CVE-2016-1228 in PR-400MI
Summary
by MITRE
Cross-site request forgery (CSRF) vulnerability on NTT EAST Hikari Denwa routers with firmware PR-400MI, RT-400MI, and RV-440MI 07.00.1006 and earlier and NTT WEST Hikari Denwa routers with firmware PR-400MI, RT-400MI, and RV-440MI 07.00.1005 and earlier allows remote attackers to hijack the authentication of arbitrary users.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 02/15/2019
The CVE-2016-1228 vulnerability represents a critical cross-site request forgery flaw affecting NTT EAST and WEST Hikari Denwa routers running specific firmware versions. This vulnerability resides in the authentication mechanisms of these network devices, creating a significant security risk for users who rely on these broadband services. The affected models include PR-400MI, RT-400MI, and RV-440MI routers from both NTT service providers, with specific firmware versions identified in the vulnerability description. The flaw allows remote attackers to manipulate authenticated sessions without requiring knowledge of valid credentials, effectively bypassing the authentication process.
The technical implementation of this CSRF vulnerability stems from the absence of proper anti-CSRF tokens or validation mechanisms within the router's web administration interface. When users access the router's management console, the system fails to verify that requests originate from legitimate administrative sessions rather than maliciously crafted web pages. This weakness enables attackers to construct specially crafted HTML pages or exploit existing web content that, when visited by an authenticated user, automatically submits administrative commands to the router. The vulnerability operates at the application layer and specifically targets the HTTP session management and request validation components of the router's web interface.
The operational impact of this vulnerability is severe as it allows attackers to completely compromise router administration capabilities. An attacker could perform unauthorized changes to network configuration, modify firewall rules, alter user accounts, disable security features, or even redirect network traffic to malicious destinations. The remote nature of the attack means that adversaries do not need physical access to the network or the ability to establish a direct connection to the router. This vulnerability essentially provides attackers with persistent access to the network infrastructure, potentially enabling further attacks against connected devices or allowing for data exfiltration from the network. The attack surface extends beyond simple configuration changes to include potential network reconnaissance and privilege escalation opportunities.
The vulnerability aligns with CWE-352, which specifically addresses Cross-Site Request Forgery weaknesses in software applications. From an ATT&CK framework perspective, this vulnerability maps to T1071.004 for Application Layer Protocol: DNS and potentially T1059 for Command and Scripting Interpreter, as attackers could use compromised routers to execute commands or establish command and control channels. The attack chain typically begins with social engineering to get a victim to visit a malicious website, followed by automatic execution of administrative commands against the vulnerable router, ultimately leading to full network compromise. Organizations should implement immediate mitigations including firmware updates from NTT, network segmentation, and monitoring for unusual router configuration changes. The vulnerability also highlights the importance of secure web application development practices and the necessity of implementing proper anti-CSRF protection mechanisms in network device management interfaces to prevent unauthorized administrative access.