PT-2025-33278 · Kuwfi · Kuwfi 4G Ac900 Lte Router

Published 2025-08-14 · Updated 2025-08-16 · CVE-2024-53945

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: KuWFi 4G AC900 LTE router version 1.0.13

Description: The KuWFi 4G AC900 LTE router is susceptible to command injection via the HTTP API endpoints /goform/formMultiApnSetting and /goform/atCmd. An authenticated attacker can execute arbitrary OS commands with root privileges by injecting shell metacharacters into parameters like pincode and cmds. Successful exploitation can result in full system compromise, potentially including enabling remote access such as telnet.

Recommendations: KuWFi 4G AC900 LTE router version 1.0.13: As a temporary workaround, restrict access to the affected API endpoints /goform/formMultiApnSetting and /goform/atCmd to minimize the risk of exploitation.

Exploit

Fix

Code Injection

Command Injection

Weakness Enumeration

CWE-94

CWE-77

Related Identifiers

CVE-2024-53945

Affected Products

Kuwfi 4G Ac900 Lte Router

References · 6

• 🔥 https://github.com/actuator/cve/tree/main/Kuwfi · Exploit
• 🔥 https://github.com/actuator/cve/blob/main/Kuwfi/CVE-2024-53945.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-53945 · Security Note
• https://t.me/cveNotify/132257 · Telegram Post
• https://kuwfi.com/products/kuwfi-gigabit-wireless-router-4g-lte-wifi-router-dual-band-portable-wifi-modem-hotspot-64-user-with-gigabit-wan-lan-rj11-port · Note
• https://twitter.com/CVEnew/status/1956654819659419722 · Twitter Post