CVE-2024-54802
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on Netgear WNR854T routers via a stack-based buffer overflow in the UPnP service. Attackers can exploit this by sending specially crafted M-SEARCH requests with oversized Host headers. All users of the affected router model and firmware version are vulnerable.
💻 Affected Systems
- Netgear WNR854T
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the router with root-level remote code execution, allowing attackers to intercept traffic, modify configurations, pivot to internal networks, or install persistent malware.
Likely Case
Remote code execution leading to router takeover, network traffic interception, DNS hijacking, and potential lateral movement to connected devices.
If Mitigated
Limited impact if UPnP is disabled or the router is behind strict firewall rules blocking external UPnP requests.
🎯 Exploit Status
The vulnerability requires no authentication and has a public proof-of-concept. Exploitation is straightforward with readily available tools.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: N/A
Restart Required: No
Instructions:
No official patch is available as this is an end-of-life device. Consider the workarounds below or replace the hardware.
🔧 Temporary Workarounds
Disable UPnP Service
linuxCompletely disable the vulnerable UPnP service to prevent exploitation.
ssh admin@router-ip
killall upnp
chmod -x /usr/sbin/upnp
Block UPnP Ports
linuxBlock external access to UPnP ports (1900/udp, 5000/tcp) at the network perimeter.
iptables -A INPUT -p udp --dport 1900 -j DROP
iptables -A INPUT -p tcp --dport 5000 -j DROP
🧯 If You Can't Patch
- Replace the router with a supported model that receives security updates
- Isolate the router in a separate VLAN with strict firewall rules limiting its network access
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via web interface (Advanced > Administration > Router Status) or SSH: 'cat /proc/version'Check Version:
cat /proc/version | grep -o 'WNR854T.*'Verify Fix Applied:
Verify UPnP service is not running: 'ps aux | grep upnp' should return no results. Check firewall rules: 'iptables -L -n' should show UPnP ports blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual UPnP M-SEARCH requests in router logs
- Multiple large Host header requests to port 1900/udp
Network Indicators:
- Abnormal UDP traffic to port 1900 with oversized packets
- Suspicious M-SEARCH requests from external IPs
SIEM Query:
source="router.log" AND "M-SEARCH" AND (Host.length > 100 OR "upnp")