The research around a recent vulnerability shows how researchers follow leads and find unexpected results.

In late January, researchers found a vulnerability in Cisco RV320 and RV325 routers — routers aimed at the needs of small businesses and remote offices. Cisco quickly released a software patch to close the vulnerability, but some of the research around the vulnerability offers a view into the world of researchers as they follow leads and look for issues in hardware and software.

The vulnerability itself was given designation CVE-2019-1653. According to the description of the vulnerability, it "…could allow an unauthenticated, remote attacker to retrieve sensitive information." In Cisco's announcement of the vulnerability and patch, it writes that a flaw in the browser-based management interface could allow an attacker to request a specific URL, which would return configuration details.

Jon Hart, senior security researcher at Rapid7, is more specific about those details. "There is a particular URL that you navigate to that happens to include the entire configuration for the device — you know, the username, password, configuration information, and just all sorts of critical information without requiring authentication," he says. To make matters worse, the interface that harbored the vulnerability was enabled by default, with public Internet access possible.

In a blog post on his research, Rapid7 chief data scientist Bob Rudis noted that he had seen news of the vulnerability's discovery through responsible disclosure on the Full Disclosure mailing list at seclists.org. Virtually all researchers deploy their own active and passive scanning tools on the Internet, and Rapid7 is no exception.

The company calls its active tool Project Sonar and the passive tool Project Heisenberg. Hart, who manages Project Sonar, says, "Project Sonar, as you know, is our Internet scanning project, so it's actively looking for interesting things and collecting data about endpoints and things on the public Internet. Heisenberg, on the other hand, is a passive tool that listens on the public Internet. And really, it's a series a series of global, publicly deployed, honeypots."

One of the things that Rudis found was a discrepancy between the number of affected devices he found and the number that had been reported by researcher Troy Mursch on the Bad Packets Report. Where Mursch found "over 9,000" devices vulnerabe, out of more than 15,000 hosts exposed to the Internet, Rudis found nearly 20,000 exposed devices. Hart says that the difference, while small in a global sense, is likely due to differences in the interfaces each researcher was scanning and searching for.

As Hart (who was working on the research with Rudis) looked at the data, he found another piece of interface-associated interest: There were duplicate MAC addresses in the vulnerable population of devices. Hart says that he was able to look at the MAC because of information returned by the routers' SSL certificates. "These SSL certificates, in addition to identifying the model, also provide the MAC address," he explains.

A MAC address is supposed to be unique to a particular physical interface — there really shouldn't be two the same anywhere in the world. In the case of the vulnerable routers, though, Hart says that one MAC address appeared more than 1,200 times. The duplicate MAC appears to be related to a company, NetKlass Technology, that was a supplier to Cisco a number of years ago. The duplicate MACs could be the result of supply chain or development issues and don't, by themselves, represent a security issue.

Duplicate MACs can, though, create performance and configuration issues if multiple devices with the same MAC are deployed on a single network. And the vulnerability that researchers were following can create a number of issues, especially, in Hart's words, if the routers are deployed by their intended audience — small businesses unlikely to have a dedicated security staff.

Hart says he would rate this vulnerability somewhere around a 5 or 6 on a 10-point severity scale. "If an attacker gets access to this configuration, he has the username and password and basically keys to the kingdom on this router," Hart says, "…and at that point he can do whatever he wants to that particular router." And because the router is responsible for routing the traffic of everything on the other side of it, Hart says, an attacker could then reconfigure DNS and firewall rules, and quickly own the network.

[Author's note: This article has been revised from the original. At original posting, Troy Mursch's name was misspelled. The article has also been edited to clarify the differences between the findings of Mursch and Rudis.]

Related Content:

About the Author(s)

Curtis Franklin, Principal Analyst, Omdia

Curtis Franklin Jr. is Principal Analyst at Omdia, focusing on enterprise security management. Previously, he was senior editor of Dark Reading, editor of Light Reading's Security Now, and executive editor, technology, at InformationWeek, where he was also executive producer of InformationWeek's online radio and podcast episodes

Curtis has been writing about technologies and products in computing and networking since the early 1980s. He has been on staff and contributed to technology-industry publications including BYTE, ComputerWorld, CEO, Enterprise Efficiency, ChannelWeb, Network Computing, InfoWorld, PCWorld, Dark Reading, and ITWorld.com on subjects ranging from mobile enterprise computing to enterprise security and wireless networking.

Curtis is the author of thousands of articles, the co-author of five books, and has been a frequent speaker at computer and networking industry conferences across North America and Europe. His most recent books, Cloud Computing: Technologies and Strategies of the Ubiquitous Data Center, and Securing the Cloud: Security Strategies for the Ubiquitous Data Center, with co-author Brian Chee, are published by Taylor and Francis.

When he's not writing, Curtis is a painter, photographer, cook, and multi-instrumentalist musician. He is active in running, amateur radio (KG4GWA), the MakerFX maker space in Orlando, FL, and is a certified Florida Master Naturalist.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights