Vulnerabilities > CVE-2014-0659 - OS Command Injection vulnerability in Cisco products

047910
CVSS 10.0 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
low complexity
cisco
CWE-78
critical
nessus
exploit available
metasploit
NVD
Published: 2014-01-12
Updated: 2017-08-29

Summary

The Cisco WAP4410N access point with firmware through 2.0.6.1, WRVS4400N router with firmware 1.x through 1.1.13 and 2.x through 2.0.2.1, and RVS4000 router with firmware through 2.0.3.2 allow remote attackers to read credential and configuration data, and execute arbitrary commands, via requests to the test interface on TCP port 32764, aka Bug IDs CSCum37566, CSCum43693, CSCum43700, and CSCum43685.

Vulnerable Configurations

Part Description Count
OS
Cisco
13
Hardware
Cisco
3

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Command Line Execution through SQL Injection
    An attacker uses standard SQL injection methods to inject data into the command line for execution. This could be done directly through misuse of directives such as MSSQL_xp_cmdshell or indirectly through injection of data into the database that would be interpreted as shell commands. Sometime later, an unscrupulous backend application (or could be part of the functionality of the same application) fetches the injected data stored in the database and uses this data as command line arguments without performing proper validation. The malicious data escapes that data plane by spawning new commands to be executed on the host.
  • Command Delimiters
    An attack of this type exploits a programs' vulnerabilities that allows an attacker's commands to be concatenated onto a legitimate command with the intent of targeting other resources such as the file system or database. The system that uses a filter or a blacklist input validation, as opposed to whitelist validation is vulnerable to an attacker who predicts delimiters (or combinations of delimiters) not present in the filter or blacklist. As with other injection attacks, the attacker uses the command delimiter payload as an entry point to tunnel through the application and activate additional attacks through SQL queries, shell commands, network scanning, and so on.
  • Exploiting Multiple Input Interpretation Layers
    An attacker supplies the target software with input data that contains sequences of special characters designed to bypass input validation logic. This exploit relies on the target making multiples passes over the input data and processing a "layer" of special characters with each pass. In this manner, the attacker can disguise input that would otherwise be rejected as invalid by concealing it with layers of special/escape characters that are stripped off by subsequent processing steps. The goal is to first discover cases where the input validation layer executes before one or more parsing layers. That is, user input may go through the following logic in an application: In such cases, the attacker will need to provide input that will pass through the input validator, but after passing through parser2, will be converted into something that the input validator was supposed to stop.
  • Argument Injection
    An attacker changes the behavior or state of a targeted application through injecting data or command syntax through the targets use of non-validated and non-filtered arguments of exposed services or methods.
  • OS Command Injection
    In this type of an attack, an adversary injects operating system commands into existing application functions. An application that uses untrusted input to build command strings is vulnerable. An adversary can leverage OS command injection in an application to elevate privileges, execute arbitrary commands and compromise the underlying operating system.

Exploit-Db

descriptionSerComm Device - Remote Code Execution. CVE-2014-0659. Remote exploit for hardware platform
idEDB-ID:30915
last seen2016-02-03
modified2014-01-14
published2014-01-14
reportermetasploit
sourcehttps://www.exploit-db.com/download/30915/
titleSerComm Device - Remote Code Execution

Metasploit

descriptionThis module can identify SerComm manufactured network devices which contain a backdoor, allowing command injection or account disclosure.
idMSF:AUXILIARY/SCANNER/MISC/SERCOMM_BACKDOOR_SCANNER
last seen2020-06-05
modified2017-07-24
published2014-01-09
references
reporterRapid7
sourcehttps://github.com/rapid7/metasploit-framework/blob/master//modules/auxiliary/scanner/misc/sercomm_backdoor_scanner.rb
titleSerComm Network Device Backdoor Detection

Nessus

NASL familyBackdoors
NASL idSCMM_BACKDOOR.NASL
descriptionThe remote device is a DSL Modem/Router with a backdoor running on port 32764. It is possible for an attacker to run arbitrary commands or access configuration details (including passwords) on the device.
last seen2020-06-01
modified2020-06-02
plugin id71807
published2014-01-06
reporterThis script is Copyright (C) 2014-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
sourcehttps://www.tenable.com/plugins/nessus/71807
titleScMM DSL Modem/Router Backdoor Detection
code
#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(71807);
  script_version("1.15");
  script_cvs_date("Date: 2018/11/28 22:47:41");

  script_cve_id("CVE-2014-0659");
  script_bugtraq_id(64675, 64776, 65007);
  script_xref(name:"CISCO-BUG-ID", value:"CSCum37566");
  script_xref(name:"CISCO-BUG-ID", value:"CSCum43685");
  script_xref(name:"CISCO-BUG-ID", value:"CSCum43693");
  script_xref(name:"CISCO-BUG-ID", value:"CSCum43700");
  script_xref(name:"CISCO-SA", value:"cisco-sa-20140110-sbd");

  script_name(english:"ScMM DSL Modem/Router Backdoor Detection");
  script_summary(english:"Detects the ScMM DSL Modem/Router port 32764 backdoor");

