CVE-2024-7467
📋 TL;DR
This CVE describes a critical OS command injection vulnerability in Raisecom gateway devices' web interface. Attackers can execute arbitrary commands remotely by manipulating the template/stylenum parameter in the sslvpn_config_mod function. Organizations using affected Raisecom MSG series devices with vulnerable firmware are at risk.
💻 Affected Systems
- Raisecom MSG1200
- Raisecom MSG2100E
- Raisecom MSG2200
- Raisecom MSG2300
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full device compromise allowing attackers to execute arbitrary commands with system privileges, potentially leading to complete network takeover, data exfiltration, or use as a pivot point for lateral movement.
Likely Case
Remote code execution leading to device configuration changes, credential theft, installation of backdoors, or disruption of network services.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound filtering and network segmentation prevents lateral movement.
🎯 Exploit Status
Exploit details have been publicly disclosed in GitHub repository. The vulnerability requires no authentication and has simple exploitation vectors.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Vendor was contacted but did not respond. Consider upgrading to newer firmware versions if available or implementing workarounds.
🔧 Temporary Workarounds
Network Access Control
allRestrict access to the web interface using firewall rules to only trusted IP addresses
Disable Web Interface
allIf web interface is not required for operations, disable it completely
🧯 If You Can't Patch
- Segment affected devices into isolated network zones to limit lateral movement
- Implement strict outbound filtering to prevent command and control communication
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface or CLI. If running version 3.90 on affected models, assume vulnerable.Check Version:
Check via device web interface or use device-specific CLI commands (varies by model)Verify Fix Applied:
No official fix available. Verify workarounds by testing web interface accessibility and reviewing firewall rules.📡 Detection & Monitoring
Log Indicators:
- Unusual web interface access patterns
- Unexpected command execution in system logs
- Multiple failed or unusual parameter values in web requests
Network Indicators:
- Unusual outbound connections from gateway devices
- Traffic to unexpected ports or IP addresses
SIEM Query:
source="raisecom_gateway" AND (url_path="/vpn/list_ip_network.php" OR cmd_execution="*" OR suspicious_parameter="template/stylenum")