SHARP has issued an emergency security update due to vulnerabilities recently discovered in several of its routers. Customers using the vulnerable devices are urged to immediately update their firmware to protect their networks .
According to SHARP, the vulnerabilities could allow attackers to perform various malicious activities, including:
- Arbitrary Code Execution: Attackers can execute commands with root privileges (CVE-2024-45721, CVE-2024-46873, CVE-2024-54082).
- Sensitive Information Exposure: Access could allow attackers to retrieve router configuration files (CVE-2024-52321).
- Denial of Service: Exploiting buffer overflow vulnerabilities could disrupt the router's operation (CVE-2024-47864).
See also: Mirai Botnet targets Juniper smart routers
For the attack to be possible, the attacker must have access to SHARP routers via Wi-Fi, USB or LAN, as well as possess knowledge that is not usually available to the average user. If the above conditions are not present, the probability of exploiting the network is considered low.
SHARP routers: Vulnerabilities
Let's take a closer look at the vulnerabilities found in SHARP routers:
- CVE-2024-45721: A vulnerability that allows OS command injection in the HOST name configuration screen, allowing attackers with root privileges to execute arbitrary commands.
- CVE-2024-46873: Exploitation of hidden debug functions, allowing unauthorized access and escalation of root privileges.
- CVE-2024-47864: A Buffer overflow vulnerability in the hidden debug function, which could lead to a denial of service.
- CVE-2024-52321: Incorrect authentication in the configuration backup function, which may expose sensitive information.
- CVE-2024-54082: Command injection vulnerability during configuration rollback, leading to arbitrary command execution with elevated privileges.
See also: Vulnerabilities in Synology router allow hackers to inject arbitrary Web Script
Which SHARP routers are affected by the above vulnerabilities?
The vulnerabilities affect various routers and software versions across multiple carriers. For NTT Docomo, Inc., the affected models include:
- Wi-Fi STATION SH-05L (01.00.C0 and older versions),
- Wi-Fi STATION SH-52B (S3.87.11 and older versions),
- Wi-Fi STATION SH-54C (S6.60.00 and older versions),
- home 5G HR02 (S5.82.00 and older versions).
SoftBank Corp. 's Pocket WiFi 809SH is vulnerable in 01.00.B9 and earlier versions. For KDDI Corporation , the Speed Wi-Fi NEXT W07 is affected in 02.00.48 and earlier versions.
SHARP has released firmware updates that address vulnerabilities in its routers. Customers are advised to:
- Firmware update: Download and install the latest version from the official SHARP website or the corresponding provider (NTT Docomo, SoftBank, KDDI).
- Enable automatic updates: The router must be configured to update automatically to address security vulnerabilities.
If automatic updates are already enabled, devices may have been updated, but it is a good idea for users to check.
SHARP expresses its gratitude to JPCERT/CC and the researcher who identified and reported these vulnerabilities in the routers.
See also: Zero-day flaws in IO-Data router exploited in attacks
General router protection tips:
1. Update firmware regularly
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
2. Change the default login credentials
3. Use a strong password
4. Enable encryption
5. Disable remote management
6. Set up a guest Wi-Fi network
7. Use a firewall
8. Monitor connected devices on the DIR-846W router
9. Keep the router in a safe place
Source: cybersecuritynews.com
