CVE-2024-22729

The vulnerability results from the lack of proper validation and sanitization of input data passed in the password parameter on the device's login page. An attacker can inject malicious system commands directly into this field, which are then executed by the device with the privileges of the process handling the login. The attack requires no authentication or user interaction, and the network vector means it can be performed remotely.

An attacker can remotely execute arbitrary system commands on the vulnerable device, leading to full takeover of the router, loss of confidentiality and integrity of data, and potential disruption of its operation.

Patches available from the manufacturer should be applied in accordance with the references. Until the update is implemented, it is recommended to restrict access to the device's administrative interface solely to trusted local networks and block access from the WAN.

NETIS SYSTEMS MW5360 Firmware version V1.0.1.3031