CVE-2007-5384 in SpeedTouch 7G router
Summary
by MITRE
Multiple cross-site request forgery (CSRF) vulnerabilities in the Thomson/Alcatel SpeedTouch 7G router, as used for the BT Home Hub 6.2.6.B and earlier, allow remote attackers to perform actions as administrators via unspecified POST requests, as demonstrated by enabling an inbound remote-assistance HTTPS session on TCP port 51003. NOTE: an authentication bypass can be leveraged to exploit this in the absence of an existing administrative session. NOTE: SpeedTouch 780 might also be affected by some of these issues.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/29/2017
The CVE-2007-5384 vulnerability represents a critical cross-site request forgery flaw in Thomson/Alcatel SpeedTouch 7G routers, specifically affecting BT Home Hub versions 6.2.6.B and earlier. This vulnerability operates at the application layer and exploits the router's insufficient validation of HTTP requests, allowing remote attackers to execute unauthorized administrative actions. The flaw manifests through unspecified POST requests that can be crafted to manipulate the router's configuration without proper authentication, fundamentally compromising the device's security posture.
The technical implementation of this CSRF vulnerability stems from the router's failure to implement proper request origin validation or anti-CSRF tokens in its web administration interface. When an administrator visits a malicious website or clicks on a compromised link, the attacker can construct a POST request that automatically executes against the vulnerable router's administration interface. The specific demonstrated attack vector involves enabling an inbound remote-assistance HTTPS session on TCP port 51003, which creates an unauthorized backdoor access point. This attack can be executed without requiring the administrator to be actively logged into the router's interface, making it particularly dangerous as it can be exploited passively.
The operational impact of this vulnerability extends far beyond the single demonstrated attack vector, as it fundamentally undermines the router's administrative security model. An attacker can leverage this vulnerability to gain complete control over the router's configuration, potentially enabling port forwarding, modifying firewall rules, changing administrator credentials, or establishing persistent access through the remote assistance feature. The vulnerability's severity is amplified by the fact that authentication bypass capabilities can be combined with CSRF exploitation, allowing attackers to operate without needing to know valid administrative credentials. This represents a classic case of insufficient session management and cross-site request forgery controls, which aligns with CWE-352 and ATT&CK technique T1071.004 for application layer protocol manipulation.
The exploitation of CVE-2007-5384 demonstrates a critical flaw in embedded device security that was prevalent in consumer-grade networking equipment during that era. The vulnerability affects not only the mentioned BT Home Hub versions but also potentially the SpeedTouch 780 model, indicating a widespread issue within the product line. Network administrators and security professionals should recognize this as a foundational weakness in legacy router implementations that lacked proper CSRF protection mechanisms. The vulnerability's persistence across multiple firmware versions highlights the importance of proper input validation and request authentication in embedded systems, particularly those with web-based management interfaces. Mitigation strategies should include immediate firmware updates where available, network segmentation to isolate critical devices, and implementation of additional access controls to prevent unauthorized configuration changes. This vulnerability serves as a historical example of how consumer networking equipment often lacks the security rigor found in enterprise-grade systems, making it a prime target for exploitation in broader network compromise scenarios.