Pre-Auth RCE, Arbitrary SMS & Adjacent Attacks on 5G and 4G_LTE Routers
Discloses multiple pre-authentication remote code execution and arbitrary SMS vulnerabilities across popular consumer and industrial 4G/5G cellular routers.
Summary
The Critical Role of Cellular Gateways
Commercial 4G LTE and 5G cellular routers provide primary and failover connectivity for industrial control networks, retail point-of-sale systems, and remote field deployments.
Pre-Authentication RCE and SMS Exploitation
Edward Warren details zero-day vulnerabilities in cellular router web management daemons and SMS parsing engines. Unauthenticated remote attackers can send crafted SMS messages or HTTP requests to trigger buffer overflows and achieve root shell access.
Adjacent Network Attacks and Cellular Pivoting
Once compromised, cellular gateways allow attackers to pivot across adjacent carrier subnets, intercept incoming multi-factor authentication SMS codes, and breach connected enterprise internal networks.
Hardening Cellular Router Deployments
Securing cellular endpoints requires disabling external WAN management interfaces, enforcing strong carrier APN isolation, and applying vendor firmware updates immediately.
Related talks
Creator Stage·25 min
O. Gianatiempo · G. Aznarez
Discloses two unauthenticated remote code execution vulnerabilities in Draytek routers (CVE-2024-51138 and CVE-2024-51139) that enable full edge device takeovers.
Main Stage·40 min
Matthias Fischer · Patrick Wardle
Reveals critical baseband and firmware vulnerabilities in popular cellular modems that allow remote over-the-air exploitation and device takeover.
Main Stage·21 min
Noam Moshe
Demonstrates remote code execution and edge compromise across Axis enterprise IP cameras, turning surveillance devices into offensive pivot points.