CVE-2018-15137
📋 TL;DR
CVE-2018-15137 is a critical vulnerability in CeLa Link CLR-M20 devices that allows unauthenticated attackers to upload arbitrary files via WebDAV's PUT method, leading to remote code execution. This affects all users of these devices with the vulnerable firmware. Attackers can gain complete control over affected devices.
💻 Affected Systems
- CeLa Link CLR-M20
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of device leading to persistent backdoor installation, data theft, lateral movement within network, and use as attack platform.
Likely Case
Remote code execution allowing attacker to run arbitrary commands, install malware, or disrupt device functionality.
If Mitigated
Limited impact if device is isolated behind firewall with strict inbound rules and WebDAV disabled.
🎯 Exploit Status
Exploit code is publicly available and requires minimal technical skill to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check with vendor for latest firmware
Vendor Advisory: No official vendor advisory found in references
Restart Required: Yes
Instructions:
1. Contact CeLa Link for latest firmware. 2. Backup configuration. 3. Upload and install firmware via web interface. 4. Reboot device. 5. Verify WebDAV is disabled or properly secured.
🔧 Temporary Workarounds
Disable WebDAV
allDisable WebDAV feature to prevent file uploads via PUT method
Network Segmentation
allIsolate CLR-M20 devices in separate VLAN with strict firewall rules
🧯 If You Can't Patch
- Immediately isolate device from internet and restrict network access
- Implement strict firewall rules to block all inbound traffic except essential management
🔍 How to Verify
Check if Vulnerable:
Test if WebDAV PUT method accepts file uploads to device web interface without authenticationCheck Version:
Check firmware version in device web interface under System Status or similar sectionVerify Fix Applied:
Verify WebDAV is disabled or properly authenticated, and test that file uploads via PUT method are rejected📡 Detection & Monitoring
Log Indicators:
- WebDAV PUT requests
- Unauthenticated file uploads
- Unusual file creation in web directories
Network Indicators:
- HTTP PUT requests to device on port 80/443
- Unexpected outbound connections from device
SIEM Query:
source_ip="*" AND http_method="PUT" AND dest_ip="CLR-M20_IP" AND http_status="200"