CVE-2024-54804
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary commands on Netgear WNR854T routers by sending a specially crafted request to post.cgi. Attackers can inject commands through the wan_hostname parameter during a forced reboot. This affects all users of Netgear WNR854T version 1.5.2 (North America) firmware.
💻 Affected Systems
- Netgear WNR854T
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the router allowing persistent backdoor installation, network traffic interception, lateral movement to connected devices, and router bricking.
Likely Case
Router compromise leading to DNS hijacking, credential theft from network traffic, and use as a pivot point for attacking internal devices.
If Mitigated
Limited impact if router is behind firewall with restricted WAN access and proper network segmentation.
🎯 Exploit Status
Exploit requires sending HTTP POST request to post.cgi with malicious wan_hostname parameter. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Consider replacing router with supported model.
🔧 Temporary Workarounds
Disable web interface
allDisable router's web administration interface to prevent exploitation
Access router settings → Administration → Disable Remote Management
Network isolation
linuxPlace router behind firewall with strict inbound rules
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Replace router with supported model that receives security updates
- Implement strict network segmentation to isolate router from critical assets
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in web interface: Advanced → Administration → Router Status → Firmware VersionCheck Version:
curl -s http://router-ip/ | grep -i 'wnr854t' || nmap -sV -p80,443 router-ipVerify Fix Applied:
No fix available to verify. Workarounds can be verified by testing web interface accessibility.📡 Detection & Monitoring
Log Indicators:
- POST requests to /post.cgi with unusual wan_hostname parameter values
- Router reboot logs following POST requests
- Unusual command execution in system logs
Network Indicators:
- HTTP POST to router IP on port 80/443 with post.cgi in URL
- Unusual outbound connections from router after reboot
SIEM Query:
source="router_logs" AND (url="/post.cgi" OR method="POST") AND (user_agent NOT CONTAINS "browser" OR params CONTAINS "wan_hostname")