Critical OpenWrt Flaw Allows Malicious Firmware Injection

December 13, 2024December 13, 2024

Critical Vulnerability Discovered in OpenWrt’s Attended Sysupgrade Feature: What You Need to Know

A serious security flaw has been identified in OpenWrt’s Attended Sysupgrade (ASU) feature, raising alarms among users and developers alike. This vulnerability, designated as CVE-2024-54143, poses a significant risk by allowing malicious firmware packages to be distributed if exploited. With a critical CVSS score of 9.3 out of 10, this issue demands immediate attention from the OpenWrt community and users of the popular open-source Linux-based operating system.

Overview of the Vulnerability in OpenWrt

The vulnerability impacts the ASU feature of OpenWrt, which is widely used for routers and embedded devices that manage network traffic. Discovered by Flatt Security researcher RyotaK on December 4, 2024, this flaw has serious implications for the integrity of firmware images built using the ASU tool. OpenWrt has since released a patch in version 920c8a1 to address the issue.

How the Flaw Works

Command Injection: The vulnerability allows attackers to exploit command injection within the imagebuilder image.
SHA-256 Hash Collision: A truncated 12-character SHA-256 hash can be manipulated, leading to the potential replacement of legitimate firmware images with malicious ones.
No Authentication Required: Attackers do not need authenticated access to submit crafted build requests, making exploitation easier.

According to OpenWrt maintainers, "An attacker can pollute the legitimate image by providing a package list that causes the hash collision." This scenario poses a severe supply chain risk, as compromised firmware could be signed with a legitimate build key, making it indistinguishable from safe versions.

Recommended Actions for Users

To protect against this threat, users are strongly advised to take the following actions:

Update OpenWrt: Install the latest version (920c8a1) that includes the patch for this vulnerability.
Review Security Protocols: Ensure that all security measures are in place, especially if your device is accessible over the internet.
Monitor for Updates: Stay informed about any further disclosures or patches related to this vulnerability.

Community Response and Further Resources

The OpenWrt community has been actively discussing the implications of this vulnerability. It’s crucial for users to remain vigilant and proactive in securing their devices. For more detailed information about this vulnerability, you can refer to the official CVE database and the OpenWrt security advisory.

Conclusion

The discovery of CVE-2024-54143 highlights the importance of maintaining updated software in embedded and network devices. By promptly addressing this vulnerability, users can safeguard their systems against potential exploitation by malicious actors. For ongoing updates and discussions about OpenWrt and its security, follow us on Twitter and LinkedIn to stay informed.

What are your thoughts on this vulnerability? Have you updated your OpenWrt systems yet? Share your experiences in the comments below or check out related articles for more insights!

Ivanti Flaw CVE-2025-0282 Under Active Exploitation

January 9, 2025January 9, 2025

Ivanti has warned of a critical security flaw, CVE-2025-0282, affecting its products, including Ivanti Connect Secure and Policy Secure, with an active exploitation reported since December 2024. This vulnerability, rated 9.0 on the CVSS scale, allows unauthenticated remote code execution, posing severe risks. Affected versions need urgent patching. Ivanti also addressed CVE-2025-0283, a high-severity privilege escalation vulnerability. Cybersecurity firm Mandiant linked attacks to the threat actor UNC5337, utilizing malware like SPAWN and PHASEJAM. Organizations are urged to upgrade systems, scan for compromises, and report any suspicious activity. CISA has added the vulnerability to its KEV catalog for immediate action.

Why Security Leaders Struggle to Secure Funding

Exploits of Critical Fortinet EMS Bug Continue

December 23, 2024December 23, 2024

A critical SQL injection vulnerability (CVE-2023-48788) in Fortinet FortiClient EMS is posing a global threat, affecting organizations in multiple countries, including Brazil, France, and India. Cybercriminals exploit this vulnerability to gain unauthorized access and control over exposed Windows systems. Kaspersky reports that attackers have used tools like ScreenConnect and Mimikatz for credential theft and data gathering. The increasing complexity of these attacks emphasizes the need for enhanced security measures, including regular software updates, intrusion detection systems, and employee training on cybersecurity practices. Organizations are urged to stay informed and proactive to mitigate risks associated with this vulnerability.

Malicious NPM Package Mimics Ethereum Contract, Injects RAT

January 3, 2025January 3, 2025

A malicious npm package disguised as a bug detection tool for Ethereum smart contracts has been found to install Quasar RAT (Remote Access Trojan) on developers’ systems. This threat highlights the vulnerability of the Ethereum development community to cyber attacks. Quasar RAT can log keystrokes, capture screenshots, harvest credentials, and exfiltrate files, posing a significant risk to developers and organizations. Experts recommend validating code, monitoring registry changes, and watching for unusual network activity to mitigate these risks. The incident underscores the need for enhanced security measures, particularly against supply chain attacks in the blockchain space. Developers must remain vigilant to protect their assets.

Cisco Alerts: Decade-Old ASA WebVPN Flaw Under Attack

December 3, 2024December 12, 2024

Cisco has issued a critical alert about the active exploitation of a decade-old vulnerability, CVE-2014-2120, in its Adaptive Security Appliance (ASA). This flaw allows unauthenticated attackers to execute cross-site scripting (XSS) attacks via the WebVPN login page. The urgency is heightened by reports from CloudSEK regarding the use of this vulnerability in distributing AndroxGh0st malware, linked to the Mozi botnet. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog, mandating federal agencies to remediate it by December 3, 2024. Users are advised to update installations, monitor for suspicious activity, and educate employees on security risks.

Attacks Linked to Major GFI KerioControl Firewall Flaw

January 10, 2025January 10, 2025

GFI KerioControl firewalls are vulnerable to a critical security flaw, CVE-2024-52857, enabling CRLF injection, which has been exploited since December 28. This vulnerability allows attackers to manipulate HTTP response headers, leading to severe risks such as remote code execution, HTTP response splitting attacks, and reflected cross-site scripting (XSS). Security experts urge the nearly 24,000 affected users to apply patches immediately to protect their networks. The flaw was identified by researcher Egidio Romano, with attacks traced back to specific IP addresses in Singapore and Hong Kong. Regular updates and security audits are crucial for safeguarding against such threats.

Decades-Old Vulnerabilities Found in Ubuntu’s Needrestart Package

December 1, 2024December 1, 2024

Critical security flaws have been found in Ubuntu’s needrestart package, which is included by default since version 21.04. Identified by the Qualys Threat Research Unit, these vulnerabilities allow local attackers to gain root privileges without user interaction. Key flaws (CVE-2024-48990, CVE-2024-48991, CVE-2024-48992, CVE-2024-11003, CVE-2024-10224) pose significant risks, enabling arbitrary code execution. Users are urged to update to version 3.8 immediately or disable interpreter scanners as a temporary fix. The situation highlights the necessity for timely software updates to protect system integrity against potential threats. Stay informed through official updates.