CVE-2024-10119

An attacker sends a specially crafted network request to the device containing malicious data in a parameter that is not properly validated by the router firmware. Lack of input data sanitization (CWE-78 — command injection) causes the transmitted commands to be executed directly by the device's operating system. The attack requires no authentication or user interaction, making it particularly dangerous.

An attacker can gain full control over the device — execute arbitrary system commands, modify network configuration, intercept network traffic, or use the router as an entry point for further infrastructure penetration (lateral movement).

Apply patches available from the manufacturer according to the references (TWCERT/CC: https://www.twcert.org.tw/en/cp-139-8157-e0461-2.html). Until updates are applied, it is recommended to restrict access to the router's management interface only to trusted IP addresses and isolate the device from the public Internet using a firewall.

SECOM WRTM326 wireless router (WRTM326 firmware); specific firmware versions indicated in the manufacturer's references