CVE-2024-8693

Vulnerability

Analysis

A stored cross-site scripting (XSS) vulnerability exists in Kaon CG3000 routers (firmware version 1.01.43) used by Claro in Brazil. The root cause is that the router's operating system fails to sanitize hostname data received via DHCP. The flaw is triggered through the dhcpcd command handler: by manipulating the -h argument with a payload like ``, an attacker can inject arbitrary JavaScript into the router's management interface [1].

Exploitation

To exploit the vulnerability, an attacker must be able to send crafted DHCP requests containing a malicious hostname. The injected script is stored and executed the next time an authenticated administrator logs into the router's web interface, specifically on the first page displayed after authentication. This means the attack requires prior network access (e.g., connecting to the router's LAN or Wi-Fi) but no additional user interaction beyond the administrator's normal login [1].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the router's administrative session. This could be used to steal session cookies, modify router settings, or perform actions as the authenticated admin, potentially leading to further compromise of the network or devices connected to the router [1].

Mitigation

As of publication, the vendor was contacted but did not respond, and no patch or official advisory has been released [1]. Because the router model may be end-of-life, users are advised to monitor for unauthorized DHCP clients, restrict administrative access to trusted networks, and consider upgrading to a supported device if available.