The Missing Link: Draytek’s New RCEs Complete the Chain
Discloses two unauthenticated remote code execution vulnerabilities in Draytek routers (CVE-2024-51138 and CVE-2024-51139) that enable full edge device takeovers.
Summary
Edge Router Vulnerabilities in Corporate Networks
Draytek routers are widely deployed as edge gateways across enterprise and small business networks. Their internet-exposed management interfaces make them prime targets for botnets and state-sponsored threat actors.
Unauthenticated Remote Code Execution Flaws
Researchers disclose two critical zero-day vulnerabilities in Draytek firmware: CVE-2024-51138 (a buffer overflow in STUN CGI handling) and CVE-2024-51139 (an integer overflow in CGI query parsing).
End-to-End Exploitation and Persistence Chain
Chaining these RCE vulnerabilities with previously documented firmware persistence techniques allows unauthenticated attackers to achieve root access from the WAN interface and install persistent backdoors.
Tooling and Edge Device Defense
The researchers release Draytek Arsenal, an open-source firmware analysis toolkit, emphasizing the necessity of rapid edge device patching and disabling external management interfaces.
Related talks
Creator Stage·43 min
Zoltan Balazs
Surveys pervasive architectural and implementation failures in consumer IoT gadgets, highlighting cleartext credentials, command injections, and insecure defaults.
Creator Stage·26 min
Alexandru Lazar
Demonstrates remote code execution vulnerabilities in popular Dahua perimeter surveillance cameras discovered through firmware key extraction.
Main Stage·27 min
Edward Warren
Discloses multiple pre-authentication remote code execution and arbitrary SMS vulnerabilities across popular consumer and industrial 4G/5G cellular routers.