CVE-2023-33722
📋 TL;DR
EDIMAX BR-6288ACL router firmware version 1.12 contains an authenticated remote code execution vulnerability in the pppUserName parameter. Attackers with valid credentials can execute arbitrary commands on the device. This affects all users running the vulnerable firmware version.
💻 Affected Systems
- EDIMAX BR-6288ACL
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to install persistent backdoors, intercept network traffic, pivot to internal networks, or brick the device.
Likely Case
Attackers with stolen or default credentials gain full control of the router to monitor traffic, redirect DNS, or use as a foothold for further attacks.
If Mitigated
Limited to authenticated users only, with proper credential management reducing attack surface significantly.
🎯 Exploit Status
Exploit details are publicly documented. Requires authentication but exploit is straightforward once credentials are obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No official vendor advisory found
Restart Required: Yes
Instructions:
1. Check EDIMAX website for firmware updates
2. Download latest firmware
3. Access router web interface
4. Navigate to firmware update section
5. Upload and apply new firmware
6. Reboot router
🔧 Temporary Workarounds
Change Default Credentials
allChange all default passwords to strong, unique credentials
Restrict Web Interface Access
allLimit web interface access to trusted IP addresses only
🧯 If You Can't Patch
- Isolate vulnerable routers in separate network segments
- Implement strict network monitoring for suspicious router traffic
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in web interface under System Status or Firmware Update sectionCheck Version:
Check via web interface or attempt to access version endpoint if availableVerify Fix Applied:
Verify firmware version is no longer v1.12 after update📡 Detection & Monitoring
Log Indicators:
- Unusual authentication attempts to router web interface
- Multiple failed login attempts followed by successful login
Network Indicators:
- Unusual outbound connections from router
- DNS or traffic redirection changes
SIEM Query:
source="router_logs" AND (event="authentication" AND result="success") AND user!="admin" OR source="router_logs" AND event="configuration_change"🔗 References
- https://docs.google.com/document/d/1KNuU0nVd4oHMZiKgfs45wK2yA4N6K7q4/edit?usp=sharing&ouid=108638774561085298954&rtpof=true&sd=true
- https://shimo.im/docs/pmkxQ1GQ4DTowANr
- https://docs.google.com/document/d/1KNuU0nVd4oHMZiKgfs45wK2yA4N6K7q4/edit?usp=sharing&ouid=108638774561085298954&rtpof=true&sd=true
- https://shimo.im/docs/pmkxQ1GQ4DTowANr
