CVE-2024-44574
📋 TL;DR
RELY-PCIe versions v22.2.1 through v23.1.0 contain a command injection vulnerability in the sys_conf function that allows attackers to execute arbitrary commands on affected systems. This affects organizations using RELY-PCIe hardware/software for industrial or embedded systems. Successful exploitation could lead to complete system compromise.
💻 Affected Systems
- RELY-PCIe
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing remote code execution, data theft, system destruction, or lateral movement to other network segments
Likely Case
Unauthorized command execution leading to service disruption, configuration changes, or data exfiltration
If Mitigated
Limited impact if proper network segmentation and least privilege controls are implemented
🎯 Exploit Status
Command injection vulnerabilities typically have low exploitation complexity once the attack vector is identified
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v23.1.1 or later
Vendor Advisory: https://www.relyum.com/web/support/vulnerability-report/
Restart Required: Yes
Instructions:
1. Download latest version from vendor website. 2. Backup current configuration. 3. Install updated version following vendor instructions. 4. Restart affected systems. 5. Verify patch installation.
🔧 Temporary Workarounds
Network Segmentation
allIsolate RELY-PCIe systems from untrusted networks and internet
Input Validation Rules
allImplement WAF or network filtering to block suspicious sys_conf requests
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach the sys_conf interface
- Monitor for unusual command execution patterns and sys_conf function calls
🔍 How to Verify
Check if Vulnerable:
Check RELY-PCIe version using vendor-provided version command or web interfaceCheck Version:
Check vendor documentation for specific version command (typically via CLI or web interface)Verify Fix Applied:
Verify version is v23.1.1 or later and test sys_conf function with safe inputs📡 Detection & Monitoring
Log Indicators:
- Unusual sys_conf function calls
- Suspicious command execution patterns
- Unexpected system process creation
Network Indicators:
- Unusual traffic to RELY-PCIe management interfaces
- Suspicious payloads in HTTP/API requests
SIEM Query:
Search for sys_conf function calls with unusual parameters or command injection patterns