Pre-Auth RCE, Arbitrary SMS & Adjacent Attacks on 5G and 4G/LTE Routers

Pre-Auth RCE, Arbitrary SMS & Adjacent Attacks on 5G and 4G/LTE Routers

Speakers: Edward Warren

Conference: DEF CON 33

YouTube: https://www.youtube.com/watch?v=Rxx07Ubmcuc

Slides: https://media.defcon.org/DEF%20CON%2033/DEF%20CON%2033%20presentations/Edward%20Warren%20-%20Hacking%20Hotspots%20Pre-Auth%20Remote%20Code%20Execution%2C%20Arbitrary%20SMS%20%26%20Adjacent%20Attacks%20on%205G%20and%204GLTE%20Routers.pdf

Overview

Edward Warren, a senior cybersecurity analyst who conducted this research while working at a security operations center, presents a series of vulnerabilities in Tuoshi and Cufi branded 5G and 4G/LTE mobile hotspot routers — consumer and prosumer devices widely used for connectivity where fixed broadband is unavailable. The vulnerabilities range from unauthenticated pre-auth remote code execution (RCE) through the device's web management interface to the ability to send arbitrary SMS messages from any device sharing the affected router's cellular number. Warren demonstrates that devices positioned as connectivity infrastructure carry significant security debt, and that the same research methodology that uncovered these issues is applicable to a wide class of similar IoT routers.

Background

▶ Watch: In this case he specifically highlights insecure API endpoints. (2:07)

Mobile hotspot routers — compact devices that share a cellular connection over Wi-Fi — are pervasive in enterprise field deployments, critical infrastructure, event venues, and everyday consumer use. Their threat model is often underestimated: because they function as routers rather than endpoints, they are frequently excluded from endpoint security scanning, patch management, and vulnerability assessment programs.

Warren developed his research methodology during work at a security operations center (SOC) at Sedara, where analyzing IoT and Android devices gave him a foundation in the specific vulnerabilities common to embedded networking hardware. His research into Tuoshi and Cufi devices emerged from that background — picking devices that were representative of a broad class of LTE/5G routers with shared firmware lineages and web UI patterns.

The research covers two distinct device families but finds similar vulnerability classes across both, suggesting that the underlying issues are endemic to the platform rather than isolated to specific hardware revisions.

Key Findings

▶ Watch: vulnerability using the using an AT command. (3:51)

Pre-authentication remote code execution on the web management interface. The most severe finding is an RCE vulnerability accessible without any credentials. An attacker on the local network — or in some configurations, from the internet if the management interface is exposed — can execute arbitrary commands on the router's underlying Linux system without supplying a username or password.

Arbitrary SMS injection. The routers support SMS functionality as part of their cellular modem integration. Warren discovers that the SMS interface is accessible without authentication and without sufficient input validation, allowing an attacker to send arbitrary SMS messages that appear to originate from the router's SIM-associated phone number. This creates a significant social engineering and fraud vector: spoofed SMS from a trusted or legitimate number.

Adjacent vulnerabilities in configuration endpoints. Beyond the primary RCE and SMS findings, Warren documents a cluster of adjacent vulnerabilities including unauthenticated access to device configuration, information disclosure that exposes network credentials and device state, and persistent change of sensitive settings without authentication.

Shared firmware ancestry increases affected device count. Because Tuoshi and Cufi devices share firmware components — as is common in the ODM/OEM model prevalent in consumer networking hardware — the vulnerabilities may affect a broader set of devices than just the two named brands. Warren identifies characteristic patterns in the web interface and API structure that are shared across product lines.

Disclosure and vendor response. Warren discusses the disclosure process, the challenges of reaching vendors for devices in this market segment, and the state of patching at the time of the talk.

Technical Deep Dive

▶ Watch: So we're going to move forward to the the the ger disassembly. (6:31)

Attack surface enumeration. Warren's methodology starts with standard web application reconnaissance against the router's management interface: mapping all HTTP endpoints, analyzing the API structure, identifying which endpoints require authentication tokens versus which are accessible without them. He uses a combination of manual browsing, Burp Suite interception, and firmware analysis to build a complete picture.

Firmware extraction and analysis. The research involves obtaining the device firmware, extracting the filesystem (commonly squashfs on these devices), and statically analyzing the web server and CGI/API binaries. This allows identification of authentication-check code paths and, critically, code paths where authentication checks are absent or bypassable.

Pre-auth RCE mechanics. The unauthenticated RCE is rooted in a web API endpoint that accepts user-supplied data and passes it — with insufficient sanitization — to a shell command or system call. Command injection via parameter values in the API request allows execution of arbitrary shell commands. Because the web server runs as root (a common pattern in embedded router firmware), the command injection immediately provides root-level access to the underlying Linux system.

