MC LR Router and GoCast unpatched vulnerabilities
Summary: Cisco Talos discovered two OS command injection vulnerabilities in MC Technologies' MC-LR Router and three in the GoCast service, none patched at the time of posting. The router flaws (CVE-2024-28025 through CVE-2024-28027, and CVE-2024-21786) are reachable through the web interface's I/O configuration and uploaded configuration file import, all triggerable with an authenticated HTTP request, while GoCast's unauthenticated HTTP API for registering and deregistering apps (CVE-2024-21855) enables exploitation of CVE-2024-28892 and CVE-2024-29224 for OS command injection and arbitrary command execution.
What you should know: GoCast's API lets anyone register or deregister apps without authentication, and that gap is the path to arbitrary command execution on a tool used for anycast load balancing across regions. The router flaws need only an authenticated HTTP request, so a single set of valid credentials reaches command injection on the device.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2024-21786CVE-2024-21855CVE-2024-28025CVE-2024-28027CVE-2024-28892CVE-2024-29224
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026