Security Research
CVE-2024-41992 Arcadyan FMIMG51AX000J RCE: ISP router supply chain bug
Thinking
2024-08-06
4 min read
Research Dossier
#Vulnerability Analysis#Code Audit#Supply Chain Attack
A RCE in the Arcadyan FMIMG51AX000J router firmware (used in WiFi Alliance certified devices), CVSS 9.8, affects a large number of ISP-deployed home gateway devices globally.
Unlock to view this content.
ad8d9422966c73fee42096dad808c6448a272095349f41facc28f3d18d1ee66a0726fb5aaffd9271b6702e0ae53f6961031443030e63d37842b7356b4a67d1f44b648f709f84d99b1640e6f7a87a3d44129b61502fc0c5c728a88c67798e6cfb7bcb30fe880464fad1a2cf9635735fbd6e964b402ea4ed27e494f7c87c72f1c586b333a4d4b6d4ade7253d06d61bf923572a6b8c253d117e8b63642be9ad8c68eaee7d4a02592bcdbd3155abcc6a953135deec61ed6729ad92ae056a76758bfc9dbe3a6985cd8e376c1d1fff361ad5bb4a1f33c7260c9394351085b7e572a5d7b6cd4f78668c3dedcb9f479d181d705cb54bd60d5ec626c5163cd1cb4fa5066c77e96cba87f1982246bda88df5b047c3dd20777829410932fa48b81139e61a86e1ed8323835a149b08941017733954354f981f3b0cdf7b5c107d843e19c6f18c3629ecb5a6020edc1e8184cb32db6486dccce2ed65fee1cecb4161d6ab6aed437e01843837ff824f94570ceb64007f431d300833b7bddccef568fdd881192987c695201c059857ae8077db785fd0d75da9aae007a046d871704f8cb622ab0379a983b7323b98c92eebd25eb767e033c670efa65724d966b320e7b9b6c0f5f8e8e69cb4abc4630f4c5bc4c2e30540efee8117d9e1216820b9d76bef72f883ed67407c68f1ed3c1c8dd0d45cdd2b04a1ffcd4f627742f2d83dc5b7fb3c75ffd47f8f0905788f82ff706e33b7dcf0a75b51447c5276ffc2855836b5518087b07d2f7a397d18b3ddf4e1438628e61576c7d55748976569d3055517e2fb425bebc0fe2341444aea84c4d9a294bc43d37d9f433207b750a5e2666877e3a780a8a797166870d42715988dad34885dd8a3098f0d8abbde1d978202623a02c89afbd4db1b322ac71fba7484f306839444d85ea40dd8c8a507943f3774a8e7a1e675a3b5eb6a0a7de07b4d881b571ff6091a137e959754a530712c3d5a76376e285bff93da3690e54f2afe6f35ee6e8faefdb5048c8f779638fc52bbd4bcff05acd0abcd49e1a71e643b518e737d1e1acd391126b19f79cc850fd17045e356a4eb896648294f228a367a311013e9d29ba75463abf294ad2b072a094db3a5771e40b750228099636808e73ee9ade29757ff40b481bebfb24dbd20b9583dfb3740c26c821088c7d6de1e03771e2ca156b29dd2768d82955ea8b83a49517dcd42552e3ae29ed3480970571d8406083d57593404f980fa8508760a18d76a74cc9d925cd0ca1b35c49bd9408de7a36b47f95d01a56f7a32fc3811dc65f287a1e2afe55215dffb987720e8fd1a74c19e88116a7aaa135d2edcb0e7b7292738b52cc66ad0a2f4e921d5a8256e5892290d41d3f24e0ab092db5d6d30eace0c3420348eca36d69a2eb90806156742961f8db402018fe2c99f410adfeb1c33777b44a79f9c6025d9ecdd0d3a5e4aead05b422f493523692e2f0c5734131b8737d0b6451fabfe9709f54ae90a6cc0103c930cc6f99bfeea151250e0d9f60289846b5d1692370638aa5989202d26504f217dd5fa1a51cf7de02520341f1d94e3ae185159c2489b4015d023f17dc9cfc588f47368448c2fdda1d16c2c5838fbf4cd186d16f9203ae607dd4c912846b7172f112dba8b0367d1bc2fd