Netis WF-2404 Cleartext Storage Vulnerability in BusyBox Shell

A vulnerability exists in the Netis WF-2404 router running firmware version 1.1.124EN. This vulnerability involves an undisclosed feature of the BusyBox Shell component, leading to the cleartext storage of sensitive information. The issue can be exploited locally on the device, and while the attack's complexity is considered high, a public exploit is available. The vulnerability was disclosed to the vendor, but no response was received.

Impact

Exploitation of this vulnerability allows for the cleartext storage of sensitive information, such as passwords, which could be accessed by unauthorized parties.

Reproduction

The vulnerability can be reproduced by gaining physical access to the router and connecting UART probes. Once connected, the 'flash set' command can be used to change default user credentials, which are then stored in cleartext. After rebooting the device, the new credentials remain active, demonstrating the vulnerability's impact.