The vulnerable system is bound to a protocol stack, but the attack is limited at the protocol level to a logically adjacent topology. This can mean an attack must be launched from the same shared proximity (e.g., Bluetooth, NFC, or IEEE 802.11) or logical network (e.g., local IP subnet), or from within a secure or otherwise limited administrative domain (e.g., MPLS, secure VPN within an administrative network zone). One example of an Adjacent attack would be an ARP (IPv4) or neighbor discovery flood leading to a denial of service on the local LAN segment (e.g., CVE-2013-6014).
Attack Complexity
Low
AC
The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system.
Privileges Required
High
PR
The attacker requires privileges that provide significant (e.g., administrative) control over the vulnerable system allowing full access to the vulnerable system’s settings and files.
Scope
Unchanged
S
An exploited vulnerability can only affect resources managed by the same security authority. In the case of a vulnerability in a virtualized environment, an exploited vulnerability in one guest instance would not affect neighboring guest instances.
Confidentiality
High
C
There is total information disclosure, resulting in all data on the system being revealed to the attacker, or there is a possibility of the attacker gaining control over confidential data.
Integrity
High
I
There is a total compromise of system integrity. There is a complete loss of system protection, resulting in the attacker being able to modify any file on the target system.
Availability
High
A
There is a total shutdown of the affected resource. The attacker can deny access to the system or data, potentially causing significant loss to the organization.
Below is a copy: Realtek SDK Information Disclosure / Code Execution
MULTIPLE VULNERABILITIES IN SEVERAL SERIES OF
REALTEK SDK BASED ROUTERS (TOTOLINK AND MANY
OTHER)
Blazej Adamczyk (br0x)
[email protected]
https://sploit.tech/
11.12.2019
1 Sensitive data disclosure and incorrect access control in several series
of Realtek SDK based routers
CVE: CVE-2019-19822
SDK vendor: Realtek
Device vendor: TOTOLINK, Sapido, CIK Telecom, Fibergate Inc.,
MAX-C300N, T-BROAD and possibly others..
Product: Realtek SDK based routers backed by Boa HTTP server (and
possibly others) and using apmib library for memory management.
Boa Version: <= Boa/0.94.14rc21 SDK Version: < 2020/02/15
Description: Realtek SDK based routers which use form based instead
HTTP Basic authentication (that includes Realtek APMIB 0.11f and Boa
HTTP server 0.94.14rc21) allows remote attackers to retrieve the
configuration, including sensitive data (usernames and passwords).
This affects:
TOTOLINK A3002RU through 2.0.0,
TOTOLINK 702R through 2.1.3,
TOTOLINK N301RT through 2.1.6,
TOTOLINK N302R through 3.4.0,
TOTOLINK N300RT through 3.4.0,
TOTOLINK N200RE through 4.0.0,
TOTOLINK N150RT through 3.4.0, and
TOTOLINK N100RE through 3.4.0;
Rutek RTK 11N AP through 2019-12-12;
Sapido GR297n through 2019-12-12;
CIK TELECOM MESH ROUTER through 2019-12-12;
KCTVJEJU Wireless AP through 2019-12-12;
Fibergate FGN-R2 through 2019-12-12;
Hi-Wifi MAX-C300N through 2019-12-12;
HCN MAX-C300N through 2019-12-12;
T-broad GN-866ac through 2019-12-12;
Coship EMTA AP through 2019-12-12; and
IO-Data WN-AC1167R through 2019-12-12; and
possibly others.
Technical details: The apmib library at some point of initialization
dumps the whole memory contents the file /web/config.dat. This folder
is actually used by the boa http server as index directory.
Additionally if the router is configured for form-based authentication
the access control verifies credentials only for some URLs but ".dat"
files are not restricted. This issue does not affect routers which use
HTTP Basic authentication to secure all URLs.
PoC:
$ curl http://routerip/config.dat
2 Password stored in plaintext in Realtek SDK based routers
CVE: CVE-2019-19823
SDK vendor: Realtek
Device vendor: TOTOLINK, Sapido, CIK Telecom, Fibergate Inc.,
MAX-C300N, T-BROAD and possibly others..
Product: Realtek SDK based routers backed by Boa HTTP server (and
possibly others) and using apmib library for memory management.
Boa Version: <= Boa/0.94.14rc21 SDK Version: < 2020/02/15
Description: Realtek SDK based routers (that includes Realtek APMIB
0.11f and Boa HTTP server 0.94.14rc21) store passwords in plaintext.
This affects:
TOTOLINK A3002RU through 2.0.0,
TOTOLINK 702R through 2.1.3,
TOTOLINK N301RT through 2.1.6,
TOTOLINK N302R through 3.4.0,
TOTOLINK N300RT through 3.4.0,
TOTOLINK N200RE through 4.0.0,
TOTOLINK N150RT through 3.4.0, and
TOTOLINK N100RE through 3.4.0;
Rutek RTK 11N AP through 2019-12-12;
Sapido GR297n through 2019-12-12;
CIK TELECOM MESH ROUTER through 2019-12-12;
KCTVJEJU Wireless AP through 2019-12-12;
Fibergate FGN-R2 through 2019-12-12;
Hi-Wifi MAX-C300N through 2019-12-12;
HCN MAX-C300N through 2019-12-12;
T-broad GN-866ac through 2019-12-12;
Coship EMTA AP through 2019-12-12; and
IO-Data WN-AC1167R through 2019-12-12; and
possibly others.
