PT-2024-9271 · Openwrt · Openwrt

Ry0Tak · Published 2024-12-06 · Updated 2025-03-18 · CVE-2024-54143

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: OpenWrt versions prior to 920c8a1

Description: The issue is related to the Attended SysUpgrade feature of OpenWrt, which allows for the injection of malicious firmware. This is due to a combination of command injection in the ImageBuilder service and the use of truncated SHA-256 hashes, making it feasible for an attacker to generate collisions and serve compromised images to users. The vulnerability could be exploited to distribute malicious firmware packages, potentially affecting over 1.7 million services.

Recommendations: Update to ASU version 920c8a1 to protect against the vulnerability. Verify the integrity of builds and only use official images from the OpenWrt website for safety. As a temporary workaround, consider restricting access to the vulnerable openwrt/asu server until a patch is applied.

Exploit

Fix

Weakness Enumeration

CWE-328

Related Identifiers

BDU:2024-10959

CVE-2024-54143

GHSA-R3GQ-96H6-3V7Q

Affected Products

Openwrt

References · 46

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/54xxx/CVE-2024-54143.json · Exploit
• https://bdu.fstec.ru/vul/2024-10959 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-54143 · Security Note
• https://osv.dev/vulnerability/CVE-2024-54143 · Vendor Advisory
• https://github.com/openwrt/asu/commit/920c8a13d97b4d4095f0d939cf0aaae777e0f87e · Note
• https://github.com/openwrt/asu/security/advisories/GHSA-r3gq-96h6-3v7q · Note
• https://t.me/cvedetector/12246 · Telegram Post
• https://twitter.com/HunterMapping/status/1866725148956426454 · Twitter Post
• https://twitter.com/nanovms/status/1866014598425673910 · Twitter Post
• https://twitter.com/Eth1calHackrZ/status/1867498444908085554 · Twitter Post
• https://twitter.com/InnoVirtuoso/status/1867667343461298436 · Twitter Post
• https://twitter.com/zoomeye_team/status/1866399764205674544 · Twitter Post
• https://twitter.com/soap2you/status/1867706723177578567 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1865126616742920584 · Twitter Post
• https://t.me/opennews/13486 · Telegram Post