Multiple SHARP Routers Vulnerabilities Let Attackers Execute Arbitrary Code

Multiple vulnerabilities have been identified in SHARP routers, potentially allowing attackers to execute arbitrary code with root privileges or compromise sensitive data.

Labeled under JVN#61635834, the vulnerabilities highlight significant security concerns for affected devices.

Overview and Key Vulnerabilities

JPCERT/CC, alongside security expert Shuto Imai of LAC Co., Ltd., has detailed several critical vulnerabilities affecting SHARP routers.

These risks stem from issues such as OS command injection, improper authentication, and buffer overflow.

Free Webinar on Best Practices for API vulnerability & Penetration Testing:  Free Registration

If exploited, they could enable unauthorized access, operational disruptions, or exposure of sensitive user data. The core vulnerabilities include:

• CVE-2024-45721: An OS command injection issue in the hostname configuration screen (CVSS 7.2). It enables attackers with high privileges to execute arbitrary commands.
• CVE-2024-46873: A hidden debug function with no authentication requirements (CVSS 9.8) poses a critical risk, allowing attackers to gain full control remotely.
• CVE-2024-47864: Buffer overflow vulnerability in the debug function (CVSS 5.3), which can crash the product’s web console.
• CVE-2024-52321: Improper authentication in the configuration backup function (CVSS 5.9), permitting attackers to retrieve sensitive data.
• CVE-2024-54082: Another OS command injection vulnerability in the restore configuration function (CVSS 7.2).

Among these, CVE-2024-46873 is the most severe, as it can be exploited remotely with no authentication, posing a major threat to user privacy and system stability.

Affected Products

Several SHARP router models from major providers are impacted, including:

• NTT DOCOMO, INC.:
  • Home 5G HR02 (S5.82.00 and earlier)
  • Wi-Fi Station SH-52B (S3.87.11 and earlier), and SH-54C (S6.60.00 and earlier)
  • Wi-Fi Station SH-05L (01.00.C0 and earlier)
• SoftBank Corp.: Pocket Wifi 809SH (01.00.B9 and earlier)
• KDDI CORPORATION: Speed Wi-Fi NEXT W07 (02.00.48 and earlier)

Impact and Risks

Exploitation of these vulnerabilities could lead to:

• Execution of arbitrary OS commands with root privileges (CVE-2024-45721, CVE-2024-46873, CVE-2024-54082).
• Crashing of the web console (CVE-2024-47864).
• Retrieval of sensitive backup files (CVE-2024-52321).

Users are urged to update their router firmware to the latest versions, as provided by their respective vendors:

According to the JVN reports, all major vendors, including KDDI CORPORATION, NTT DOCOMO, INC., Sharp Corporation, and SoftBank Corp., have acknowledged the vulnerabilities and are actively addressing the issue as of December 16, 2024.

This discovery credits Shuto Imai of LAC Co., Ltd., who coordinated the disclosure through JPCERT/CC and the Information Security Early Warning Partnership.

Investigate Real-World Malicious Links, Malware & Phishing Attacks With ANY.RUN – Try for Free