CVE-2024-54745
📋 TL;DR
This vulnerability allows attackers to log in as root on affected WAVLINK routers using a hardcoded password stored in /etc/shadow. Anyone using WAVLINK WN701AE routers with the vulnerable firmware version is affected, potentially giving attackers complete control over the device.
💻 Affected Systems
- WAVLINK WN701AE
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the router allowing attackers to intercept all network traffic, install persistent malware, pivot to internal networks, and use the device for botnet activities.
Likely Case
Attackers gain root access to the router, enabling them to modify DNS settings, intercept credentials, and potentially access connected devices on the local network.
If Mitigated
If the router is behind a firewall with strict inbound rules and not internet-facing, risk is reduced but still present from internal threats or compromised devices on the network.
🎯 Exploit Status
Exploitation requires SSH or web interface access, but the hardcoded password makes authentication trivial once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://docs.wavlink.xyz/Firmware_ch/fm-701e/
Restart Required: Yes
Instructions:
1. Check vendor website for firmware updates. 2. Download latest firmware. 3. Upload via web interface. 4. Wait for reboot. 5. Verify new firmware version.
🔧 Temporary Workarounds
Change root password
linuxManually change the root password on affected devices
passwd root
Disable remote management
allDisable SSH and web management from WAN interface
🧯 If You Can't Patch
- Isolate affected routers in separate network segments with strict firewall rules
- Implement network monitoring for suspicious authentication attempts to router management interfaces
🔍 How to Verify
Check if Vulnerable:
Check /etc/shadow file for hardcoded password or attempt SSH login with known default credentialsCheck Version:
cat /proc/version or check web interface firmware versionVerify Fix Applied:
Verify root password has been changed and cannot be accessed with default credentials📡 Detection & Monitoring
Log Indicators:
- Successful root SSH logins from unexpected sources
- Multiple failed authentication attempts followed by successful root login
Network Indicators:
- SSH connections to router on port 22 from external IPs
- Unusual outbound traffic from router
SIEM Query:
source="router_logs" AND (event="authentication success" AND user="root")