7c1c3b286f1c740aa7f51b3199f9de42c5aaaae06204d7e7134dec8da677e915f5fa3ed6f42b3a28552e83cbf6d6fbaba0d2c837865388930593cb9452e8ecb696e98307c08651becdc7f01c629974f25f6837650a0d659aa60a6d0f7ef7a8fdeff7917043228d48039a1b3d177477a770d0bd35f998b0878d56f625ae1e88730dd9cac39c3f63bf4a12df838aea503c018c11e2eceddf55ad6a4b74e419bdd71a6f3a8a28449f5507f88ee73a323f9cfdb96010cf42850a0e85525e657a63d8cc457b54ef70ea368110b878c125b436c032262a22b6d8828cd4de02398c5082b65b1b489f255750d2436a2530729aec273d6ba5a42f893e1a3e7de9d91c49111dfc3f4371af6eb62cabf251033de2889dd1a12e41888547ffe48c88e4a806704564bd3b4f56191265a451f6b536ed6a8022a78f20f2610796ffcffe7600e5f6869dd53897d00ba0af1bd04124f17e26e90cf92138883236ccc9094942017ef6f9dd3cf8fe3b90e0dc76d9e854565a3bed36eba09577bf7526c59d05bf27e8f096569ca3e7aed89daf80fbc8145505bb7ab8eefa89d60ce689f2842cd9d077bda1c27e87284f0947e614f63a7572158497630cafbda740018160261092ccc9b5c022a11cfc2df25992f671875980a60b8ce4d2aa560692c119d1a42445597eeb5bf451d44df1e01cde53b63402d0e5baf374e3d83478414bea709b13b561696d14ac92328a4cd9cd5b70ae4b987e259fb136dfa03223ecf494a3abb4849c0c6a1db147a9c8ca9daaebd8646bd6a81c48dbfd621c828e18ab5b30fab267e66d9126984854e557077208e11ae301aa5e56e2ab58191a6444f280f9347b7db79673b2a3c6683ad736ce4ef7ce5f43cc97c28593851ae4abab265ab1a9e29a0bce57ae52580f5605d292d00cb94632fcae7ea64cedba3177fbda5c8f66b0939a958eb8084c10beaa9bd19942f8cc4abb2211c3ba8dc0d1b5527119aefccaf86668c8e62de7f928dcc45c238ab605b5d8b60e39b7771478bd6cc67fc57146e3c639172b7272e138337564000fb5a95232e46e8cbff06fc00406fa0473e1b648ff65e2fda6c7ec72d1d6cd6fc9ea0dd2a049107c31ce53aca858706b858c922152513bc55b6c2ec6899fa06309bb6e92b5ab1a171868c82c11a0b10ec178e492992614b10232775efd9abd877f3bd2273d0eb279bc90a6ff08266835a5db9eaf45817d4b1dca0bca254d4637d58610c6dbfde2dfa129536f05245a433c6b025879acec1f0006da5c1157483f05b3038179865712a6baee4472628f3bb93f3d82244e433b9c851a107a157a41b0c694957ad5a7eb7b753c075fabdec9d934efea3d11fede3101c6d77a75d02ee5d9614a3c55b0f2de3e9bba0a79d0819906f6e5ac62628fb12625a24a4a0756605821c5ab56bbb830ce9d238c0d79d346b53df6a3a9c7f437da706b0f5e710f9d51c0e8f3842ef8df265c45bd155d674e77f47ea5209d8f74ee3fbe3573d64882e6b9269479cd82a86a474d6af676b3c85bbde757e08ee09b4a43752dcdc1d1e330c5a14bfa68bae50461046c00d70be20915d9a4a73a8d5a9d80c7cf6e460de0f335b4d6846450f1208fffa9904bbdc0dc98960cb3bee0cf58e56386aedb090c1226a3b115ea54f6808d2bacc16298c943e886b84d28510e636c565128eb071188dc2de62309815826a2f41d92e126a7d26a6dccf292282cfeb754d9715b81c7a2f7eafdb3f8104a0d8f4db46178a90026a693c4c9dbedc4b3684f43a4ade0d2d0a1b97d3c5bf196c3e1fb95d72008d533bc9bbf33346cbfc40ed51a26f0b371bf72fac3f6f1179c7a4272182396a7238d64651c6cf91079537ff6220035f606786081f06aeaa520ebb8fcdc76f67051cd545b7f72e3fced84cb3556213cb103a2245427d18302a6f8a70099