Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

Cisco Router Vulnerability Gives Window into Researchers' World

The research around a recent vulnerability shows how researchers follow leads and find unexpected results.

In late January, researchers found a vulnerability in Cisco RV320 and RV325 routers — routers aimed at the needs of small businesses and remote offices. Cisco quickly released a software patch to close the vulnerability, but some of the research around the vulnerability offers a view into the world of researchers as they follow leads and look for issues in hardware and software.

The vulnerability itself was given designation CVE-2019-1653. According to the description of the vulnerability, it "…could allow an unauthenticated, remote attacker to retrieve sensitive information." In Cisco's announcement of the vulnerability and patch, it writes that a flaw in the browser-based management interface could allow an attacker to request a specific URL, which would return configuration details.

Jon Hart, senior security researcher at Rapid7, is more specific about those details. "There is a particular URL that you navigate to that happens to include the entire configuration for the device — you know, the username, password, configuration information, and just all sorts of critical information without requiring authentication," he says. To make matters worse, the interface that harbored the vulnerability was enabled by default, with public Internet access possible.

In a blog post on his research, Rapid7 chief data scientist Bob Rudis noted that he had seen news of the vulnerability's discovery through responsible disclosure on the Full Disclosure mailing list at seclists.org. Virtually all researchers deploy their own active and passive scanning tools on the Internet, and Rapid7 is no exception.

The company calls its active tool Project Sonar and the passive tool Project Heisenberg. Hart, who manages Project Sonar, says, "Project Sonar, as you know, is our Internet scanning project, so it's actively looking for interesting things and collecting data about endpoints and things on the public Internet. Heisenberg, on the other hand, is a passive tool that listens on the public Internet. And really, it's a series a series of global, publicly deployed, honeypots."

One of the things that Rudis found was a discrepancy between the number of affected devices he found and the number that had been reported by researcher Troy Mursch on the Bad Packets Report. Where Mursch found "over 9,000" devices vulnerabe, out of more than 15,000 hosts exposed to the Internet, Rudis found nearly 20,000 exposed devices. Hart says that the difference, while small in a global sense, is likely due to differences in the interfaces each researcher was scanning and searching for.

As Hart (who was working on the research with Rudis) looked at the data, he found another piece of interface-associated interest: There were duplicate MAC addresses in the vulnerable population of devices. Hart says that he was able to look at the MAC because of information returned by the routers' SSL certificates. "These SSL certificates, in addition to identifying the model, also provide the MAC address," he explains.

A MAC address is supposed to be unique to a particular physical interface — there really shouldn't be two the same anywhere in the world. In the case of the vulnerable routers, though, Hart says that one MAC address appeared more than 1,200 times. The duplicate MAC appears to be related to a company, NetKlass Technology, that was a supplier to Cisco a number of years ago. The duplicate MACs could be the result of supply chain or development issues and don't, by themselves, represent a security issue.

Duplicate MACs can, though, create performance and configuration issues if multiple devices with the same MAC are deployed on a single network. And the vulnerability that researchers were following can create a number of issues, especially, in Hart's words, if the routers are deployed by their intended audience — small businesses unlikely to have a dedicated security staff.

Hart says he would rate this vulnerability somewhere around a 5 or 6 on a 10-point severity scale. "If an attacker gets access to this configuration, he has the username and password and basically keys to the kingdom on this router," Hart says, "…and at that point he can do whatever he wants to that particular router." And because the router is responsible for routing the traffic of everything on the other side of it, Hart says, an attacker could then reconfigure DNS and firewall rules, and quickly own the network.

[Author's note: This article has been revised from the original. At original posting, Troy Mursch's name was misspelled. The article has also been edited to clarify the differences between the findings of Mursch and Rudis.]

Related Content:

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
MarkSindone
50%
50%
MarkSindone,
User Rank: Moderator
2/19/2019 | 12:01:39 AM
The more the merrier
I actually find it quite amazing how easy it is for software engineers to release a patch that magically solves all the problems of their hardware around the world. I reckon that it takes actual operations and real-life testing to actually detect these issues. Testing before release is definitely not exhaustive if the company wants to push all of their stock out off storage and start raking in the profits from the sale of their items.
DavidHamilton
50%
50%
DavidHamilton,
User Rank: Apprentice
2/18/2019 | 11:10:03 PM
Take advantage of situation
Have you heard of the saying "Every cloud has a silver lining"? This situation somehow explains this term in a vague manner. Though the unfortunate event of Cisco router compromise happened, it also created an opportunity for security experts to improve their security processes. If it hadn't happened, perhaps the level of their expertise might have not progressed a step forward.
7 Tips for Infosec Pros Considering A Lateral Career Move
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2020
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark Reading,  1/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
IT 2020: A Look Ahead
Are you ready for the critical changes that will occur in 2020? We've compiled editor insights from the best of our network (Dark Reading, Data Center Knowledge, InformationWeek, ITPro Today and Network Computing) to deliver to you a look at the trends, technologies, and threats that are emerging in the coming year. Download it today!
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16029
PUBLISHED: 2020-01-26
A vulnerability in the application programming interface (API) of Cisco Smart Software Manager On-Prem could allow an unauthenticated, remote attacker to change user account information which can prevent users from logging in, resulting in a denial of service (DoS) condition of the web interface. Th...
CVE-2020-3115
PUBLISHED: 2020-01-26
A vulnerability in the CLI of the Cisco SD-WAN Solution vManage software could allow an authenticated, local attacker to elevate privileges to root-level privileges on the underlying operating system. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerabi...
CVE-2020-3121
PUBLISHED: 2020-01-26
A vulnerability in the web-based management interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability is due to insufficient validation of user-supplie...
CVE-2020-3129
PUBLISHED: 2020-01-26
A vulnerability in the web-based management interface of Cisco Unity Connection Software could allow an authenticated, remote attacker to perform a stored cross-site scripting (XSS) attack. The vulnerability is due to insufficient input validation by the web-based management interface. An attacker c...
CVE-2020-3131
PUBLISHED: 2020-01-26
[CVE-2020-3131_su] A vulnerability in the Cisco Webex Teams client for Windows could allow an authenticated, remote attacker to cause the client to crash, resulting in a denial of service (DoS) condition. The attacker needs a valid developer account to exploit this vulnerability. The vulnerability i...