CVE-2024-33792

An attacker sends a crafted payload to the 'tracert' (traceroute) diagnostic page available in the device's interface. User input passed through the interface is not properly validated or sanitized (CWE-20), allowing injection of additional system commands (CWE-78). As a result, malicious commands are executed with the privileges of the process handling the request at the router's operating system level.

An attacker can remotely take full control of the device by executing arbitrary OS commands — including modifying configuration, gaining access to transmitted network data, or using the device as an entry point for further attacks on the internal network.

Apply patches available from the manufacturer according to the references provided. As a temporary measure, it is recommended to restrict access to the device's administrative interface exclusively to trusted hosts and to isolate the device from the public Internet.

Netis-Systems MEX605 with firmware version v2.00.06