CVE-2018-1164
📋 TL;DR
This vulnerability allows remote attackers to reboot ZyXEL DSL routers without authentication by exploiting improper access controls in CGI endpoints. It affects ZyXEL P-870H-51 routers running specific firmware versions. The vulnerability enables denial-of-service attacks and potentially other unauthorized actions.
💻 Affected Systems
- ZyXEL P-870H-51 DSL Router
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Persistent denial-of-service rendering the router unusable, potential for additional unauthorized administrative actions beyond rebooting, and service disruption for all connected users.
Likely Case
Intermittent service disruption through router reboots, causing temporary network outages for connected devices and users.
If Mitigated
No impact if proper network segmentation and access controls prevent external access to router management interfaces.
🎯 Exploit Status
Exploitation requires only HTTP requests to specific CGI endpoints. No authentication needed. Was disclosed through ZDI-CAN-4540.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Later firmware versions from ZyXEL
Vendor Advisory: https://www.zyxel.com/support/security_advisories.shtml
Restart Required: Yes
Instructions:
1. Check current firmware version. 2. Download latest firmware from ZyXEL support site. 3. Upload firmware through router web interface. 4. Reboot router after update completes.
🔧 Temporary Workarounds
Disable WAN Management Access
allPrevent external access to router management interface by disabling WAN-side administration
Access router web interface > Advanced Setup > Remote Management > Disable WAN access
Network Segmentation
allPlace router management interface on isolated VLAN with strict access controls
🧯 If You Can't Patch
- Implement strict firewall rules to block all external access to router management ports (typically 80, 443, 8080)
- Deploy network monitoring to detect and alert on unauthorized reboot attempts or suspicious CGI endpoint access
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router web interface under Maintenance > System Info. If version is 1.00(AWG.3)D5 or earlier, likely vulnerable.Check Version:
curl -s http://router-ip/maintenance/system_info.cgi | grep FirmwareVerify Fix Applied:
Verify firmware version is updated to a version later than 1.00(AWG.3)D5. Test that CGI endpoints no longer accept unauthenticated reboot commands.📡 Detection & Monitoring
Log Indicators:
- Multiple HTTP POST requests to CGI endpoints from unauthorized sources
- Router reboot events without administrative action
- Access to /cgi-bin/reboot.cgi or similar endpoints
Network Indicators:
- HTTP traffic to router management interface from external IPs
- POST requests to CGI endpoints without preceding authentication
SIEM Query:
source="router-logs" AND (uri="/cgi-bin/reboot.cgi" OR uri="/cgi-bin/*.cgi") AND NOT user="admin"