Genexis Platinum P4410 Router Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in the Genexis Platinum P4410 router, specifically in firmware version P4410-V2-1.41. This vulnerability allows a local network attacker to execute commands with root privileges. The issue arises from improper session management, as the session token remains valid even after an administrator logs out. An attacker on the same local network can exploit this by reusing the stale token to send crafted requests through the router's diagnostic endpoint, leading to unauthorized command execution as root.

Impact

Exploitation of this vulnerability allows for full control of the router with root access, enabling interception of network traffic and potential persistent compromise until the device is rebooted.