AI
Broken Authentication and Command Injection on 5G Routers
On a Tuoshi 5G router the web interface accepted username=admin as valid authentication. An NTP server parameter was piped directly into a shell command without sanitization. Warren sent a crafted request that triggered a reverse shell and obtained root access. The root password was DES-hashed (admin!.2). The device remained reachable over the WAN despite being marketed as LAN-only. This pre-auth RCE required no binary exploitation.
Goform SDK: A Systematic Source of Vulnerabilities
Warren searched the MITRE CVE database for the string “goform” and found 743 results initially. By July 1 the count hit 912. The goform web form SDK, common in Realtek and Ralink chipsets, appeared across TP-Link, D-Link, and other vendors. The same command injection code existed in 4G Tuoshi devices but lacked an exposed NTP field. Other parameters still allowed pre-auth RCE. Warren demonstrated logging into a 4G device without credentials and executing commands. The pattern of unsanitized input passed to shell was universal across that manufacturer.
Arbitrary SMS and Information Disclosure on Kufi Devices
Kufi 4G routers built on Android exposed a goform endpoint that granted admin privileges without authentication. Warren used AT commands via that endpoint to send arbitrary SMS messages, even though the prepaid SIM was marketed as no-SMS. He also showed information disclosure that revealed admin passwords. The 5G Kufi device (Snapdragon X62, about $400) had similar broken access control. Warren could force SMS and read credentials on that device without obtaining a root shell. The goform pattern persisted.
Notable Quotes
username equals admin is enough to authenticate. Completely broken access control Edward Warren · ▶ 7:33
when I first did this I got about 743 results. This is just you know go form appearing in like the URL or or affiliated and then you know as of July 1st I searched again. We’re up to 912 Edward Warren · ▶ 6:00
the Wi-Fi parameter was command injection and that gives me pre rce Edward Warren · ▶ 18:17
Key Takeaways
- Pre-auth RCE via command injection in the NTP parameter on Tuoshi 5G routers.
- Goform SDK accounts for over 900 CVEs across multiple router vendors.
- Kufi routers allow arbitrary SMS via unprotected AT command endpoints.
About the Speaker(s)
Edward Warren is an Information Security Analyst and Independent Security Researcher specializing in IoT and mobile application security. Over the past few years he has discovered critical (CVSS) 0-day vulnerabilities. He earned a Hall of Fame acknowledgement from the Google Play Security Reward Program (GPSRP) and attribution in numerous CVE publications. He has presented his work at conferences such as BSides and ShmooCon.