A security vulnerability in the Wi-Fi Test Suite could allow unauthenticated local attackers to execute arbitrary code with elevated privileges on specific routers, potentially compromising network security.
The CERT Coordination Center (CERT/CC) reported the flaw, identified as CVE-2024-41992, which affects Wi-Fi Alliance software found in certain Arcadyan FMIMG51AX000J router models.
"This flaw allows an unauthenticated local attacker to exploit the Wi-Fi Test Suite by sending specially crafted packets, enabling the execution of arbitrary commands with root privileges on the affected routers," CERT/CC stated in its advisory issued Wednesday.
The Wi-Fi Test Suite, developed by the Wi-Fi Alliance, is a testing platform used to automate the testing of Wi-Fi components and devices. While its open-source elements are publicly accessible, the full toolkit is available only to Wi-Fi Alliance members.
According to SSD Secure Disclosure, which shared details of the vulnerability in August 2024, the flaw results from a command injection vulnerability that could enable a threat actor to gain root access. The vulnerability was initially reported to the Wi-Fi Alliance in April 2024.
An independent researcher known as "fj016" is credited with uncovering and reporting this security flaw. The researcher has also released a proof-of-concept (PoC) exploit demonstrating how the flaw could be used.
CERT/CC emphasized that the Wi-Fi Test Suite was not designed for use in production environments, yet it has been found in commercial router setups.
"An attacker who successfully exploits this vulnerability can gain full administrative control over the affected device," CERT/CC explained.
This elevated access allows attackers to modify system configurations, disrupt network services, or even reset the device, leading to potential service disruptions, data compromise, and a loss of network services for users.
As there is currently no patch available from Arcadyan, CERT/CC advises other vendors who have implemented the Wi-Fi Test Suite to remove it from production devices or update to version 9.0 or later to reduce the risk.
