- Description
- openwrt/asu is an image on demand server for OpenWrt based distributions. The request hashing mechanism truncates SHA-256 hashes to only 12 characters. This significantly reduces entropy, making it feasible for an attacker to generate collisions. By exploiting this, a previously built malicious image can be served in place of a legitimate one, allowing the attacker to "poison" the artifact cache and deliver compromised images to unsuspecting users. This can be combined with other attacks, such as a command injection in Imagebuilder that allows malicious users to inject arbitrary commands into the build process, resulting in the production of malicious firmware images signed with the legitimate build key. This has been patched with 920c8a1.
- Source
- security-advisories@github.com
- NVD status
- Received
CVSS 4.0
- Type
- Secondary
- Base score
- 9.3
- Impact score
- -
- Exploitability score
- -
- Vector string
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Severity
- CRITICAL
- security-advisories@github.com
- CWE-328
Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.
- Hype score
1
🚨Alert🚨CVE-2024-54143: Critical Vulnerability in OpenWrt’s Attended SysUpgrade Server Allows for Firmware Poisoning 📊 1.7m+ Services are found on https://t.co/ysWb28BTvF yearly. 🔗Hunter Link: https://t.co/tRxcsKerHB 👇Query HUNTER:/product.name="OpenWrt(X-Wrt) Router" SHODAN:
@HunterMapping
11 Dec 2024
2824 Impressions
17 Retweets
50 Likes
12 Bookmarks
0 Replies
0 Quotes
OpenWrt orders router firmware updates after supply chain attack scare: https://t.co/hZW8iYDy9k OpenWrt has urged users to upgrade their firmware following a reported supply chain attack risk. A command injection vulnerability in the attended sysupgrade server (CVE-2024-54143)…
@securityRSS
10 Dec 2024
19 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
OpenWrt项目团队于12月6日发布安全公告，披露了其固件升级存在严重安全漏洞(CVE-2024-54143)。该漏洞由日本Flatt Security公司安全研究员RyotaK发现并报告。… https://t.co/wCVYTWdQVJ
@Nuwaempress
10 Dec 2024
28 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
⚠️⚠️ CVE-2024-54143: Critical Vulnerability in OpenWrt’s Attended SysUpgrade Server Allows for Firmware Poisoning 🎯484k+ Results are found on the https://t.co/pb16tGYaKe nearly year. 🔗FOFA Link:https://t.co/DGTyN46gtr FOFA Query:app="OpenWrt" 🔖 Refer:… https://t.co/S5M94gr
@fofabot
10 Dec 2024
1025 Impressions
9 Retweets
17 Likes
0 Bookmarks
0 Replies
0 Quotes
🚨🚨CVE-2024-54143 (CVSS: 9.3) : Openwrt/Asu Allows Build Artifact Poisoning Via Truncated SHA-256 Hash and Command Injection ⚠️This vulnerability could allow attackers to compromise the integrity of firmware updates delivered through its Attended SysUpgrade server. ZoomEye… htt
@zoomeye_team
10 Dec 2024
437 Impressions
2 Retweets
2 Likes
3 Bookmarks
0 Replies
0 Quotes
OpenWrt固件升级服务器发现严重安全漏洞，官方已紧急修复，建议大家迅速升级 OpenWrt项目团队于12月6日发布安全公告，披露了其固件升级存在严重安全漏洞(CVE-2024-54143)。该漏洞由日本Flatt Security公司安全研究员RyotaK发现并报告。… https://t.co/of7DvBrm0C
@srtg000bot
10 Dec 2024
44 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
shelling out in python via magical fairy dust "containers" isn't a great look - CVE-2024-54143 https://t.co/KwZJwwoZFq
@nanovms
9 Dec 2024
242 Impressions
0 Retweets
2 Likes
0 Bookmarks
0 Replies
0 Quotes
Security Advisory 2024-12-06-1 - OpenWrt Attended SysUpgrade server: Build artifact poisoning via truncated SHA-256 hash and command injection (CVE-2024-54143) https://t.co/2j4QRkchUO
@musashino_205
7 Dec 2024
231 Impressions
2 Retweets
2 Likes
0 Bookmarks
1 Reply
0 Quotes
CVE-2024-54143 OpenWrt Image Cache Poisoning Exploit via Hash Collision The openwrt/asu is an on-demand server for OpenWrt distributions. Its request hashing cuts SHA-256 hashes to 12 characters. This lowers secu... https://t.co/haRlMzagHV
@VulmonFeeds
6 Dec 2024
14 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2024-54143 openwrt/asu is an image on demand server for OpenWrt based distributions. The request hashing mechanism truncates SHA-256 hashes to only 12 characters. This significa… https://t.co/oMDU7MEbea
@CVEnew
6 Dec 2024
274 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[CVE-2024-54143: CRITICAL] Warning: Cybersecurity vulnerability in OpenWrt! Exploiting truncated SHA-256 hashes could allow attackers to serve compromised images to users. Patch available with 920c8a1.#cybersecurity,#vulnerability https://t.co/EUnPPr7keZ https://t.co/oOtmmLiwq5
@CveFindCom
6 Dec 2024
42 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes