CVE-2023-29711
📋 TL;DR
This vulnerability allows unauthenticated attackers to execute arbitrary code on Interlink PSG-5124 switches via crafted GET requests due to improper access control. It affects all systems running version 1.0.4 of this network switch firmware. Attackers can gain complete control of affected devices remotely.
💻 Affected Systems
- Interlink PSG-5124
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of network infrastructure, lateral movement to other systems, data exfiltration, and persistent backdoor installation.
Likely Case
Remote code execution leading to device takeover, network disruption, and potential credential harvesting.
If Mitigated
Limited impact if network segmentation isolates switches and strict firewall rules prevent external access.
🎯 Exploit Status
Public proof-of-concept code exists and exploitation requires only HTTP GET requests.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Contact Interlink for firmware updates or replacement options.
🔧 Temporary Workarounds
Network Segmentation
allIsolate PSG-5124 switches from untrusted networks and restrict access to management interfaces.
Firewall Rules
allBlock all external HTTP/HTTPS access to switch management interfaces.
🧯 If You Can't Patch
- Replace affected switches with updated models or different vendors
- Implement strict network access controls and monitor for exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface or CLI. If version is 1.0.4, device is vulnerable.Check Version:
Check web interface or use vendor-specific CLI commands (varies by device)Verify Fix Applied:
Verify firmware has been updated to a version later than 1.0.4.📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP GET requests to switch management interface
- Unexpected process execution or configuration changes
Network Indicators:
- HTTP requests with suspicious parameters to switch IPs
- Outbound connections from switches to unexpected destinations
SIEM Query:
source_ip="switch_ip" AND http_method="GET" AND (uri CONTAINS "cmd" OR uri CONTAINS "exec" OR uri CONTAINS "system")🔗 References
- https://github.com/shellpei/LINK-Unauthorized/blob/main/CVE-2023-29711
- https://holistic-height-e6d.notion.site/LINK-PSG-5124-Switch-remote-command-vulnerability-da4fd8fb450d42879b07ef3a953a2366
- https://github.com/shellpei/LINK-Unauthorized/blob/main/CVE-2023-29711
- https://holistic-height-e6d.notion.site/LINK-PSG-5124-Switch-remote-command-vulnerability-da4fd8fb450d42879b07ef3a953a2366