Technical details: Data stored in memory in COMPCS (apmib library)
format contains device administration and other passwords in
plaintext. The apmib library additionally at some point of
initialization dumps the whole memory contents the file
/web/config.dat which might be used to easily retrieve user passwords.
3 Code execution in several TOTOLINK routers
CVE: CVE-2019-19824
Vendor: TOTOLINK
Product: TOTOLINK Realtek SDK based routers
Boa Version: <= Boa/0.94.14rc21
Description: On several Realted SDK based TOTOLINK routers, an
authenticated attacker may execute arbitrary OS commands via the
sysCmd parameter to the boafrm/formSysCmd URI, even if the GUI
(syscmd.htm) is not available. This allows for full control over the
device's internals.
This affects:
A3002RU through 2.0.0,
A702R through 2.1.3,
N301RT through 2.1.6,
N302R through 3.4.0,
N300RT through 3.4.0,
N200RE through 4.0.0,
N150RT through 3.4.0,
N100RE through 3.4.0, and
possibly others.
PoC:
$ curl 'http://routerip/boafrm/formSysCmd' --user "admin:password"
--data 'submit-url=%2Fsyscmd.htm&sysCmdselect=5&sysCmdselects=0&
save_apply=Run+Command&sysCmd=cp%20%2Fetc%2Fpasswd%20%2Fweb%2Fxxxx.dat'
4 Incorrectly implemented captcha protection in TOTOLINK routers
CVE: CVE-2019-19825
Vendor: TOTOLINK
Product: TOTOLINK Realtek SDK based routers
Boa Version: <= Boa/0.94.14rc21
Description: Guessable captcha vulnerability (CWE-804) in several
series of TOTOLINK routers allows a remote attacker to automatically
login to the router without reading and providing real captcha.
The following command returns captcha in plain text:
$ curl 'http://routerip/boafrm/formLogin' --data '{"topicurl":"setting/getSanvas"}'
Additionally by using the HTTP Basic in a HEADER the attacker can
execute router actions without providing captcha at all.
This affects:
A3002RU through 2.0.0,
A702R through 2.1.3,
N301RT through 2.1.6,
N302R through 3.4.0,
N300RT through 3.4.0,
N200RE through 4.0.0,
N150RT through 3.4.0,
N100RE through 3.4.0, and
possibly others.
5 Exploiting all together on TOTOLINK routers
CVSS v3 socre: 9.6 AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (assuming
Administrative Access on WAN is enabled the score is 10.0)
Exploiting all the vulnerabilities together allows a remote
unauthenticated attacker to execute any code with root permissions and
reveal administration password.
The only thing that is needed is the access to router administration
interface (either access to local network or Administrative Access on
WAN enabled)
Description, video and possibly an exploit:
https://sploit.tech/2019/12/16/Realtek-TOTOLINK.html
Timeline:
17.12.2019 - Contacted all identified vendors, i.e. TOTOLINK, CIK
Telecom, Sapido, Fibergate and Coship.
18.12.2019 - received TOTOLINK first line support response totally
not related to my message and showing me how to log into my router.
I responded right away and asked to forward the message to
technical/security team.
19.12.2019 - received response from CIK Telecom stating that the
routers support encryption (SIC!). I replied asking to forward the
message to technical/security team.
19.12.20219 - CIK Telecom responded that for further assistance I
should contact them over the phone. I replied that I need to explain
the details as a written message as this is technical.
27.12.2019, 06.01.2020 - I resent the messages to TOTOLINK and CIK
Telecom but none have replied till the date of disclosure.
06.01.2020 - I finally contacted Realtek as the Supplier of the SDK.
10.01.2020 - I got a response and I replied with encrypted details
on the bugs.
14-15.01.2020 - Realtek replied that the issue with dumping
configuration by apmib exists but it is not directly exploitable in
the defualt SDK configuration becuase it uses HTTP Basic
authentication which protects all URLs. They agreed however that
most of the Vendors modify the software including authentication
mechanism thus making it vulnerable.
23.01.2020 - Realtek responded that they are goining to fix the
issue with dumping configuration to the config.dat file in version
released on 15.02.2020. They also said that after fixing the issue
the impact of storing password in plaintext is less significant thus
they will not fix the CVE-2019-19823 yet but will try to fix it in
the future.
Temporary workaround: Unfortunately I did not get any good information
from real vendors like TOTOLINK and for now I would suggest to disable
administration interface from WAN and restricting LAN router
administration interface access using some kind of firewall if
possible.
Credit: Blazej Adamczyk | [email protected] | http://sploit.tech/
This information is provided for TESTING and LEGAL RESEARCH purposes only. All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use and Privacy Policy and Impressum