Unauthenticated RCE in Motorola MR2600: Full Disclosure

A security researcher has published a detailed write-up of an unauthenticated remote code execution (RCE) vulnerability in the Motorola MR2600 Wi-Fi 5 router. The last firmware update (v1.0.22) was released in mid-2024, and the device is now end-of-life with no active update mechanism. The researcher found that both the firmware upload and validation endpoints lack proper authentication, allowing an attacker on the LAN (or WAN if remote management is enabled) to flash a malicious firmware image.

Firmware Upload Bypass

The router exposes a fwupload endpoint at POST /WEBCGI1/prog.fcgi?method=/cgi-bin/fwupload.cgi. The developers attempted to validate that the uploaded file is a valid SEAMA image by checking the first four bytes for the magic bytes 0x27 0x05 0x19 0x56. However, the validation is applied to the raw multipart form data instead of the extracted file field. This means a legitimate upload would always fail because the multipart boundary prefix (----) doesn't match the magic bytes. An attacker can bypass this by sending the raw firmware image without any multipart encoding. The file is written to /tmp/firmware.img before any authentication check, and the check itself does not delete the file on failure.

Authentication Bypass for Flashing

The second step triggers the flash via a SOAP request to POST /WEBCGI1/ with the action LoadFirmwareValidation. This endpoint is supposed to require authentication, but the access control logic is flawed. The code checks allowlisted paths via substring match and denylisted paths via exact match. By appending an allowlisted string (e.g., ?Login.html) to the URI, the request passes the allowlist check while the denylist exact match fails. The final request becomes POST /WEBCGI1/?Login.html, which bypasses authentication entirely.

Exploit Chain

• Upload a malicious firmware image to fwupload.cgi without multipart boundaries.
• Send the LoadFirmwareValidation SOAP request with the authentication bypass.
• The router validates the SEAMA image and CRC32 (no cryptographic signing required).
• The firmware is flashed via mtd_write, and the router reboots with the attacker's code.

Impact and Disclosure

At minimum, any attacker on the LAN can exploit this. If remote management is enabled, it's exploitable from the WAN as well. Shodan currently shows 41 exposed MR2600 routers. The researcher attempted responsible disclosure but was bounced between Motorola Mobility and Motorola Solutions, with neither claiming ownership of the product. Given the end-of-life status and broken update infrastructure (the update endpoint now points to a telecom SaaS company), the researcher opted for full public disclosure. No bug bounty was paid.