安全研究
CVE-2024-41992 Arcadyan FMIMG51AX000J RCE：ISP 路由器供应链漏洞
Thinking
2024-08-06
2 分钟阅读
研究档案
#漏洞分析#代码审计#网络攻击
Arcadyan FMIMG51AX000J 路由器固件（用于 WiFi Alliance 认证设备）存在 RCE 漏洞，CVSS 9.8，影响全球 ISP 部署的大量家用网关设备。
Unlock to view this content.
ad8d9422966c73fee42096dad808c6448a272095349f41facc28f3d18d1ee66a0726fb5aaffd9271b6702e0ae53f6961031443030e63d37842b7356b4a67d1f44b648f709f84d99b1640e6f7a87a3d44129b61502fc0c5c728a88c67798e6cfb7bcb30fe880464fad1a2cf9635735fbd6e964b402ea4ed27e494f7c87c72f1c586b333a47062292625ea7240d146fb061f3975a6253d117e97272d7df5aa897fb9fe2c09034f658aae2645a68076992d7d9de07ae63e2fac88f85e475412988dfbc9237681ce83236a0cc05eab1afdba091f77cc220fdca61d79ab9fb426c4eafe981c47320de52c0c7d8314efd0e7a66dc601d2cd258244c780420ba161fcbdf32889256f3850c58712594526359874519c04645a60467ea01529b1dd6af351723747a13bd2b377d5e767471b685a54779c137a04d56c11227d852274caf1c463b227756ec4e114e75627069575b466502109688b7240132fdd8829f84b9e703b9a73f9b62b55cc2eb78c33bb848e98d6adf0b851624a2a1ee00e4309fffc1666599accb2148d59cc4fc77f1b172abe2d5262875bb65a8fa8d35102e554c4fb0b5b2be1fc1e2dda7f6e8023800fb23e81bcd4610f57af4b0bd484918973090d6a7f1bd9c67015761cf7eeac2e079fdd9b2a86d10b3b08ffe771db38d999cc267d2352b8cd65314e3538dd10f5885c0613ea89c681221ede103316ede3671209fc147a1924160dba9ae66e125dce3d0f63253f469ccde6425eba2495abf64a2b0e733427fecef9e3448635a90e7fd8d95954872d2bdb4a68219fb94a51fec2bf7838440da6cb8698eed8f905dc729846254ace4da7b0233b32befa87a9fcc745787c8f6b179689b2658b991c4f9f65e61f6332d4425b4a287f539affb89fd905182ac71fa630cda506dc90168b4ef54ed9deeb4087282779e4fbadfa3de0b9f0615374ef6d0ada781b3ff800131d7ed0bf6d9f4119713f2524277e3831ff5661ac483a90b362970ee65b95b39eab0d968b78873eb43ab4c8b1d74dbcd72a05b7d8b65e7a9db661fb84c55be05e1e844449d8651ea807c8934e9f611c5df09efac8d948e5fbea96e91bbb899b18ef64061240bda7d0c0d04576e0c8e0729dd30b2ab4e5fc0070a0a8e88449b627dd9abeeafc10e730b84b6db33a4ad5388418c9d7ca8e51107c0969a55cb4968a6c8b999e48ea9d067a173c863b016177abc4960c092a565cc912052e410a7a53fb95e59949670111936a3584d7db59c7967479c6851ce51e3218a10ec62c7efd296421a15e508f36ef85f3a7fcbc570ecab3d6752eefeb0a34df94981f2936c35b506093e4a2ba6a743ef269cb7293ef6268814275ee2b71b41e354c55328d892c7c5fb7b8b47f5fa0c5e8f15e2d55e6e148f1dc93b0a0e00fd0110fca961c61345884f01b6cf8e5afe6a1276b43e6d90a614ce1b09297222289c8e088bde3f5f7faf1d6e7fa218339d01984c71243478501b26bc4b65b92e31b8315707a3360dba957e3ff85470f4197d6c746acc98b629655abe6d3d58ce6ba223d938132fb068cbafcdf8546196df1bd459f4387424ea823bd328e9cde94af766c42d761dcac873b2a5679e1e9845f6d15eb263eb407da0f992e55a7482c092bb68e1a799fd860a4c181f7ceb08d41f62d12f71c8998b06d4defa810245b3d786a90c68e603c891713faae291520213e975b9176d0edbaba0176cb4c797cc066597ff50461999f3d3c9e2f781a6445a683741dd72dc84e21b48e7206fbf11ae52ef295b9bb788d5045d992f4dab3182df3725a8253546b75015fdc5ecda8685df94a3207828efe6d9db7efa86463b77c29c0429caecc70b