CVE-2024-48417
📋 TL;DR
This vulnerability allows attackers to inject malicious scripts into the Edimax AC1200 router's web interface via specific form endpoints. When exploited, it enables cross-site scripting attacks that could compromise router administration sessions. Users of Edimax BR-6476AC router version 1.06 are affected.
💻 Affected Systems
- Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker could steal administrator credentials, hijack router sessions, modify router settings, or redirect users to malicious sites, potentially leading to full network compromise.
Likely Case
Attackers could perform session hijacking, steal authentication cookies, or deface the router's web interface by injecting malicious scripts.
If Mitigated
With proper network segmentation and limited admin access, impact is reduced to the router's web interface only, preventing lateral movement.
🎯 Exploit Status
Exploitation requires authentication to router web interface. Proof-of-concept available in GitHub advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: http://edimax.com
Restart Required: No
Instructions:
Check Edimax website for firmware updates. If update available, download and install via router web interface under Administration > Firmware Upgrade.
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to router web interface
Use Strong Authentication
allImplement complex passwords and limit admin access
🧯 If You Can't Patch
- Segment router management interface to isolated VLAN
- Implement web application firewall with XSS filtering
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in web interface under Status > Device Info. If version is 1.06, system is vulnerable.Check Version:
No CLI command. Check via web interface at Status > Device Info.Verify Fix Applied:
Verify firmware version has been updated from 1.06 to a newer version.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/setStaticRoute, /goform/fromSetFilterUrlFilter, or /goform/fromSetFilterClientFilter with script tags
Network Indicators:
- Malicious script injection in HTTP requests to router web interface
SIEM Query:
http.method:POST AND (http.uri:"/goform/setStaticRoute" OR http.uri:"/goform/fromSetFilterUrlFilter" OR http.uri:"/goform/fromSetFilterClientFilter") AND http.request_body:"<script>"