CVE-2018-10024
📋 TL;DR
The ubiQuoss Switch VP5208A creates a plaintext password file at /cgi-bin/bcm_password when login attempts fail, exposing user credentials via HTTP. Attackers can retrieve these credentials and use them to gain SSH/TELNET access to the system. This affects all ubiQuoss Switch VP5208A devices with default configurations.
💻 Affected Systems
- ubiQuoss Switch VP5208A
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with administrative access, allowing attackers to reconfigure network settings, intercept traffic, or use the device as a pivot point into internal networks.
Likely Case
Unauthorized administrative access to the switch, enabling network disruption, credential harvesting, and lateral movement within the network.
If Mitigated
Limited impact if proper network segmentation, access controls, and monitoring prevent exploitation attempts.
🎯 Exploit Status
Exploitation requires only HTTP access to the device and failed login attempts to trigger file creation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check with ubiQuoss for specific firmware version
Vendor Advisory: https://www.ubiquoss.com/security-advisory/
Restart Required: Yes
Instructions:
1. Contact ubiQuoss for latest firmware. 2. Backup configuration. 3. Upload firmware via web interface. 4. Apply firmware update. 5. Reboot device. 6. Verify fix by checking /cgi-bin/bcm_password no longer exists.
🔧 Temporary Workarounds
Block HTTP access to /cgi-bin/
linuxPrevent access to the vulnerable directory via web server configuration or firewall rules.
iptables -A INPUT -p tcp --dport 80 -m string --string '/cgi-bin/bcm_password' --algo bm -j DROP
Disable HTTP management interface
allUse alternative management methods (SSH, console) and disable the HTTP interface.
configure via device web interface: disable HTTP service
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the switch from untrusted networks
- Enable comprehensive logging and monitoring for failed login attempts and unusual HTTP requests
🔍 How to Verify
Check if Vulnerable:
Attempt to access http://<device-ip>/cgi-bin/bcm_password after a failed login attempt. If file exists with credentials, device is vulnerable.Check Version:
Check firmware version via device web interface or SSH: show versionVerify Fix Applied:
After patching, verify the bcm_password file is no longer created at /cgi-bin/ after failed login attempts.📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts followed by HTTP GET requests to /cgi-bin/bcm_password
- Unusual SSH/TELNET login attempts from new IP addresses
Network Indicators:
- HTTP requests to /cgi-bin/bcm_password from external IPs
- Sudden increase in authentication attempts
SIEM Query:
source="switch_logs" AND (uri="/cgi-bin/bcm_password" OR (event="login_failed" AND event="http_request"))