SMS injection mechanism. The router's SMS functionality is exposed through a CGI endpoint that communicates with the cellular modem via AT commands. The endpoint accepts the destination number and message body from the HTTP request. Insufficient validation allows an attacker to inject arbitrary AT command sequences, including commands that send SMS messages from the modem. Because the modem's SIM number is the outgoing caller ID, recipients see SMS from the router's registered phone number.

Impact of SMS injection. Warren discusses the downstream exploitation potential: an attacker who can send arbitrary SMS from a known, trusted number can conduct targeted social engineering against the organization or individuals associated with that SIM. In enterprise deployments where the router's number is a registered business line, the spoofing value is significant.

Network persistence. Following pre-auth RCE, Warren demonstrates establishing persistence on the device — adding backdoor accounts, modifying startup scripts in the flash filesystem — that survives router reboots and may survive certain factory reset procedures depending on the flash partition layout.

Multi-device scanning. Because the vulnerable endpoint is consistent across the Tuoshi/Cufi product line and potentially across OEM variants, Warren discusses how an adversary could scan for exposed management interfaces to identify and mass-exploit affected devices. In deployments where management interfaces are accessible from the internet (inadvertently or by design), this becomes a network-scale concern.

Demo / Proof of Concept

▶ Watch: Let's uh let's move forward to the next demo here. (10:27)

Warren includes live demonstrations against the physical router hardware:

1. Pre-auth RCE demo: A crafted HTTP request — no authentication cookies or tokens — is sent to the vulnerable API endpoint. The demo shows command output returned from the router (e.g., the contents of /etc/passwd or the output of id), confirming unauthenticated root command execution.

1. Arbitrary SMS demo: A request to the SMS CGI endpoint sends a text message from the router's phone number to a target phone. The demo phone receives the SMS with the router's number as the sender, illustrating the spoofing capability.

1. Persistence demo: Post-RCE, Warren shows how an attacker could write a backdoor to the router's flash filesystem, demonstrating that the compromise survives reboot.

The demos use hardware purchased and tested in a lab environment. Warren confirms devices are running stock/unmodified firmware to validate that the vulnerabilities exist in factory state.

Defensive Implications

▶ Watch: Uh, I'm not going to bore you guys with this whole demo because I'm kin (13:18)

Disable remote management interfaces. If the router's web management interface does not need to be accessible from the WAN or from untrusted network segments, it should be firewalled or disabled. Many organizations deploy these devices and leave management accessible from all interfaces.

Network segmentation. Mobile hotspot routers should be on isolated network segments, not directly on corporate LAN infrastructure. This limits an attacker's lateral movement options even if the router itself is compromised.

Firmware updates. Vendors who have issued patches should be applied immediately. Given the ODM firmware sharing patterns Warren identifies, organizations should check whether their specific hardware variant is covered by available patches.

Inventory IoT devices in patch management. Routers and IoT devices are frequently excluded from vulnerability scanning and patch management workflows. This research illustrates why that exclusion is a risk. Asset inventory should include all network-connected devices, and patch management should have a workflow for embedded firmware.

Treat SMS from these devices as untrusted. If an organization's operations depend on SMS alerts or communications associated with a SIM in a vulnerable router, those communications should be treated as potentially spoofable until the device is patched or replaced.

Apply zero-trust principles to connectivity infrastructure. The implicit trust that "the router is part of our infrastructure and therefore trusted" is dangerous when the router itself can be compromised without authentication. Network access policies should not grant elevated trust based on traffic originating from router interfaces.

Key Takeaways

1. Tuoshi and Cufi 5G/4G LTE routers contain a pre-authentication remote code execution vulnerability in their web management interfaces, providing unauthenticated root access to the underlying Linux system.
2. A second vulnerability allows arbitrary SMS injection via the router's cellular modem, enabling an attacker to send messages that appear to originate from the router's registered phone number.
3. Adjacent vulnerabilities include unauthenticated configuration access, information disclosure, and the ability to establish persistent backdoors.
4. Shared firmware ancestry across ODM product lines means the affected device population is likely larger than the two named brands.
5. The research methodology — web interface mapping, firmware extraction, and API analysis — is generalizable to a wide class of consumer and prosumer mobile routers.
6. Defensive controls center on access restriction, network segmentation, and inclusion of embedded devices in patch management workflows.

About the Speaker(s)

▶ Watch: uh via via binary exploitation here. (15:20)

Edward Warren is a senior cybersecurity analyst at a Fortune 500 company. He conducted the research presented in this talk during his time as an information security analyst at Sedara, where SOC work gave him the foundation for deep-dive IoT and Android device analysis. DEF CON 33 is his first DEF CON appearance; he has previously presented at BSides events on Android inter-app collusion and related topics.