CVE-2018-16590
📋 TL;DR
FURUNO FELCOM 250 and 500 satellite communication devices rely solely on client-side JavaScript for authentication, allowing attackers to bypass login entirely. This affects all users of these devices who haven't implemented additional security controls. The vulnerability enables complete system compromise without valid credentials.
💻 Affected Systems
- FURUNO FELCOM 250
- FURUNO FELCOM 500
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover allowing attackers to intercept/modify communications, disable safety systems, or use the device as an attack vector into connected networks.
Likely Case
Unauthorized access to device configuration, communication logs, and ability to disrupt satellite communications.
If Mitigated
Limited impact if network segmentation and additional authentication layers are implemented.
🎯 Exploit Status
Exploitation requires only disabling JavaScript or modifying client-side code - no special tools needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No known vendor advisory
Restart Required: No
Instructions:
No official patch available. Contact FURUNO support for guidance.
🔧 Temporary Workarounds
Implement Reverse Proxy with Authentication
linuxPlace device behind a reverse proxy that enforces proper server-side authentication
# Example nginx config with basic auth
location / {
proxy_pass http://felcom-device:80;
auth_basic "Restricted";
auth_basic_user_file /etc/nginx/.htpasswd;
}
Network Segmentation
allIsolate FELCOM devices in separate VLAN with strict firewall rules
# Example iptables rule to restrict access
# iptables -A INPUT -s 192.168.1.0/24 -p tcp --dport 80 -j ACCEPT
# iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Implement network-level authentication via firewall rules or VPN access only
- Monitor device access logs for unauthorized authentication attempts
🔍 How to Verify
Check if Vulnerable:
Access device web interface, disable JavaScript in browser, and attempt to access protected pages without credentialsCheck Version:
Check device web interface or serial console for firmware versionVerify Fix Applied:
Attempt authentication bypass with JavaScript disabled - should be blocked by server-side controls📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts followed by successful access
- Access from unexpected IP addresses
- Multiple rapid login attempts
Network Indicators:
- HTTP traffic to device without proper authentication headers
- Direct device access from unauthorized networks
SIEM Query:
source="felcom-device" AND (event="login" AND result="success" WITHOUT prior event="auth_failed")