018098cf4420f52d6064d22a8cc5e36aa312e4e3549973d84bd1b36cf25c9245402719a92518fa0662e92fe50ea4178a8ee713f814c9959a997cd52cb7b49612f87c1b62beacc2de505e633af89c01e48b6017f4f30b1e2e5f6b240b8ce966b44a3213b9b926e17092048191a5e0a56e216532cdc5bcbdc24a2bfb8fcdb42e4405efcf069c04ac78a1c802d7ee926f895b3a88bbbd85bb73833175a2f162082fd4c2262a811791c7177bbf9ab45337f796bc65b8a7400a61db9f20b1e5016a0638ed3ca58ced85f258fd594d76159ef3190c09a9feabc5d1f896f8dc07244ad9f9064f8131860e05f704add46e77cc185b78259ade8275609669f189d4a1848a98192e0ecd436d074db7d5084884b79c50e69b93dc3f1946c764d79e9516342432f378bf7d671564372566317e46d2f9b91ad59b5b1ec691dd193c2ed4d8a88674b84ff22f19ca5f952d2a3a2d0482572088999963796fb59ea04351c07c9d52ef0fe9b44f234994a73c16dcbd0cd6e04c604afcc6f43522d3b982430673e9d23e4eb20c2abe44c9099d33093ae44120040c0845b5e6b6c006e0cda4aff5e0e04750de418c76c0b5f3ec57cbea38f5bbde1c68e455b723d73930ead2315e166cca8375d6921bc97a4b353c54030e5aca5aefb82055e8270bfe435e7a253c92b6d1b381cf30bbfbc76f8439434f6f5e862e12495a9214a777e06c2876e2082a9f178ced6a51e76bfbb86bc41487de411a580d48044f1edf2089c75dfdaf9fe3a0d27bf9d1e1a53650d98fac5a28e6298826d9961184e25c336e8f83d084ec518acd9327102d3868328fd5a422a3a799962a1692c168f305b011cf553c86d6e12fe8ef30df31a0b3dfb01692e0cc0fb4c3fc87873cf33403c92e2455e30ba844b8e39cf709f471462f9946aeb6198a6e736a9650a15be1222dbf61b272cb1ee7812ef4302374cac83943ccc189ea55393a381c6d2e50c25c7c47be6bc767edfa9a77a7dd38008c94ab17d1c274c5fd5bf505f4736790ddb1cc0e0829ed1fd090da627f2008e70c6a841be0569a3412d45263280d0484bc795031b8af4bacc16b4cfbb844377f3daaf0649105310a1df1d8d524b85099a76fa1c1646240918aa4e602671800702d2d43c6505b8242511b97a3ec98da79336ab8d638c1788651e9ee2f95c785433486982c476f3918a0fdcf360e2b7d4ea4967a8b29262f6c400843a7fc7638a3daa71fa5342e244bed69739cc834b966a2a67b50b41ccc7cb0870d18d64ae21d227dd479e6bd385301d06c6e245acf7e149ab9461ac9f7531488bdd33cfc22dd6e0356b75d7e0c8736c43b143f0bb3400b8b34c5c71838af22d7b7035f3bd9eba0127198a218653935a68a3916160f7f11c74e304dea7b8baf98d9ec5eac56e2264c15f0b5befae48cbb7399130e35459a213307403e799ee988033c0abd753713a8afe36d504fb4eca4359ff70ca16e4a2643c84d9091a1fab98459942b5a5bc0ba385b1f2d7375c2ef1ae7128c91877af20eb4c58126eb78a11cc8b56577a219a964278435e655a4ad393c907308bba2d479b68251716bfc4d8b655a4fede25859c957cfef2726079ecd04f25a975d37d3d3c3b14ff27a47143a1a9669327378338606e24d67350dcc389078abd1a908cf1b1203ccc4c91dd1945d6b47e015bc71a1b31554af8233ff7e45b66c4b37c2153e9053c31563afac3e0abc107dec764901b05b8acf5cba19789993c3a52282f4697a2bb0e088f61807d3f66ba29a7e9a73beca0ddb7ba11bc3c7911dd51cf6d5621c00e3253ae3d4b0bc9851528c8c0c47e7ffe05e6e5edd274d9164afd39e55dc24520fcdc897f2b83fae2fa3d6827c73eaa4b21fa0cfa630c589a1f69249c1671d908910848abd81dc54e417c4bf3dd5b5d4be3919ac4263b77169088ec696c2b596b4266ac3ea33a2410fede7b9f4754d0174d0616000698c220882de6845268328085979f4430c20a40ae6bb4f6f5182c41796cf5c5365ee5d