CVE-2023-3991
📋 TL;DR
This CVE describes a critical OS command injection vulnerability in FreshTomato router firmware's iperfrun.cgi component. Attackers can execute arbitrary commands on affected routers by sending specially crafted HTTP requests. All systems running vulnerable versions of FreshTomato are affected.
💻 Affected Systems
- FreshTomato
📦 What is this software?
Freshtomato by Freshtomato
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to install persistent backdoors, steal credentials, pivot to internal networks, or brick the router.
Likely Case
Remote code execution leading to router takeover, network traffic interception, DNS hijacking, or botnet recruitment.
If Mitigated
Limited impact if network segmentation isolates routers and strict firewall rules prevent external access to management interfaces.
🎯 Exploit Status
Exploitation requires sending a crafted HTTP request to the vulnerable endpoint. No authentication is required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2023.4 or later
Vendor Advisory: https://github.com/freshtomato-arm/freshtomato-arm/issues
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Download FreshTomato 2023.4 or later from official repository. 3. Flash firmware using web interface or recovery mode. 4. Restore configuration if compatible.
🔧 Temporary Workarounds
Disable HTTP management interface
linuxTemporarily disable the web management interface to prevent exploitation
uci set uhttpd.main.listen_http=''
uci commit uhttpd
/etc/init.d/uhttpd restart
Restrict access with firewall
linuxBlock external access to router management ports (typically 80/443)
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Isolate affected routers in separate VLAN with strict firewall rules
- Implement network monitoring for suspicious HTTP requests to iperfrun.cgi endpoint
🔍 How to Verify
Check if Vulnerable:
Check FreshTomato version via web interface (Status -> Overview) or SSH command: 'nvram get os_version'Check Version:
nvram get os_versionVerify Fix Applied:
Verify version is 2023.4 or later and test iperfrun.cgi endpoint with safe test commands📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP POST requests to /iperfrun.cgi
- Suspicious command execution in system logs
- Multiple failed login attempts followed by iperfrun access
Network Indicators:
- HTTP requests containing shell metacharacters in parameters
- Unexpected outbound connections from router
- Traffic to known malicious IPs from router
SIEM Query:
source="router.log" AND (uri="/iperfrun.cgi" OR "iperfrun" IN uri) AND (method="POST" OR params CONTAINS "$" OR params CONTAINS "|" OR params CONTAINS ";")