I-O DATA UD-LT1 routers patched for critical exploited flaws
I-O DATA UD-LT1 LTE routers contain three critical vulnerabilities under active exploitation, requiring immediate firmware updates to version 2.2.0.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 3 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
Japan's IPA has issued an urgent security alert regarding multiple vulnerabilities in I-O DATA Corporation's UD-LT1 and UD-LT1/EX hybrid LTE routers. The devices contain three distinct vulnerabilities: improper access privilege assignment (CVE-2024-45841), OS command injection (CVE-2024-47133), and an undocumented feature (CVE-2024-52564). These flaws enable attackers to steal authentication credentials, execute arbitrary OS commands, disable firewalls, and modify device configurations.
The advisory emphasizes that active exploitation of these vulnerabilities has already been confirmed in the wild, making this a time-sensitive threat. All firmware versions 2.1.9 and earlier are affected by CVE-2024-45841 and CVE-2024-47133, while versions 2.1.8 and earlier are vulnerable to CVE-2024-52564. The vendor released firmware version 2.2.0 on December 18, 2024, which addresses all three vulnerabilities.
Organizations using these devices should prioritize immediate patching given the confirmed exploitation activity. The combination of command injection capabilities and the ability to disable security controls makes these routers attractive targets for initial access operations, particularly in small-to-medium business environments that commonly deploy such equipment for internet connectivity.
Mentioned in this report
Source reporting: https://www.ipa.go.jp/security/security-alert/2024/20241204-jvn.html
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs