CVE-2017-18369
📋 TL;DR
This CVE describes a critical command injection vulnerability in Billion 5200W-T routers distributed by TrueOnline. Unauthenticated attackers can execute arbitrary commands on the router by exploiting the syslogServerAddr parameter in the Remote System Log forwarding function. This affects all users with vulnerable router firmware exposed to network access.
💻 Affected Systems
- Billion 5200W-T router distributed by TrueOnline
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router compromise allowing persistent backdoor installation, credential theft, network traffic interception, and lateral movement to connected devices.
Likely Case
Router takeover leading to DNS hijacking, credential harvesting, and use as pivot point for internal network attacks.
If Mitigated
Limited impact if router is behind firewall with no external access and proper network segmentation.
🎯 Exploit Status
Multiple public PoCs exist showing simple curl commands can exploit this vulnerability. The attack requires no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Later firmware versions from vendor
Vendor Advisory: Not publicly documented in vendor advisory
Restart Required: Yes
Instructions:
1. Check current firmware version via router admin interface. 2. Download latest firmware from vendor website. 3. Upload and apply firmware update through admin interface. 4. Reboot router to complete installation.
🔧 Temporary Workarounds
Disable Remote System Logging
allDisable the vulnerable Remote System Log forwarding feature to prevent exploitation.
Restrict Management Interface Access
allConfigure firewall rules to restrict access to router management interface to trusted IPs only.
🧯 If You Can't Patch
- Replace router with non-vulnerable model
- Place router behind dedicated firewall with strict inbound/outbound rules
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface. If version is 1.02b.rc5.dt49, the device is vulnerable.Check Version:
Login to router admin interface and check System Status or Firmware Information page.Verify Fix Applied:
After firmware update, verify version is no longer 1.02b.rc5.dt49 and test that adv_remotelog.asp page is no longer accessible or properly sanitizes input.📡 Detection & Monitoring
Log Indicators:
- Unusual commands in system logs
- Multiple failed access attempts to adv_remotelog.asp
- Suspicious syslog configuration changes
Network Indicators:
- HTTP requests to adv_remotelog.asp with shell metacharacters in parameters
- Outbound connections from router to unexpected destinations
SIEM Query:
http.url:*adv_remotelog.asp* AND (http.param:*syslogServerAddr* AND http.param:*[;&|`]*🔗 References
- https://raw.githubusercontent.com/pedrib/PoC/master/advisories/zyxel_trueonline.txt
- https://seclists.org/fulldisclosure/2017/Jan/40
- https://ssd-disclosure.com/index.php/archives/2910
- https://raw.githubusercontent.com/pedrib/PoC/master/advisories/zyxel_trueonline.txt
- https://seclists.org/fulldisclosure/2017/Jan/40
- https://ssd-disclosure.com/index.php/archives/2910