737256d9ec1cdb721533c79ba4a44167870fe27832ad583b0a74a2e26f6390affeec6b476d2db88e232cfb83c18311f461816f404b93af5a019345e1d5468162aa36a5b52f9c04ff7775a3f42a27424f3c41147a66b47efe13ec57ff8483565c486cf3f4e73eacc728ccccac41f26796cafc471ee6f21038679a949066f03ea188e1a951d5f06a9ee521586f7bbf8f43268835eece9d7c172c2030b774a134893e86feb4ed8dd1c0325df3d8f896733c5762a976ee1acc761c3bbf91eafb3bfcfba46f8151752f07d5e6087549d1629fcb8278120dc0e2ecb1ab524ad9fc45c2ecfa0886a0317cf001f212450703dfdab11b2f9af1dcd0f1a430c45c53c644a12d909e64725a63893fb6a7b94ed5e37b57e1535671365c667585081e645e65520cc0a20ec425b8e04ace164dac3cd0761627b87e3678aa4d2e6b637e1826a87f8c82fb952084047a2fa8eb9f3b5022c4c58c395f4307354ede58d6d989db3018c3c16450b492f514764236a976c0bcafb028a15decc078ef204630a34e3c2336d5177ec839349b53f5d5a910da8c1be5d88af35a3616d6046e65fb3bcde391a9169a4a086fca39c9b93b4886f6b2b992213763b16880583007d8741606fdaf0dc45457dadea0009aa00ff53ad0879b59241801c48d67f5e65024c02801d8d958a4273870b983914546dc620e9ca320d1371fce30556db72cb17403c35af65fa60523e5f148ab9dd848cdefa213a675becdd667c75f9eed4c9845ce92364c68c7fa3c40611dfcabc16d6a2fa07b42132497a3560029e947fc58c13d3612ab694521d4379026ff5b7c82b6f9d3b5b801960d223a2a2ab99e07881c086d82c6a2264990a030d5512b3407e1cbc84b925556f40a13fc32f5bc46d50f483f6ad380a74b4d7812962a7dac0ed5de01357f1e9d2c541b43d5aef67c60f466e45995f200bad6249aa4d82b2a95f509ff198fa1080edf30d4b8425b28259eb97ff5fbe8eae1451359a2b932b33307e1bbb9fa6a064d6ed60a9fa9a0c3b41b9b8939a16213ad16c3b07cb6040ec6804a3386403a1730bd8982a1f97294e34710c0ea54132d170385002686e4e48d4e21b099868b7e7862108e33d40de0922c2676c14a91ef7fcf6fdfbf4ea9ffc712862a48e0bb6d6269cfada94ec6996982dc4a80537c495fb611c5796b775ffb33a82daf2a83e585eac8c7342dad137427a946e4c1a7032e40216f5cdc3b85b2a25780e144e50394b246aafaf5303198e44b5ae7ee0c5b80216a643d6e6447c33daa4edf3f43e47fa7a2f7b1206dd7a02ece029a451ca1da2f214e2657246431c87896909971fd08e2b0de175f725d396e930f791c4cb5be83bcef06284ff7e8e38076ec81260956c77f1b3f58ceaa40ffc44b0b89fd46027fad614682026abcf16d65130c15b930772b662bd62d52c34328bcf7482855f54cb739599bc85eafa7312b08e3fa6e30f48c37e86fad220168c99532661819207ba9a760a42432c56632e727100ae92819df56990964049e0c088a9e40f36a27797bc20f340b199634fee240b7ccf87318003cabc43126545756a4ef03caedb98a2edf228a6354040368baa551bc0d0709f858d10cb44b03dc983a203b8f17d6f041eb2ea25829d221950f49125ec44c2ef8c372731055c30580db8580d9511bc860729e98bb6e2c813a5237987f635047f0fa2b2e3cd7be0ae300dfadddc8aec455d313196578e91b717f449098b12466b5afb1cb992dc1e248fe7a2d0f8496c1c1066aa876f3a33754cf7fe80c19473611df0b790d38bb5c2859b870f5d0e7c55b68a078e9dc6f036ac910c015d192507ea617ef0b561d984b343809bae0ea38b7142c88ab1d126140f9c3a1223311f0d5c8024b2cc32f4a413a905360cf825d0399b533d29cd692a287c9d171365e29be4c60b242eba881a2805cab2d7c20e2c85582c73834dc463e2415e51bd23634bd8d7d3b139a912261b3e64265fb447d49e1569414dc8d7788d9125e1d71a8c