A critical vulnerability (CVE-2024-54143) in OpenWrt’s Attended Sysupgrade feature, used to create custom firmware images, could have been exploited to distribute malicious firmware packages.

What Is OpenWrt?

OpenWrt is a popular, highly customizable Linux-based operating system for embedded devices, especially routers and IoT hardware. It supports devices from major brands like ASUS, D-Link, Belkin, and many others, offering advanced features and greater flexibility compared to stock firmware.

The Vulnerability

Flatt Security researcher RyotaK discovered the issue during a routine home lab upgrade. The flaw, rated critical with a CVSS v4 score of 9.3, was found in OpenWrt’s Attended Sysupgrade (ASU) service. This feature simplifies upgrading devices by preserving packages and settings during firmware updates.

Two Main Issues Identified:

1. 
   

   Command Injection via Package Names:

   
   
   
   
   • The sysupgrade.openwrt.org service processes inputs through commands in a containerized environment.
   
   
   • Improper handling of the make command allowed arbitrary command injection via manipulated package names.
   
   
   
   


2. 
   

   Hash Truncation Vulnerability:

   
   
   
   
   • The service uses a 12-character truncated SHA-256 hash (48 bits) for caching build artifacts.
   
   
   • This makes brute-forcing collisions feasible, enabling attackers to reuse cache keys from legitimate firmware builds.