CVE-2017-14269
📋 TL;DR
This vulnerability in EE 4GEE WiFi MBB devices exposes sensitive information through a JSONP endpoint, allowing remote attackers to retrieve passwords and SMS content without authentication. It affects EE 4GEE WiFi mobile broadband routers running firmware versions before EE60_00_05.00_31. Anyone using these vulnerable devices is at risk of having their credentials and communications intercepted.
💻 Affected Systems
- EE 4GEE WiFi MBB (Mobile Broadband Router)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain complete control over the router, intercept all network traffic, steal all stored credentials, access SMS messages, and potentially pivot to attack connected devices.
Likely Case
Remote attackers harvest passwords, WiFi credentials, and SMS content from vulnerable devices exposed to the internet.
If Mitigated
With proper network segmentation and firewall rules, impact is limited to information disclosure from the router itself.
🎯 Exploit Status
Exploitation requires only web requests to the JSONP endpoint. Public proof-of-concept code and detailed writeups are available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: EE60_00_05.00_31 or later
Vendor Advisory: No formal vendor advisory found, but fix confirmed in referenced disclosures
Restart Required: Yes
Instructions:
1. Log into router admin interface. 2. Check current firmware version. 3. If below EE60_00_05.00_31, download latest firmware from EE support. 4. Upload and apply firmware update. 5. Reboot router.
🔧 Temporary Workarounds
Block External Access
linuxConfigure firewall to block all external access to router admin interface (typically port 80/443)
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
Disable Remote Management
allTurn off remote management feature in router settings if enabled
🧯 If You Can't Patch
- Replace vulnerable devices with updated models or different vendors
- Isolate router on separate VLAN with strict firewall rules limiting access
🔍 How to Verify
Check if Vulnerable:
Access router admin interface, navigate to firmware version page, check if version is below EE60_00_05.00_31Check Version:
curl -s http://router-ip/firmware-version or check admin web interfaceVerify Fix Applied:
Confirm firmware version shows EE60_00_05.00_31 or higher after update📡 Detection & Monitoring
Log Indicators:
- Unusual access to JSONP endpoints
- Multiple failed authentication attempts followed by JSONP requests
Network Indicators:
- External IPs accessing router admin interface on unusual ports
- Patterns of requests to /jsonp endpoints
SIEM Query:
source="router_logs" AND (uri="*jsonp*" OR uri="*/api/*") AND src_ip NOT IN [trusted_networks]🔗 References
- http://seclists.org/fulldisclosure/2017/Sep/13
- https://blog.jameshemmings.co.uk/2017/08/24/ee-4gee-mobile-wifi-router-multiple-security-vulnerabilities-writeup
- http://seclists.org/fulldisclosure/2017/Sep/13
- https://blog.jameshemmings.co.uk/2017/08/24/ee-4gee-mobile-wifi-router-multiple-security-vulnerabilities-writeup
