CVE-2023-33378
📋 TL;DR
Connected IO v2.1.0 and prior has an argument injection vulnerability in its AT command message handling, allowing attackers to execute arbitrary operating system commands on affected devices. This affects Connected IO routers and similar IoT devices running vulnerable firmware versions.
💻 Affected Systems
- Connected IO routers and IoT devices
📦 What is this software?
Connected Io by Connectedio
⚠️ Risk & Real-World Impact
Worst Case
Full device compromise leading to complete control over the device, data exfiltration, lateral movement within networks, and potential use as a botnet node.
Likely Case
Remote code execution allowing attackers to modify device configurations, intercept network traffic, or deploy malware.
If Mitigated
Limited impact if devices are behind firewalls with strict network segmentation and command filtering.
🎯 Exploit Status
The vulnerability is in the communication protocol itself, making exploitation straightforward once the protocol is understood.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v2.2.0 or later
Vendor Advisory: https://www.connectedio.com/products/routers
Restart Required: Yes
Instructions:
1. Check current firmware version. 2. Download v2.2.0 or later from Connected IO support portal. 3. Upload firmware to device via admin interface. 4. Apply update and restart device.
🔧 Temporary Workarounds
Network Segmentation
allIsolate Connected IO devices in separate VLANs with strict firewall rules limiting inbound/outbound traffic.
AT Command Filtering
allImplement network-level filtering or proxy to sanitize AT commands before reaching devices.
🧯 If You Can't Patch
- Segment devices on isolated networks with no internet access
- Implement strict firewall rules to allow only necessary communication to/from devices
🔍 How to Verify
Check if Vulnerable:
Check firmware version in device admin interface or via SSH if available. Versions v2.1.0 or earlier are vulnerable.Check Version:
ssh admin@device_ip 'cat /etc/version' or check web admin interfaceVerify Fix Applied:
Confirm firmware version is v2.2.0 or later in device admin interface.📡 Detection & Monitoring
Log Indicators:
- Unusual AT command patterns in device logs
- Unexpected process executions
- Configuration changes not initiated by administrators
Network Indicators:
- Unusual network traffic from Connected IO devices
- AT command messages with shell metacharacters or suspicious arguments
SIEM Query:
source="connected_io" AND (message="*AT*" OR message="*shell*" OR message="*exec*")