CVE-2024-22729

What it actually does

The vulnerability is an unauthenticated OS command injection flaw in NETIS SYSTEMS MW5360 firmware version V1.0.1.3031. The login page passes the supplied password parameter into a command context without sufficient sanitization, allowing an attacker to inject shell metacharacters and arbitrary operating-system commands. Because the device is network-accessible, requires no authentication, and exploitation can provide full confidentiality, integrity, and availability impact, successful exploitation can lead to remote command execution on the router appliance.

Why it matters to the business

A compromised router can allow attackers to take control of network traffic, disrupt connectivity, change DNS or firewall settings, pivot into internal networks, or enroll the device into botnets for scanning, proxying, or denial-of-service activity. The high CVSS score, high EPSS probability, and weaponized exploit maturity make this an urgent internet-edge risk even though it is not currently listed in CISA KEV. Organizations using affected NETIS MW5360 devices should treat exposed management interfaces as high-priority remediation targets.

How an attack unfolds

An attacker scans for NETIS MW5360 devices with the web management interface reachable over the network. The attacker sends a crafted login request to the device login page where the password parameter contains shell metacharacters followed by attacker-controlled commands. The firmware processes the password value insecurely and executes the injected command on the underlying operating system. Initial commands commonly validate execution, retrieve system details, or download a payload using built-in utilities such as wget, curl, tftp, or busybox. Once code execution is confirmed, the attacker may establish persistence where possible, alter router configuration, redirect DNS, open remote access, proxy traffic, or deploy botnet malware. Because exploitation is unauthenticated and weaponized, opportunistic mass exploitation against exposed devices is plausible.

How to fix it

Upgrade to a vendor-provided firmware release that explicitly fixes this command injection issue if one is available. No fixed version was provided in the supplied vulnerability data, so organizations should check NETIS SYSTEMS support channels for updated MW5360 firmware and apply it as soon as available. If no fixed firmware exists, reduce exposure immediately: disable remote administration from the internet, restrict the management interface to a trusted management network or specific administrator IP addresses, place the device behind a firewall or VPN, change administrative credentials after mitigation, and consider replacing affected devices that cannot be patched. Rebooting alone is not sufficient if configuration changes or malware persistence occurred.

How to confirm the fix worked

Confirm the device model and firmware version through the administrative interface or device inventory and verify whether it is NETIS MW5360 firmware V1.0.1.3031. Validate that the management interface is not reachable from untrusted networks or the public internet using external scanning from a non-trusted network. After firmware update or replacement, confirm the installed firmware version is newer than the vulnerable release or is explicitly documented by the vendor as fixed. Review firewall and ACL rules to ensure only authorized management sources can access the web interface. Where safe and authorized, perform a controlled validation using a benign command-injection test against the password parameter and confirm that shell metacharacters are rejected, escaped, or do not result in command execution.

Typical attack path

1. Scan the internet or local network for NETIS MW5360 web management interfaces.
2. Fingerprint the firmware or login page to identify potentially vulnerable MW5360 V1.0.1.3031 devices.
3. Submit a crafted login request with command-injection syntax in the password parameter.
4. Execute a simple command to confirm remote command execution, such as id, uname, or a DNS/HTTP callback.
5. Download or stage additional tooling using wget, curl, tftp, busybox, or similar utilities available on embedded Linux devices.
6. Modify router settings, deploy malware, create a reverse shell, proxy traffic, or enroll the device in a botnet.
7. Use the compromised router as a foothold for traffic interception, lateral scanning, or continued external access.

How to detect it

Review web management access logs, firewall logs, reverse proxy logs if the interface is proxied, IDS/IPS alerts, DNS logs, NetFlow, and outbound connection telemetry for evidence of crafted login attempts and post-exploitation activity. Focus on HTTP requests to the router login page where the password parameter contains shell metacharacters such as semicolons, pipes, backticks, dollar-parentheses command substitution, URL-encoded equivalents, or common embedded Linux commands. Look for failed or unusual login attempts followed by outbound connections from the router to unfamiliar hosts, especially HTTP, HTTPS, TFTP, Telnet, SSH, or high-volume scanning traffic. On the device, if shell or diagnostic access is available, inspect running processes, startup scripts, cron entries, temporary directories, DNS settings, port-forwarding rules, firewall rules, and newly modified configuration files. Because weaponized exploitation is reported, treat any exposed vulnerable device with suspicious outbound traffic as potentially compromised even if local logs are sparse.

• password=*;*
• password=*%3B*
• password=*|*
• password=*%7C*
• password=*`*
• password=*%60*
• password=*$(*)*
• password=*%24%28*
• password=*wget*
• password=*curl*
• password=*tftp*
• password=*busybox*
• password=*nc%20*
• password=*netcat*
• password=*telnetd*
• password=*/bin/sh*
• password=*/bin/busybox*
• password=*chmod%20%2Bx*
• password=*uname%20-a*
• password=*id%3B*
• /tmp/*
• /var/tmp/*
• /dev/shm/*
• wget http://
• curl http://
• tftp -g
• busybox wget
• /bin/sh -c
• telnetd -p

What your security team should do

• Immediately inventory NETIS MW5360 devices and identify any running firmware V1.0.1.3031.
• Prioritize devices with management interfaces exposed to the internet or untrusted networks.
• Disable internet-facing remote administration and restrict management access to trusted IPs or VPN-only access.
• Check vendor sources for fixed firmware; if no fix is available, plan replacement or isolation of affected devices.
• Review router configuration for unauthorized DNS, port forwarding, firewall, user, or remote-management changes.
• Hunt for signs of exploitation, especially login requests containing shell metacharacters in the password parameter and follow-on downloads using wget, curl, tftp, or busybox.
• Rotate administrative credentials after patching or isolating the device, especially if exposure existed before remediation.
• Monitor affected network segments for outbound connections from routers to unfamiliar IPs, command-and-control infrastructure, or high-volume scanning behavior.