CVE-2023-29711

What it actually does

CVE-2023-29711 is a network-exploitable remote code execution vulnerability in Interlink PSG-5124 firmware version 1.0.4 caused by incorrect access control in the device web interface. An unauthenticated attacker can send a crafted HTTP GET request to the device and cause arbitrary commands or code to execute in the context of the vulnerable firmware process. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, exploitation requires no credentials or user interaction and can result in full compromise of confidentiality, integrity, and availability of the device.

Why it matters to the business

Successful exploitation can allow an attacker to take control of affected Interlink PSG-5124 devices, alter configurations, disrupt service, pivot into adjacent networks, deploy malware, or use the device as part of a botnet. The vulnerability has a critical CVSS score of 9.8, a high EPSS likelihood of 0.70308, and public exploit availability, which materially increases the risk for internet-facing or broadly reachable management interfaces. Although it is not currently listed in CISA KEV and is not known from the provided data to be used in ransomware campaigns, the age of the vulnerability and available exploit code make unpatched deployments high-risk.

How an attack unfolds

An attacker first identifies an exposed Interlink PSG-5124 device, typically by scanning for its web management interface or fingerprinting banners, login pages, HTTP headers, or device-specific responses. If the device is running vulnerable firmware version 1.0.4 and the affected interface is reachable, the attacker sends a specially crafted HTTP GET request that reaches the vulnerable access-control path. Because the affected function does not correctly enforce authorization, the request is processed without valid authentication and attacker-controlled input can result in arbitrary code execution. The attacker can then run commands on the embedded system, modify device settings, download additional tooling, establish persistence where possible, proxy traffic through the device, or use it to attack internal systems reachable from the device’s network position.

How to fix it

Identify all Interlink PSG-5124 devices and determine firmware versions. Devices running firmware version 1.0.4 should be treated as vulnerable. No fixed version was provided in the supplied advisory data, so organizations should check Interlink support channels for updated firmware or vendor mitigation guidance. If no vendor fix is available, reduce exposure immediately: remove the management interface from the internet, restrict access to trusted administrative networks or VPNs, enforce network ACLs and firewall rules, disable unnecessary remote management, and place the device behind monitoring controls. Where patching or adequate isolation is not possible, plan replacement, retirement, or compensating segmentation. After remediation, rotate any credentials or shared secrets that may have been stored on or transited through the device if compromise is suspected.

How to confirm the fix worked

Confirm whether any PSG-5124 devices remain on firmware version 1.0.4 and whether their web management interfaces are reachable from untrusted networks. Validate external exposure using approved asset discovery or port scanning from outside the trusted network, and validate internal reachability from representative network segments. Review vendor release notes or device administration pages to confirm whether an updated firmware version has been installed if one is available. Test that only authorized management networks can reach HTTP/HTTPS management ports and that unsolicited access attempts are blocked. Where safe and authorized, use a non-destructive vulnerability scanner or vendor-provided validation method to confirm the device no longer accepts the crafted unauthenticated GET behavior. Also verify logging and alerting are enabled for administrative access attempts and suspicious request patterns.

Typical attack path

1. Scan public or internal address ranges for exposed Interlink PSG-5124 web management interfaces.
2. Fingerprint discovered devices to identify PSG-5124 firmware, especially version 1.0.4.
3. Send a crafted unauthenticated HTTP GET request to the vulnerable interface.
4. Execute arbitrary commands or code under the privileges of the vulnerable firmware process.
5. Retrieve system information, configuration data, credentials, or network details from the device.
6. Deploy follow-on tooling, alter configuration, create persistence where supported, or use the device as a pivot point.
7. Cover tracks by clearing or rotating device logs if the platform permits it.

How to detect it

To determine whether exploitation has already occurred, review logs from the PSG-5124 device, upstream firewalls, reverse proxies, web gateways, packet captures, NetFlow, and any network detection platforms monitoring the management interface. Focus on unauthenticated or failed-authentication HTTP GET requests containing shell metacharacters, URL-encoded command separators, references to system shells, file download utilities, or attempts to write to temporary directories. Look for bursts of probing followed by outbound connections from the device to unfamiliar hosts, especially HTTP, HTTPS, TCP high ports, IRC-like traffic, or repeated beaconing. On the device, inspect available administrative audit logs, configuration change history, unexpected user or service changes, modified startup scripts, unknown binaries in writable directories, and signs of log clearing. Because no exact vulnerable URI was provided, detections should combine PSG-5124 targeting context with suspicious command-execution patterns rather than rely on a single path. If threat hunting finds suspicious requests followed by abnormal outbound traffic or configuration changes, treat the device as potentially compromised and preserve evidence before reimaging or replacing it.

• GET /
• ;wget
• |wget
• %3Bwget
• %7Cwget
• ;curl
• |curl
• %3Bcurl
• %7Ccurl
• /bin/sh
• /bin/busybox
• busybox wget
• `wget
• $(wget
• ; chmod +x
• %3Bchmod%20%2Bx
• /tmp/
• /var/tmp/
• /dev/tcp/
• nc -e
• netcat -e

What your security team should do

• Immediately inventory Interlink PSG-5124 devices and prioritize any running firmware version 1.0.4.
• Treat internet-facing PSG-5124 management interfaces as urgent remediation targets because public exploit code exists and EPSS indicates high exploitation likelihood.
• Remove direct internet exposure for PSG-5124 administration interfaces and restrict management access to trusted networks or VPNs.
• Check with the vendor for firmware updates or official mitigations; if no fix is available, isolate, replace, or retire affected devices.
• Review web access logs, device logs, firewall logs, proxy logs, NetFlow, and EDR/NDR telemetry for evidence of suspicious GET requests and post-exploitation behavior.
• Hunt for outbound connections from affected devices to unfamiliar IP addresses, especially downloads, reverse shells, or command-and-control style traffic.
• If exploitation is suspected, preserve logs, capture volatile evidence where possible, rotate credentials associated with the device, and rebuild or replace the device from trusted firmware.
• Add detection rules for command-injection patterns in HTTP GET requests targeting PSG-5124 management interfaces.
• Continuously monitor exposed-asset inventories to ensure PSG-5124 management ports do not reappear on public networks.