I-O DATA UD-LT1 LTE routers contain three critical vulnerabilities under active…

I-O DATA UD-LT1 LTE routers contain three critical vulnerabilities under active exploitation, requiring immediate firmware updates to version 2.2.0.

Japan's IPA has issued an urgent security alert regarding multiple vulnerabilities in I-O DATA Corporation's UD-LT1 and UD-LT1/EX hybrid LTE routers. The devices contain three distinct vulnerabilities: improper access privilege assignment (CVE-2024-45841), OS command injection (CVE-2024-47133), and an undocumented feature (CVE-2024-52564). These flaws enable attackers to steal authentication credentials, execute arbitrary OS commands, disable firewalls, and modify device configurations.

The advisory emphasizes that active exploitation of these vulnerabilities has already been confirmed in the wild, making this a time-sensitive threat. All firmware versions 2.1.9 and earlier are affected by CVE-2024-45841 and CVE-2024-47133, while versions 2.1.8 and earlier are vulnerable to CVE-2024-52564. The vendor released firmware version 2.2.0 on December 18, 2024, which addresses all three vulnerabilities.

Organizations using these devices should prioritize immediate patching given the confirmed exploitation activity. The combination of command injection capabilities and the ability to disable security controls makes these routers attractive targets for initial access operations, particularly in small-to-medium business environments that commonly deploy such equipment for internet connectivity.

Source reporting: https://www.ipa.go.jp/security/security-alert/2024/20241204-jvn.html