ProSoft RLX-IFH24E v2.2.44 industrial wireless radio installs and executes code submitted over its management interface without performing any signature, hash, or CRC check. The vulnerability exists in the firmware upgrade mechanism which accepts unsigned firmware packages and executes them with root privileges. The upload handler at /cgi-bin/tool_reprogramming.cgi processes multipart/form-data POST requests without validating the uploaded file's integrity or authenticity. The /sbin/upgrade script dispatches on file extension (.pkg, .passwd, .factory) supplied by the client, allowing execution of arbitrary code. The only gate before code execution is an equality test comparing PRODUCT_NAME against LOCK_NAME, both of which are controlled by the attacker within the package itself, providing no actual assurance.
| Vendor | Product | Versions |
|---|---|---|
| prosoft technology | rlx-ifh24e | 2.2.44 |
Loading…
