KeeneticOS CRLF Injection Vulnerability in the Authentication API Endpoint

A CRLF injection vulnerability has been identified in KeeneticOS versions prior to 4.3, specifically at the '/auth' API endpoint. This vulnerability allows remote attackers to manipulate HTTP headers and inject unauthorized commands. Exploitation involves adding new administrative users, thereby gaining control of the affected device. The attack requires the victim to open a specially crafted page.

Impact

Exploitation of this vulnerability could lead to unauthorized user management actions, allowing attackers to gain administrative control over the device.

Remediation

Users are advised to upgrade to KeeneticOS 4.3, which addresses this vulnerability. Firmware updates can be applied through the device's web interface or the Keenetic mobile app.