CVE-2024-37664
📋 TL;DR
This vulnerability allows attackers on the same wireless network to disrupt or hijack TCP connections by sending forged TCP RST packets to the Redmi router. The router improperly handles these packets, causing it to remove NAT mappings and disconnect victim connections. Only users of the affected Redmi router model on the same WLAN are vulnerable.
💻 Affected Systems
- Redmi router RB03
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers can persistently disconnect victims from all internet services or hijack active sessions to steal credentials, intercept sensitive data, or redirect to malicious sites.
Likely Case
Intermittent connection drops for victims, causing service disruption and potential session timeouts for online services.
If Mitigated
With proper network segmentation and monitoring, impact is limited to temporary connection resets that can be quickly detected and mitigated.
🎯 Exploit Status
Exploit requires attacker to be on same wireless network. Simple packet crafting tools can be used.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Xiaomi/Redmi security advisories for firmware updates. 2. If update available, download from official sources. 3. Apply firmware update through router admin interface. 4. Reboot router after update.
🔧 Temporary Workarounds
Enable MAC address filtering
allRestrict WLAN access to known devices only to prevent unauthorized attackers from joining the network.
Use WPA3 encryption
allUpgrade wireless encryption to WPA3 if supported to make network access more difficult for attackers.
🧯 If You Can't Patch
- Replace router with different model that doesn't have this vulnerability
- Segment critical devices onto separate VLANs or physical networks
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface. If version is v1.0.57, device is vulnerable.Check Version:
Login to router admin interface (typically 192.168.31.1) and check System Status or About page.Verify Fix Applied:
Verify firmware version has been updated to a version later than v1.0.57.📡 Detection & Monitoring
Log Indicators:
- Unusual TCP RST packets from internal IPs
- Multiple connection resets for same client
Network Indicators:
- Spike in TCP RST packets from single source
- Abnormal connection termination patterns
SIEM Query:
source.ip IN internal_range AND tcp.flags.reset = 1 | stats count by source.ip dest.ip | where count > threshold