VORANT. Threat Intelligence Sign in Get the full feed

I-O DATA routers under active exploit

high vulnerability

Three vulnerabilities in I-O DATA UD-LT1 hybrid LTE routers are being actively exploited to steal credentials, execute commands, and disable firewalls.

Japan's IPA has issued an alert for three actively exploited vulnerabilities affecting I-O DATA Corporation's UD-LT1 and UD-LT1/EX hybrid LTE routers. The flaws include improper access control (CVE-2024-45841), OS command injection (CVE-2024-47133), and an undocumented feature (CVE-2024-52564). Exploitation enables attackers to steal authentication credentials, execute arbitrary OS commands, disable firewall protections, and modify device configurations.

All three vulnerabilities are confirmed under active exploitation in the wild, prompting IPA to emphasize urgent patching. CVE-2024-52564 carries a CVSS score of 7.5, CVE-2024-47133 scores 7.2, and CVE-2024-45841 scores 6.5. Firmware versions 2.1.9 and earlier are affected by the access control and command injection flaws, while version 2.1.8 and earlier are vulnerable to the undocumented feature issue.

I-O DATA has released firmware version 2.2.0 for both UD-LT1 and UD-LT1/EX models to address CVE-2024-45841 and CVE-2024-47133, with version 2.1.9 remediating CVE-2024-52564. Organizations using these devices should immediately update firmware and review device configurations. The advisory was updated December 18, 2024 with expanded affected version details.

Mentioned in this report

Vulnerabilities CVE-2024-45841CVE-2024-47133CVE-2024-52564

Detection guidance

Shell Spawned by Router Web Management Process (Possible OS Command Injection)

ATT&CK T1059

Detects a shell or system utility being spawned as a child of the device's web management/CGI daemon, consistent with exploitation of OS command injection flaws such as CVE-2024-47133 in I-O DATA routers. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Shell Spawned by Router Web Management Process
id: 43a8f17e-e295-527a-8029-79b1cd8d6221
status: experimental
description: Detects a shell or system binary spawned by an HTTP/CGI management daemon
  process on embedded Linux network devices, which is consistent with exploitation
  of OS command injection vulnerabilities (e.g. CVE-2024-47133) affecting I-O DATA
  UD-LT1 routers.
references:
- https://www.ipa.go.jp/
author: Vorant
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|contains:
    - httpd
    - lighttpd
    - boa
    - cgi
    - uhttpd
    Image|endswith:
    - /sh
    - /bash
    - /busybox
    - /telnetd
    - /nc
  filter:
    CommandLine|contains:
    - logrotate
    - healthcheck
  condition: selection and not filter
falsepositives:
- Legitimate CGI scripts that intentionally shell out for device status or diagnostic
  scripts
- Vendor firmware update or maintenance scripts invoked through the web UI
level: high
tags:
- attack.t1059
- attack.execution

Firewall Rule Flush or Disable via Command Injection on Network Device

ATT&CK T1562.004

Detects iptables/firewall management commands executed by a web management or CGI process, indicating an attacker disabling firewall protections after exploiting a command injection or access-control flaw on the router. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Firewall Rule Flush or Disable via Command Injection on Network Device
id: 491dd05b-7b4a-57c1-9fbb-a3e63cb6c79a
status: experimental
description: Detects firewall management commands (iptables/nftables/ufw) invoked
  by a web/CGI daemon process on an embedded Linux router, consistent with attackers
  disabling firewall protections after exploiting access-control or command injection
  vulnerabilities such as those in I-O DATA UD-LT1 devices.
references:
- https://www.ipa.go.jp/
author: Vorant
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
    - httpd
    - lighttpd
    - boa
    - cgi
    - uhttpd
  selection_cmd:
    CommandLine|contains:
    - iptables -F
    - iptables -X
    - iptables --flush
    - nft flush ruleset
    - ufw disable
    - service iptables stop
    - /etc/init.d/firewall stop
  condition: selection_parent and selection_cmd
falsepositives:
- Legitimate firmware update or reset-to-defaults scripts triggered from the admin
  UI
- Scheduled maintenance tasks that reload firewall rules through the same daemon
level: high
tags:
- attack.t1562.004
- attack.defense_evasion

Administrative Interface Authentication from External/WAN Context on Embedded Router

ATT&CK T1078

Detects successful authentication to the router's administrative interface originating from the WAN-facing network context rather than the expected LAN management network, consistent with credential theft/reuse enabled by CVE-2024-45841 improper access control. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Administrative Authentication from Unexpected Network Context on Router
id: 30d370c6-86e3-593a-96d9-f1f5009da261
status: experimental
description: Detects successful logins to the router's web management interface from
  an external/WAN-facing source rather than the internal LAN management segment, which
  can indicate abuse of stolen or default credentials following exploitation of improper
  access control flaws (e.g. CVE-2024-45841) on I-O DATA UD-LT1 devices.
references:
- https://www.ipa.go.jp/
author: Vorant
logsource:
  category: authentication
  product: linux
detection:
  selection:
    EventType: authentication_success
    LogonType: network
  filter_internal:
    SourceIp|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
  condition: selection and not filter_internal
falsepositives:
- Remote management intentionally enabled by the administrator through a VPN or port-forward
  for support purposes
- Cloud-based device management platforms authenticating from vendor infrastructure
  IP ranges
level: medium
tags:
- attack.t1078
- attack.initial_access
- attack.persistence

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/security/security-alert/2024/20241204-jvn.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free