Motorola MR2600 Routers Vulnerable to Unauthenticated Firmware Takeover
A critical vulnerability in Motorola MR2600 Wi-Fi routers allows unauthenticated local attackers to execute arbitrary code by uploading a malicious firmware image, potentially leading to full network compromise.
Researchers have uncovered a severe vulnerability in Motorola's MR2600 Wi-Fi routers that permits unauthenticated attackers on the local network to gain complete code execution. The exploit targets the router's firmware update process, allowing for the installation of custom, malicious firmware without requiring any login credentials.
The vulnerability, detailed by researcher MrBruh, resides in the router's handling of firmware uploads and validation. The MR2600 is designed to accept firmware in the SEAMA format and performs checks on the file's header. However, the firmware upload handler incorrectly validates the entire HTTP multipart request instead of focusing solely on the uploaded file itself. This allows an attacker to bypass initial checks by submitting the raw firmware image directly within the request.
Even though the router performs an authentication check after the upload, it occurs too late in the process. By this point, the malicious firmware image has already been saved to a temporary location on the device. Crucially, the router fails to delete the file if the subsequent authentication check fails, leaving the malicious image vulnerable to the next stage of the attack.
The second part of the exploit targets the router's firmware validation SOAP endpoint. This endpoint is intended to be protected and require authentication before validating and flashing new firmware. However, inconsistent URL matching rules allow attackers to bypass this protection. By appending an allowlisted page name as a URL parameter, an attacker can trick the router into treating a protected request as publicly accessible.
Once authentication is bypassed, the attacker can trigger the firmware validation function. The device checks the SEAMA image structure and CRC32 checksum, but it does not enforce cryptographic signing of the firmware. This means a carefully crafted malicious image can pass these checks, leading the router to flash the attacker-controlled firmware.
Upon rebooting with the compromised firmware, the router begins executing attacker-provided code. This grants persistent code execution capabilities, enabling attackers to modify network settings, intercept and monitor network traffic, deploy malware onto the network, or use the compromised router as a pivot point for further lateral movement within the network.
The exploit is particularly concerning as it can be launched by an unauthenticated attacker on the local network. Furthermore, if remote management is enabled on the MR2600, the vulnerability could potentially be exploited over the internet. Shodan scans have reportedly identified MR2600 routers with remote administration enabled publicly accessible online.
Motorola's MR2600 is reportedly end-of-life, and attempts to report the vulnerability to Motorola Mobility and Motorola Solutions resulted in confusion, with each division reportedly directing the researcher to the other. Users of affected devices are strongly advised to disable remote management immediately, restrict administrative access to trusted networks only, and consider replacing these routers with supported hardware to mitigate the risk.