CVE-2024-51187
📋 TL;DR
This CVE describes a stored cross-site scripting (XSS) vulnerability in specific TRENDnet router models. Attackers can inject malicious scripts into the firewall rule name parameter, which then executes when administrators view the firewall settings page. This affects administrators of TRENDnet TEW-651BR, TEW-652BRP, and TEW-652BRU devices.
💻 Affected Systems
- TRENDnet TEW-651BR
- TRENDnet TEW-652BRP
- TRENDnet TEW-652BRU
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker could steal administrator session cookies, hijack the admin session, reconfigure the router, or redirect to malicious sites, potentially gaining full control of the network device.
Likely Case
Session hijacking of the router admin interface, allowing attacker to modify network settings, change DNS, or install malicious firmware.
If Mitigated
Limited to admin interface compromise if proper network segmentation and admin authentication are in place.
🎯 Exploit Status
Exploit requires admin credentials to access firewall settings page. Public PoC available on GitHub.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found
Restart Required: No
Instructions:
Check TRENDnet website for firmware updates. No official patch identified at this time.
🔧 Temporary Workarounds
Input Validation on Admin Interface
allManually validate and sanitize all user inputs in firewall rule names
Not applicable - manual configuration required
Restrict Admin Access
allLimit admin interface access to specific IP addresses using firewall rules
Not applicable - configure via router admin interface
🧯 If You Can't Patch
- Replace affected devices with supported models
- Implement network segmentation to isolate router management interface
🔍 How to Verify
Check if Vulnerable:
Access router admin interface, navigate to /firewall_setting.htm, attempt to inject script in firewallRule_Name_1.1.1.0.0 parameterCheck Version:
Check firmware version in router admin interface under System Status or similar sectionVerify Fix Applied:
Test XSS payload injection after applying any firmware updates or workarounds📡 Detection & Monitoring
Log Indicators:
- Unusual admin login attempts
- Firewall rule modifications with suspicious names
Network Indicators:
- HTTP requests to /firewall_setting.htm with script tags in parameters
SIEM Query:
http.url:"/firewall_setting.htm" AND (http.param:"firewallRule_Name" AND http.param contains "<script>")