices.
If Mitigated
Limited impact if CSRF protections are implemented or if router is not internet-facing with strict access controls.
🎯 Exploit Status
Exploitation requires tricking an authenticated administrator to click a malicious link; technical details are publicly available in NCC Group advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
Check Connectize website for firmware updates; if available, download and install via router admin interface.
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to router admin interface
Access router admin panel → Advanced Settings → Remote Management → Disable
Use Strong Authentication
allImplement additional authentication layers
Configure router to require re-authentication for sensitive actions
🧯 If You Can't Patch
- Isolate router management interface to trusted network segments only
- Implement network segmentation to limit router access to authorized administrators
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface; if version is 641.139.1.1256, device is vulnerable.Check Version:
Login to router admin interface and check System Status or Firmware Information pageVerify Fix Applied:
Verify firmware version has been updated to a version later than 641.139.1.1256.📡 Detection & Monitoring
Log Indicators:
- Unusual GET requests to /man_password.htm from unexpected sources
- Multiple failed password change attempts
Network Indicators:
- HTTP requests to router IP with /man_password.htm parameter manipulation
- Suspicious redirects to router management pages
SIEM Query:
source_ip=router_ip AND uri_path="/man_password.htm" AND http_method="GET"🔗 References
- https://research.nccgroup.com/2023/10/19/technical-advisory-multiple-vulnerabilities-in-connectize-g6-ac2100-dual-band-gigabit-wifi-router-cve-2023-24046-cve-2023-24047-cve-2023-24048-cve-2023-24049-cve-2023-24050-cve-2023-24051-cve/
- https://research.nccgroup.com/2023/10/19/technical-advisory-multiple-vulnerabilities-in-connectize-g6-ac2100-dual-band-gigabit-wifi-router-cve-2023-24046-cve-2023-24047-cve-2023-24048-cve-2023-24049-cve-2023-24050-cve-2023-24051-cve/
