CVE-2024-23628

The vulnerability consists of insufficient filtering of input data passed to the 'SaveStaticRouteIPv6Params' parameter, which allows injection and execution of arbitrary system commands. An attacker operating from a local network segment (AV:A vector) can craft an appropriate request containing a malicious payload. Although access requires authentication, the authorization mechanism can be bypassed, which practically eliminates this protective barrier.

Successful exploitation of the vulnerability gives the attacker full control over the device — the ability to execute arbitrary system commands, which may lead to violations of confidentiality, integrity and availability of the system and the entire network behind it.

Patches available from the manufacturer should be applied in accordance with references. Until the fix is implemented, it is recommended to restrict access to the device management interface only to trusted hosts and isolate the router from untrusted network segments.

Motorola MR2600 (firmware) — versions indicated in manufacturer references