PT-2024-27703 · Xiaomi · Redmi Router Rb03

Ke Xu + 4 · Published 2024-06-17 · Updated 2024-11-22 · CVE-2024-37664

Positive Technologies (AI Summary)

CVSS v3.1

5.2

Medium

Base vector

AV:A/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Redmi router RB03 version 1.0.57

Description The issue allows an attacker in the same WLAN as the victim to disconnect or hijack the traffic between the victim and any remote server by sending out forged TCP RST messages to evict NAT mappings in the router. This can lead to TCP DoS or hijacking attacks.

Recommendations For Redmi router RB03 version 1.0.57, consider restricting access to the WLAN network to minimize the risk of exploitation until a patch is available. As a temporary workaround, implement additional security measures to monitor and filter out forged TCP RST messages.

Exploit

Fix

Weakness Enumeration

CWE-940

Related Identifiers

CVE-2024-37664

Affected Products

Redmi Router Rb03

References · 4

• 🔥 https://github.com/ouuan/router-vuln-report/blob/master/nat-rst/redmi-rb03-nat-rst.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-37664 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-37664 · Security Note
• https://t.me/cvenotify/102363 · Telegram Post