ProSoft RLX-IFH24E v2.2.44 accepts unsigned firmware to root
Original title: [0day-rubbish] ProSoft Technology RLX-IFH24E v2.2.44 unsigned firmware upgrade package to root command execution and full account-database overwrite (7.2)
An unsigned upgrade package can run root commands and overwrite the full account database; rated 7.2.
0day Rubbish Research Team publicly disclosed a flaw in ProSoft Technology RLX-IFH24E version v2.2.44, a US industrial wireless radio. An unsigned firmware upgrade package can lead to root command execution and a full overwrite of the account database. The device is described as a closed-source OEM of the MicroHard Systems IPx21 platform on Linux 2.4.24-uc0. The snippet states no CVE, patch, or confirmed attacks.
Unconfirmed: The snippet does not state whether the upgrade requires authentication, a CVE, or a fix.
- The stated severity figure is 7.2.
- Hardware is an Intel IXP425 XScale, ARM big-endian, MHX-910 board.
- Static management pages live under /usr/web.
- Posted to Full Disclosure on October 20.
Impact: Unsigned firmware yields root and overwrites the account database
| Product | Affected |
|---|---|
| ProSoft Technology RLX-IFH24E | v2.2.44 |
- Vendors
- ProSoft Technology
- Products
- RLX-IFH24E
- Organizations
- 0day Rubbish Research TeamMicroHard Systems
- Countries
- United States
From the original article
Posted by disclosure via Fulldisclosure on Oct 20 0day Rubbish Research Team is publicly disclosing a vulnerability in the ProSoft RLX-IFH24E, version v2. 2. 44, the industrial wireless radio from ProSoft Technology, Inc.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.