db00d1fb8a6acc3bc97aef418167f726c279bf3e249230eb87bfdb19f19f02f6875d8294d013563b8d1b896ce4e8b00f9eea948e0c29c7bd36f42e9854704d3cddf7a31f413e6c3f9d279fb1e50ef56c22bf078ab6022d5217fccc0f5f769633d863fc1c0c84bac2ebc90c469304b71f2515ff757fd55778c96369868266651b4eb415829e9e695de5e406709e182ee43e0e5c8e8b8992ef558adc4987f218a59858d71e7d3a3c2eb4fb0ff13cde50d5bc4b5f8ef969fdf2d5f912568ba61b6f3f8102d0fb1a32544b2b0cbdf63713093dcd7b3210a3f6eb7784e047075f467966892eedfd81d7e6578e0a54d3f34378107532c7477b73feef0b287f89cff2ac148f3bb8e5c390a92a496dffe52ddb2f8d38968de37c9f19531fcd9790ee22ec92b07afaf7bfc7991187f3c437c549c84814f0bc2540d081c9091131be2ce3e649f8d8d7aaf2490d8ffbd4eb96ed11dc4a4548f8921153635527656ca0edd19ad601f0bb505db9e80a293b46c04b017fb0575dabe8617a81856f889ef0676defd1c6740857e0522ee3e59680738cd2689f6ed4aa194a9748962829e151d8c3fc8718fc4ee7da147644845f1863d7240c0a4a420e2f7c0b08aa8af590411fbb1a718cd4396bddfd25ef7085f75aab14894a56ec6d0ec763487a1d7c857fbe0dc82cf8d43f6e8956111de05aea10dd3aa77831e8a02a0f0191a4c6cc2a19cf75a0e14dde4df677dcd6d64a74f0601ad18eee7cdd265385332204195c89d3bcf9ce04359fc0d350c98581342d5698ad82764092d4454213777eb24580f3cda4de05668fd5637e4be87c4164ee5a195a32f83954ebf6b0ad74cbd290e46dd6b74b07ba05d476cd15ab1e85cd4e272c528676929306d7e1f7a55a888f11cddd4ecc2d7a24983959148c48781550e7feeac8b6418c08266f570aa79c1915d0780549cb070ee9986c59be6e810c41e6f9ae55ace1defb683c6439b3d35f5f3c9f302298ab108ba0bf8032a2dbe7ab635d9ce97845978b9ddc55925cebab9ef772ba9e6ac10d3f493979767ecf22b48ba511092df1d0f5aca1e5126917bd1b3ecabb3e2fe5b43905044f958f5d7d3995f1c27172b78fb7201f6fc68f0d976d54abd3ba7a1aa88fd7fab90da9aa390f2e35ef8c4e593917fab7e3680b9f4a3a18fd605bc0a9bb442b9af74626530ebede7000fd3337ca1d2c4e4db13b211fae1d0478a5c450de13358de81e58a51131859bc7643a00c8de1cf6076bdc284c167f6fd85486dc8e04a57d324539a00b0c1209a9ab468a5db133b377e9b4f672a4aa78fa44780ba77addfc34221e9c1516fa83cd2d88d0be5b125e9c773d4fa8b0c99c39dc82c078f235831024a00f1ddde10f4e4ad8b94fdd8853024f1c11da45a6d59e9ce06c1853ddba90dc94b02d3567754287f0d7c6b7f3ff1e4932277ea702ac1180a245b359df8c8628deb51ff025d3e8bf207b09740bb5c900f673348a490be99b25744fc53c3a648e20f6c96d0d2d43d52abdb8a3694d058375c504302b885ffe54973174d7afde8664b57cff8fcc7f563cf3f04dfa9d05d0c5e7e2cf0cd258749221243883f873d19a952d45ce54977ef6ae9a1a3c8f1680aa1ae5cb1241ed3cb62b05e4c9bd7a073ed561930ef78c49bc75284c1371cdfeaa716da18d83b36aef630670e3a9204cc6c60152084ab237e9da2fba648089c1686b95b8003ed9934ad4de635c0bbda6b42a936009bb32ec53fb0fca0f280155c82bf26a2e60f4f971d9efac22273e79d6e6e25d6c716c8db34457b456e4467776a7604eac89081f525eebc2a399003442769c4d6cd5dddfd7ebcd27e78a5f122bfc3b74c1fc3c2464161b7d6c4bfffb885f97fcfa598040f1ba975e0c8fbf80774c3509f933bd11854ca0d954b9338577f955a8367b088ce98ac6cddd0