CVE-2018-16591
📋 TL;DR
CVE-2018-16591 allows unauthenticated attackers to change administrative passwords on FURUNO FELCOM 250 and 500 satellite communication devices. This affects all organizations using these devices without proper network segmentation or access controls.
💻 Affected Systems
- FURUNO FELCOM 250
- FURUNO FELCOM 500
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover, disruption of maritime communications, potential manipulation of critical navigation or safety systems.
Likely Case
Unauthorized administrative access leading to device configuration changes, data interception, or service disruption.
If Mitigated
Limited impact if devices are properly segmented and not internet-facing.
🎯 Exploit Status
Simple HTTP POST requests to vulnerable endpoints with no authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check with FURUNO for specific firmware versions
Vendor Advisory: https://www.furuno.com/en/security/
Restart Required: Yes
Instructions:
1. Contact FURUNO support for latest firmware. 2. Backup device configuration. 3. Apply firmware update via web interface or physical media. 4. Verify password change functionality requires authentication.
🔧 Temporary Workarounds
Network Segmentation
allIsolate FELCOM devices from untrusted networks
Access Control Lists
linuxRestrict access to device management interfaces
iptables -A INPUT -p tcp --dport 80 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate devices
- Monitor for unauthorized password change attempts in logs
🔍 How to Verify
Check if Vulnerable:
Attempt HTTP POST to /cgi-bin/sm_changepassword.cgi without authenticationCheck Version:
Check firmware version via web interface or serial consoleVerify Fix Applied:
Verify password change endpoints require authentication after update📡 Detection & Monitoring
Log Indicators:
- Unauthenticated POST requests to /cgi-bin/sm_changepassword.cgi
- Password change events from unexpected IPs
Network Indicators:
- HTTP POST to vulnerable endpoints without authentication headers
SIEM Query:
source="felcom" AND (url="/cgi-bin/sm_changepassword.cgi" OR url="/cgi-bin/sm_sms_changepasswd.cgi") AND NOT auth_token=*