CVE-2023-24135
📋 TL;DR
This CVE describes a command injection vulnerability in Jensen of Scandinavia Eagle 1200AC routers running firmware version V15.03.06.33_en. Attackers can execute arbitrary commands by manipulating the mac parameter in the formWriteFacMac function, potentially gaining full control of affected devices. Organizations using these specific router models with the vulnerable firmware are at risk.
💻 Affected Systems
- Jensen of Scandinavia Eagle 1200AC
📦 What is this software?
Eagle 1200ac Firmware by Jensenofscandinavia
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the router allowing attackers to pivot to internal networks, intercept traffic, deploy malware, or use the device as part of a botnet.
Likely Case
Router takeover leading to network disruption, credential theft, or deployment of cryptocurrency miners.
If Mitigated
Limited impact if network segmentation isolates the router and external access is restricted.
🎯 Exploit Status
The vulnerability appears to be exploitable without authentication based on the description and references showing proof-of-concept details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No vendor advisory found in provided references
Restart Required: Yes
Instructions:
1. Check vendor website for firmware updates. 2. Download latest firmware. 3. Backup current configuration. 4. Upload and install new firmware. 5. Restart router. 6. Restore configuration if needed.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict access to router management interface to trusted IP addresses only
Disable Unnecessary Services
allDisable any unnecessary management interfaces or services that might expose the vulnerable function
🧯 If You Can't Patch
- Isolate affected routers in a separate VLAN with strict firewall rules
- Implement network monitoring for unusual outbound connections from routers
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via web interface at System > Firmware or via SSH with 'cat /proc/version'Check Version:
ssh admin@router-ip 'cat /proc/version' or check web interfaceVerify Fix Applied:
Verify firmware version has been updated to a version later than V15.03.06.33_en📡 Detection & Monitoring
Log Indicators:
- Unusual command execution in system logs
- Multiple failed login attempts followed by successful access
- Unexpected process creation
Network Indicators:
- Unusual outbound connections from router
- Traffic to known malicious IPs
- Unexpected SSH or telnet connections
SIEM Query:
source="router-logs" AND ("formWriteFacMac" OR "mac parameter" OR suspicious_command_execution)