CVE-2024-46873CWE-489

Multiple SHARP routers leave the hidden debug function enabled

Critical · published December 23, 2024

CVSS v3.0
9.8
EPSS
1%
Percentile
54.0
In the wild
Unconfirmed
What it is

🔥 A hidden debug function in multiple SHARP routers is leaving the door wide open for attackers! Think of it as a hotel where the maintenance staff forgot to lock the service entrance — anyone can walk in and mess with the entire system without a reservation! An attacker could remotely execute arbitrary OS commands with root privileges, potentially taking complete control of the router. This means they could intercept traffic, modify configurations, or even launch further attacks on connected devices. It’s absolutely devastating if exploited!

Put simply

Think of it as a hotel where the maintenance staff forgot to lock the service entrance — anyone can walk in and mess with the entire system without a reservation! This vulnerability stems from the debug feature being left enabled, allowing unauthenticated users to run OS commands as the root user on affected SHARP routers. This critical oversight creates a pathway for serious exploitation without any authentication checks in place.

What to do

An attacker could remotely execute arbitrary OS commands with root privileges, potentially taking complete control of the router. This means they could intercept traffic, modify configurations, or even launch further attacks on connected devices. It’s absolutely devastating if exploited! To secure your environment, disable the debug function on all SHARP routers immediately. Make sure to apply any firmware updates provided by the manufacturer. Regularly review your router configurations to ensure similar features are not inadvertently left open. You've got this! Follow these steps, and you’ll be one step closer to locking down your network. 🛡️

The record
Technical detail
CVSS v3.0
9.8 · CRITICAL
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00737 · 54.0th percentile
Weakness
CWE-489 · Active Debug Code
Published
2024-12-23T00:17Z
EPSS history
Timeline
  • 23 DEC 00:17Z
    Multiple SHARP routers leave the hidden debug function enabled
    cvelistv5