CVE-2018-20444 in CGA0111
Summary
by MITRE
Technicolor CGA0111 CGA0111E-ES-13-E23E-c8000r5712-170217-0829-TRU devices allow remote attackers to discover Wi-Fi credentials via iso.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.10001 and 1.3.6.1.4.1.4413.2.2.2.1.18.1.2.3.4.1.2.10001 SNMP requests.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 04/24/2020
This vulnerability affects Technicolor CGA0111 and CGA0111E wireless routers that implement SNMP protocols for network management. The flaw resides in the improper handling of specific SNMP object identifiers that expose sensitive wireless configuration data. Attackers can remotely query these particular OID sequences through SNMP requests to extract stored Wi-Fi credentials without requiring authentication or prior access to the device. The vulnerable OIDs iso.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.10001 and 1.3.6.1.4.1.4413.2.2.2.1.18.1.2.3.4.1.2.10001 specifically target the wireless network configuration parameters including SSID and passphrase information. This represents a critical security weakness that violates fundamental principles of network device security and configuration management. The vulnerability directly relates to CWE-200, which addresses information exposure through improper access control mechanisms.
The technical exploitation of this vulnerability demonstrates a significant flaw in the SNMP implementation where sensitive network configuration data is accessible through publicly queryable object identifiers. The affected devices do not properly implement access controls or authentication requirements for SNMP queries that should be restricted to authorized network management personnel. This allows any remote attacker with knowledge of the specific OID sequences to retrieve the wireless network credentials, effectively compromising the entire wireless security posture of the network. The vulnerability exists because the device's SNMP service exposes internal configuration data without proper authorization checks, creating an information disclosure scenario that aligns with ATT&CK technique T1082 for system information discovery.
The operational impact of this vulnerability is severe as it enables attackers to gain immediate access to wireless network credentials without requiring physical access or complex exploitation techniques. Once credentials are obtained, attackers can establish unauthorized connections to the wireless network, potentially leading to further network compromise through lateral movement, data exfiltration, or man-in-the-middle attacks. The vulnerability affects devices deployed in residential and small business environments where wireless networks are commonly used, making it particularly dangerous as these networks often lack robust security monitoring and segmentation controls. Network administrators may be unaware of the exposure since the credentials are accessible through standard network protocols without generating obvious alerts or logs.
Organizations should immediately implement mitigations including disabling SNMP services on affected devices when not required for network management, or at minimum restricting SNMP access to trusted IP addresses only. Network segmentation should be implemented to isolate management interfaces from user networks, and regular security audits should be conducted to identify and remediate similar information disclosure vulnerabilities. Device firmware updates from Technicolor should be applied immediately when available, as this vulnerability represents a known flaw in the device implementation. Network monitoring should be enhanced to detect unauthorized SNMP queries, and access controls should be reviewed to ensure that only authorized personnel can access sensitive network configuration data through management interfaces. The vulnerability highlights the importance of proper SNMP security configuration and the need for regular security assessments of network infrastructure components.