6f715310dae77b41c5d09c437fb4bbf134796578da9873dc79de27fa0ff12483db0541d6a1c9a9a3968e38f567dfb20a7e8bc3b2e28d318623b2293e0c4e3781b47e7da706b6c710221b202b5343a027b893e18dfba87404ca310ca03f67de0448fb4f7c6201ab79f5c19edee15e6232028c9601276dd842346877d77ee80a82e334bf0ce6bc211fe8319bdf51b4e28c9abadaed20a7aa487d102332092e1a76032fdeacb566e643b8e8052c4ce765d8a190e8f3dbe76972d9a9df050a27f2e7da3d1bbc7f02b51920133350c2b676ef7961facdb499723476558543b1bbce6adebd409a28b50f0c87fcba90214aa8cfcd53be91f493973439f8347b3cfeef1a2591f1b321afd03c213039ee5ce891e4ffb4023ca419c9ef21de4f78ae67379e07103f63446950b92b3caa357d4b0455ab642c090b173c4b6b9ad1436eac5dfd3fb4610e67a3235bcab9da311ade30df452554085e68fb0343a650e9884b6deff1afefaa51b2551ed301d018c4eea77672cffbf1673746b4230019649d53c2738a61a7ec121ddc076ad5bccc93460af13d3c47811f374956b429077d16178cffee47caca8fe77b80ebd79829cb2a2c0e6795dab11c41250d5bee40a04b74a88d1c2595412a2120c324affd63938d1600ab07529886a678238cbf9e3929b7ddecd70ffe6fb1cc922505b9b178afcbf5779717b765420c8a88682fc05e81299dfa90d29c1a04e48ff1819ead727cc564c92c6e015585a08fd616db34e4544ed3103f6f76b123444018c57ca545175c1be716273e41f8b0714e5656f05a36d3b81150224442ae39b3b850da1290ffb0ca0403067e51904f27a3dfd17b83ee33591ceaa1b634c52370c6ee97c09af4270cbd09218683605170b2e6a03e280e2389c450cf29d8b1f6d077ba32517773049d9f89ff7377c3be6178b07ce10b6da57814795a48b12b4ebb7a386379ef3088675aa38352c67b4e54cf092e89c6b865b6effaa85f130651d1df3d0105ad160db506f3d2ac9873bfee794664c739e3243de76766e6934cba579b87c0aa90afaa0a3af6154eb387b9edcfd823a86cda8fdeab4bf09516d4bd119eac2da20ebbf274d4e6bc03e23c2cd4c9cbe8c35a30113cee50ca1067817ab9ad883adbb92742c5286dbf6f2b07a8d936fa2e6a19fb1094521698db30ba32873ff155215bd8568468d5203d7a06cea364615f700efba189b3843810560c3d9a6605a8036688e49c4311406ff17fa83206228be79e55b399d93418d96d4cd000b57716138ee10af6a9c3a9de7ab097c3602a10ab81ad238174ff46ae3b5dd60461092d64168fa9c6babdfd152bb3694abb6be463d4eada997c2461fc1c73b48e81601d65573b6d212f592e716d12c98e28cbb02e73d76f610b2f07e1f9c4e32f3c50fd62171ce01277ace0bff593389f1ef6b9be099112ea97466a846a71a434e3cc25119c0c0b09a7f6923e1c99e027b5eeeff92ff1f269d80af55dd427587eab8df4ecc78f037805450f5e843d734a4a055abb23e9f9148a04c0aee04aa6531cdb03dc0e1d27844dc2804f2ec0984b2034df222ddcf907bd20ca79fbfc77e41c44e72441a1a7b126154abd1dee490234bbd1ea6e967cbf1e72d922805489e17ae85c4b96e7b7f6393d99c261e542d852845ac6e68c57e375e3505d77b8d2354378304d1bb6b983753d24f7dabf3f5bfda8309b7035b7f206977406da33cd596b3b7af4f32bee9a7b103a1b891036ddc9146d58924a96661631400f373de84d90ed4447b3c785636802540a4055a02eba59dfcd8434163107b7cec97466bf9c5c00d326e29254acd11899b9a78d71ba44570fbe664ddf02f502f883a2cc05f6a9853a7fab45cca554124886e9f0724068a6b86d53f5437e7563ed41ee8dcb741079fe8dfd8d9806c8d5985a4e35bd521302d1565fa313b5e475f2734e246465205ac9e93ceefb3f26e347139ca8212eef933c112e3a0bd5f971345f5d67e4fd8e07b3b796de713fe676e5