CVE-2017-6094
📋 TL;DR
This vulnerability allows attackers to forge authentication values and impersonate other subscribers' CPE devices on Genexis GAPS networks. By reverse-engineering the 'chk' algorithm, attackers can obtain sensitive configuration data including VoIP credentials. This affects Genexis B.V. GAPS systems up to version 7.2.
💻 Affected Systems
- Genexis B.V. GAPS
📦 What is this software?
Gaps by Genexis
⚠️ Risk & Real-World Impact
Worst Case
Mass credential theft across all subscribers, unauthorized access to VoIP services, potential financial fraud through compromised telephony services, and complete compromise of subscriber privacy.
Likely Case
Targeted credential theft for specific subscribers, unauthorized VoIP access leading to toll fraud, and exposure of sensitive subscriber configuration data.
If Mitigated
Limited to isolated incidents if network segmentation and monitoring are in place, with minimal impact on overall service availability.
🎯 Exploit Status
The algorithm disclosure makes exploitation straightforward for attackers with network access to GAPS systems.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 7.2
Vendor Advisory: http://seclists.org/fulldisclosure/2017/Dec/62
Restart Required: Yes
Instructions:
1. Contact Genexis for updated firmware beyond version 7.2
2. Apply firmware update to all GAPS instances
3. Restart GAPS services
4. Verify new chk algorithm implementation
🔧 Temporary Workarounds
Network Segmentation
allIsolate GAPS management network from untrusted networks
Access Control Lists
allRestrict access to GAPS configuration endpoints to authorized IPs only
🧯 If You Can't Patch
- Implement strict network segmentation to isolate GAPS systems
- Deploy network monitoring for unusual MAC/chk combinations and configuration requests
🔍 How to Verify
Check if Vulnerable:
Check GAPS version via administrative interface or CLI. Versions ≤7.2 are vulnerable.Check Version:
gaps-cli --version or check web interface system infoVerify Fix Applied:
Verify GAPS version is >7.2 and test that chk values cannot be predicted from MAC addresses.📡 Detection & Monitoring
Log Indicators:
- Multiple configuration requests from same MAC with different chk values
- Configuration requests for non-local MAC addresses
- Failed authentication attempts followed by successful ones with different chk
Network Indicators:
- Unusual patterns of configuration requests to GAPS endpoints
- Traffic from unexpected sources to GAPS configuration ports
SIEM Query:
source_ip=* AND dest_port=GAPS_CONFIG_PORT AND (event_type="config_request" OR event_type="auth_attempt") GROUP BY mac_address HAVING COUNT(DISTINCT chk_value) > 1