  script_set_attribute(attribute:"synopsis", value:"The remote device contains a backdoor.");
  script_set_attribute(attribute:"description", value:
"The remote device is a DSL Modem/Router with a backdoor running on port
32764.  It is possible for an attacker to run arbitrary commands or
access configuration details (including passwords) on the device.");
  script_set_attribute(attribute:"see_also", value:"https://github.com/elvanderb/TCP-32764");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140110-sbd
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b9d609e8");
  script_set_attribute(attribute:"solution", value:"Contact the device vendor regarding the availability of an update.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'SerComm Device Remote Code Execution');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2013/12/21");
  script_set_attribute(attribute:"plugin_publication_date", value:"2014/01/06");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Backdoors");

  script_copyright(english:"This script is Copyright (C) 2014-2018 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("find_service1.nasl");
  script_require_ports("Services/scmm_backdoor", 32764);

  exit(0);
}

include("audit.inc");
include("byte_func.inc");
include("global_settings.inc");
include("misc_func.inc");
include("data_protection.inc");

port = get_service(svc:"scmm_backdoor", default:32764, exit_on_fail:TRUE);

soc = open_sock_tcp(port);
if (!soc) audit(AUDIT_SOCK_FAIL, port);

req = "endiantest00" + raw_string(0x00);
send(socket:soc, data:req);

resp = recv(socket:soc, length:12);
close(soc);

if (strlen(resp) < 4) audit(AUDIT_RESP_BAD, port, "ScMM DSL Modem/Router Backdoor probe", "TCP");

sig = substr(resp, 0, 3);
if (sig != "ScMM" && sig != "MMcS") audit(AUDIT_NOT_DETECT, "ScMM DSL Modem/Router Backdoor", port);

if (sig == "MMcS") set_byte_order(BYTE_ORDER_LITTLE_ENDIAN);

req = sig + mkdword(1) + mkdword(1) + raw_string(0x00);

soc = open_sock_tcp(port);
if (!soc) audit(AUDIT_SOCK_FAIL, port);
send(socket:soc, data:req);
resp = recv(socket:soc, length:2048);

if (strlen(resp) < 13) extra = "Nessus was unable to obtain configuration details.";
else
{
  conf = substr(resp, 12);
  conf = str_replace(string:conf, find:raw_string(0x00), replace:'\n  ');
  conf = str_replace(string:conf, find:raw_string(0x01), replace:'\n    ');
  extra = "Nessus was able to obtain the following configuration details:" + '\n  ' + conf;
}

# If GDPR data protection is enabled don't include config
if (report_verbosity > 0 && !get_kb_item(data_protection::DPKB_ENABLED)) security_hole(port:port, extra:'\n'+extra);
else security_hole(port);

Seebug

bulletinFamilyexploit
descriptionBUGTRAQ ID：64776 CVE ID：CVE-2014-0659 Cisco RVS4000/WRVS4400N/WAP4410N是思科公司发行的无线路由器和无线AP。 Cisco WAP4410N Wireless-N Access Point, Cisco WRVS4400N Wireless-N Gigabit Security Router和Cisco RVS4000 4-port Gigabit Security Router产品存在安全漏洞，允许未验证远程攻击者获得对设备的root级的访问。 漏洞是由于受影响设备在TCP 32764端口存在一个未文档化的测试接口，攻击者可访问设备的LAN端接口，并执行任意命令。 运行固件2.0.3.2和之前版本的Cisco RVS4000 4-port Gigabit Security Router，运行固件1.1.13及之前版本的Cisco WRVS4400N Wireless-N Gigabit Security Router硬件1.0和1.1版本，运行固件2.0.2.1及之前版本的Cisco WRVS4400N Wireless-N Gigabit Security Router硬件2.0版本和运行了2.0.6.1及之前版本的Cisco WAP4410N Wireless-N Access Point受此漏洞影响。 0 Cisco WRVS4400N Wireless-N Gigabit Security Router 1.0 Cisco WRVS4400N Wireless-N Gigabit Security Router 1.1 Cisco RVS4000 4-port Gigabit Security Router 1.3.2.0 Cisco RVS4000 4-port Gigabit Security Router 2.0.2.7 Cisco RVS4000 4-port Gigabit Security Router 1.3.3.5 Cisco WRVS4400N Wireless-N Gigabit Security Router 2.0.2.1 厂商补丁： Cisco ----- 厂商将在2014年1月底发布相关的升级程序，建议用户下载使用： http://www.cisco.com
idSSV:61468
last seen2017-11-19
modified2014-02-18
published2014-02-18
reporterRoot
titleCisco RVS4000/WRVS4400N/WAP4410N设备测试接口远程特权提升漏洞

The Hacker News

idTHN:A76AC8864F7D2E7750E33ED0D4B5F38B
last seen2018-01-27
modified2014-01-14
published2014-01-13
reporterSudhir K Bansal
sourcehttps://thehackernews.com/2014/01/cisco-released-security-advisory-for.html
titleCisco released Security advisory for critical Router password reset vulnerability

References