CVE-2018-15555
📋 TL;DR
This vulnerability allows physical attackers to gain root access to Telus Actiontec WEB6000Q devices via exposed UART headers using default credentials. Attackers with physical access can bypass authentication and gain complete control of the device. This affects all users of Telus Actiontec WEB6000Q v1.1.02.22 devices.
💻 Affected Systems
- Telus Actiontec WEB6000Q
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attacker to install persistent malware, intercept all network traffic, pivot to internal networks, and use device as attack platform.
Likely Case
Physical attacker gains root shell access, modifies device configuration, installs backdoors, and potentially accesses connected devices on the network.
If Mitigated
With physical security controls, impact limited to device compromise without network propagation.
🎯 Exploit Status
Exploitation requires physical access to device UART headers and basic serial connection tools.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Contact Telus/Actiontec for firmware updates or replacement options.
🔧 Temporary Workarounds
Disable UART access
allPhysically disable or obscure UART headers on device PCB
Requires physical modification: Desolder or cover UART pins
Change root password
linuxChange default root password if device allows password modification
passwd root
Enter new secure password
🧯 If You Can't Patch
- Implement strict physical security controls for device location
- Replace affected devices with updated models if available
🔍 How to Verify
Check if Vulnerable:
Check device label for model WEB6000Q and version v1.1.02.22. Physically inspect for exposed UART headers.Check Version:
Check device label or web interface for firmware versionVerify Fix Applied:
Attempt UART connection with serial adapter using root/admin credentials. Successful login indicates vulnerable.📡 Detection & Monitoring
Log Indicators:
- Serial console login attempts
- Root login from unexpected source
Network Indicators:
- Unusual outbound connections from device
- Configuration changes without authorization
SIEM Query:
Device:Telus Actiontec AND Event:Authentication AND Result:Success AND User:root