b2dea3760fbee233e6eecfb5fae3c2b8dedab843d4f2179f48768ae4130d7d0c00fe5d83ce4c9271543d462879471fc17904f9f47407580c6287d5ccda12966c567ef8940c4ad25bcdbad46de9791708e7a82b76aca7d477605f80bd4940aec95b3c18a8bf173d07f999dd796e73524710454d3a14fdbcc9b09b2760d30058449348e29686f5b46d0342bf77287d7d89bacaf60a800e40cf304cabc0127e276e9fd09736ff9ccfb3c3c79551c5056dfa6363ee24ccc68011d0a91390204d9f01ace0bda1db5c3d29a2add798531834b3b31428c369307c18e1a37995e5ab7ff97ecf864e7f12b42e704bd59c5271e06096d179397a2f46fa0d8db40d794d54dcad39c5cd7cbf8317c03c70401ac1f73446c384c41e6eafbcf4222d312f9c9621852f8464bb53f71c97f1064c135b012a0a5cc67f9471d9a507648f8df1b18270842297351461492b9d9c7eb82abc702bc65c74716a0d4ded3ba699e889fbfcb2fd38a2d722417cd34b44f54c39310aaf7fe1c6cc97800460300590841c252c966b757361f77ebb06c59f57ff49a6bb0b9813c0775bb3292e62106b16ed13819a04fadef0fa98ed30264aa42568f00ffd47cc5f8ef1ce0d815b5c43e8c4f3895c4e9c6c27e289d9136c46db9765a08475ddb2cbd27ad2b771805330ac83223f9fb98fdd02ab453f3d8fb1c524bf4deb5559d9a4b7c77f1efc9c83d01f35665b4bf1d03da193fc731cf32fd9d78408af46fad4a2c278cd1b4e20377687ec5b9d011fe82d98f960cebd6edb87f6ad8fedb5fb64ff4bccebaaf3dc0b9e081e0c05785c65d490d39752df28d2fd4b3c43eaabaf60564ba8dd45d65bbee9d481e9a3409d8f7f86685dbbe20b3f69175dcd7396d157a115f31d654399f4074e608af78041ffb68d8e11f33509e7f4521791bd29898f523f1e5bc3d33ea9c1e24fbf91492834eac1f5f0de193b5fcf260d0e279c103a0212e26ce599aba30a5679f696b3c8be6d990cdf8d4507d8cf53bafdabd902be122be30f7199cb2a97a77c415e95a4707a1fefc93c2f4959dc1be57f23d866863f10bf3946539a459f63a84231b1bd68ae0bb105d9596b351f1de6e7a0856260603d8591bd0afd2cab88f2207b4657cd24f13e8acc67dcbdb48621ca834fa71b952bf1d6d8f13c86d2c805a0d3144391a427d3f9397ed0a0aab98eeb03af8d02469c6975471690b9aac2aa66fa84126e0fec51589e92965ec2cd51bb7434d4bbd380c7b471513e95dbb29d664334a4e9eea5fce2e0612a7efc4c92e2b28733f67a684560c80153b8db3b58deb965f906ff62eb8c844f223c625ba3284da91d7c3828aaf74096c34f4dd21feaeab5218edf40404ffb36320b2992c890ff3851dcf36cef320d689856031d03b81d5aa4cdfe02ba3ea2e805f0a94e1da061c4367f83f4146d0cdfbb7edfc7085a18730557adba73f04b4376c32462df2846841835836ce593f95995ded262c3a1b07fa78a7d3696b2d9f929f51098f45df6434308dc5756aaeb1283e50982e886583d3ca3a88be67cc017c5c5415af443f174d89a2d7e528b1da17f9622356214d3bc6630737518af8283b4893a69354b7884264a91092593f994594503339530fa630327dd84ba70f298cf784fcf775cc627f8382f19cde01bf8bf86ba9e2a3b5b35e4fca4307762b072aa6e840c6614c6086517640378f2998fa3f3be0d22a53a3eca48ad74d8a3d1fc68212c95793ee3cbac78502834752a215b7033676b1ec49c4ce10cf98f10ba83441463cf7a3702034f6f79c4c6ad1eb7a2377d6c4c0fef2e902303539e09ef645cd3a512c7f873dc751fdf9f2fc1428c4e0413cdd15c18f472000378b73547a15a8f3ca146fcabf14d4478760aca9995fec2e59447ce8ad29bccc723c1692fd201986e674025c051914bd13fccfbda14a021ae7906c03cbef9bd1afea80a5858911ff62a332e992dd29a51c1d1296852e3ff997be10dc8efc5f25271951db867959f51ab7ac30500867fbc850b076f31e2c1d5e557c7035cb540da320ec5cc7c9b6f8d9ebe4c13a3bdbfb59ae535481d99abf8782b05b2bf213ddc58e1e96ef78f4c8a86128944bd9cb5a40036c72e46fb83f6a55184c70a598c88d2779f509ac3a3b3c87f687de4717adf9738284df2a0c0d4dfe211971b961a5d242cf3e7c78c703d4694b77674868259d47f6d98370be05f6546df548d6212ca13abcc23e17db5340b4a369e057703e1c8218f3af09cc2bf422407f1f8ae2c74b2c520a2f6ec856d9b2f052db7dee84f09165a5dd2285949c1dccb55d5c0e65abed00eff442ca829f59fd1e8bee09f1608a9070a5a74aa1e4fdaeb7d3eefa52d50133c1bd5fd5b56da5aa566eff7923694897cd4993b3951783f67a58e1b5bf6a8eacd54cbd4056d783d66a78a6fbbea63c72f8500e6b437b3e0bb88c2126b22f2485d8519d593bfa85b12ac6b314f8a5837f5a80fed96c508abf43c65f0767477aecd58a6d86b4015682e507a1f55fa3040fce30ebdb89f2c957514c43ec7c0a5d49f03af2c300f839dd3dde3b065884ffc81ebc606630c7a4ad0efcb629284bc07ea8b74dde0d0ed551750dd407c2e0ffff8adc9f5ac6664ff9c413daf76f55bfff3ce2f6e42b46924af19ac20c363c1237ef6e9a638d008400e159701c7e40a2a4dd782c604faf92f9c2404fd15ed27918f02770d6bad1be9368619a47ca3ddd287f9d4946d2674c4aeae68ec8fa3fa69570f3ba6bbaf5ef11192ea3b87c788dfeba2f8f9bb18d62d1720fb89c6ed0e6d6e0d8578f7b6a9be9a9529b55e7e2ce15e47ca16fadc7d79fa1b7592ea814af06d87f2d9c515db0554325425f24ce9fe559c7d77958ab606cd12f5b365b83cfcbc1388f7f3898ee4a4d0320b5dc0c781bba0159e272298736fc0bfcae9d063cc64e12ab2ebc6f515b56388c6acb927a9e7d37fe0f05ea3ca684966184bd25a6ed089cc27eaf06c75b18236e5079f491eec7af3057a39a0f8bc6db31705573f02ea498bb90f16e213b4dfa7b3699382adcab7c211871353d52c8a437ce749b648ccb77473b5c5885ac31d03ab4b514dc3b96d1d8d8afedd2aa228107df7984604c78fae1efecedb85601ba4da810cb85cdc78c0f901db34414e5c94527eab446da3873dd19de757eca923cd95d88c3913f7b5a3fa8321904a9e65f8e0e90c7901e1580865985972a73149ec3f2ce7014ca47eb483a231a2bebfb16e098ab05a8f402d87477bdb798c7f107a4712968fd2816da40e59274963289eb8bfbfa03404c6a9337d6bb2f8052ac363ac78542bab829f64f973ed4820a8c088008226ae6841bf99f194331514a8ade86958f39ae0b25f2d047314f5034ce962415927cff1337b067de7bdbf7dbe3e54521f09f4aeda7e3c64e87327872aa40ef90345b898c487b26b9a0b3415b58f25d33a2f0f49baa43c87eca15677fcecc7f3b66e2b792242d2fdc6623e35a3bae6c1e6bf76d549a289e5bdbbbf69bb40b35b294438b2bcce910ae74eaae3cbd17f95152b1b93e96f6377d86eb3d63a78b4ec97c147bbaac0bec39042a2cf16717e9575d3ee28027f252a2fd2ed1205c3b84be75ccbb14d6e157d0dfec7f6b945f0275dba12af36ea98d6ee02b2207e0dc1579172820debafcd79c1135eda186b10a2091370d6efcc92d5c031e8f4a735a53ceae9f042e4bc95576139e26c0085efcfa980dfaa7d2eafb0d95f2872033e07f0b54f0aab9b8dc3493e606d335c51c5ce8a86990d9de052c2f30c5fe9568c8347431930091304fac5685e748c6e9af60348657322b3dca90ab5b850a21cb45b92b57c71b9826bb272146130006529d23bf3220f328f08b10cd9c8