CVE-2023-29708
📋 TL;DR
This vulnerability allows attackers to force a factory reset on WavLink WavRouter devices via a crafted payload sent to the /cgi-bin/adm.cgi endpoint. Attackers can remotely restore devices to default settings, disrupting network connectivity and potentially enabling further attacks. This affects WavLink WavRouter RPT70HA1.x devices exposed to untrusted networks.
💻 Affected Systems
- WavLink WavRouter
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete network disruption, loss of configuration, potential credential exposure, and enabling of follow-on attacks after reset.
Likely Case
Network downtime, service disruption, and need for manual reconfiguration of affected devices.
If Mitigated
Limited to isolated lab environments or properly segmented networks with no internet exposure.
🎯 Exploit Status
Simple HTTP POST request to vulnerable endpoint. Proof-of-concept code available in GitHub repository.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Check WavLink website for firmware updates. If update exists, download and apply through web interface.
🔧 Temporary Workarounds
Disable web interface
allDisable the router's web management interface if not required for operations.
Network segmentation
allPlace affected routers in isolated network segments with strict access controls.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate affected devices from untrusted networks
- Deploy network-based intrusion detection to monitor for exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check device model and firmware version via web interface or SSH. If running RPT70HA1.x firmware, assume vulnerable.Check Version:
Check web interface status page or use SSH command if available: cat /proc/versionVerify Fix Applied:
No official fix available. Monitor for firmware updates from vendor.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /cgi-bin/adm.cgi with reset parameters
- Unexpected factory reset events in system logs
Network Indicators:
- HTTP traffic to router on port 80/443 containing reset payloads
- Sudden loss of connectivity from router
SIEM Query:
source="router_logs" AND (uri="/cgi-bin/adm.cgi" OR message="factory reset")🔗 References
- https://github.com/shellpei/WAVLINK-Reset/blob/main/CVE-2023-29708
- https://holistic-height-e6d.notion.site/WAVLINK-Wi-Fi-APP-Arbitrary-factory-reset-vulnerability-b2d747693a7442aaa8b045e57bbd8297
- https://github.com/shellpei/WAVLINK-Reset/blob/main/CVE-2023-29708
- https://holistic-height-e6d.notion.site/WAVLINK-Wi-Fi-APP-Arbitrary-factory-reset-vulnerability-b2d747693a7442aaa8b045e57bbd8297
