CVE-2018-18375
📋 TL;DR
This vulnerability in Orange AirBox routers allows attackers to extract sensitive APN configuration data including names, numbers, usernames, and passwords via an unauthenticated web request. Attackers can exploit this to steal credentials and potentially compromise mobile network access. Users of Orange AirBox Y858_FL_01.16_04 routers are affected.
💻 Affected Systems
- Orange AirBox Y858_FL
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal APN credentials, gain unauthorized access to mobile networks, intercept communications, and potentially pivot to other network resources.
Likely Case
Attackers extract APN credentials and use them for unauthorized mobile data access or credential reuse attacks against other systems.
If Mitigated
With proper network segmentation and access controls, impact is limited to credential exposure without lateral movement opportunities.
🎯 Exploit Status
Simple HTTP GET request to /goform/getProfileList with rand parameter triggers the leak. Public proof-of-concept code exists on GitHub.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
No official patch available. Check Orange vendor website for firmware updates or contact Orange support for patching guidance.
🔧 Temporary Workarounds
Block Web Interface Access
linuxRestrict access to the router's web management interface using firewall rules
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
Disable Remote Management
allTurn off remote management/administration features in router settings
🧯 If You Can't Patch
- Segment affected routers on isolated network segments to limit lateral movement
- Monitor for unusual outbound connections or credential usage from affected devices
🔍 How to Verify
Check if Vulnerable:
Send HTTP GET request to http://[router-ip]/goform/getProfileList?rand=test and check if APN data is returned in responseCheck Version:
Check router web interface or use nmap -sV [router-ip] to identify firmware versionVerify Fix Applied:
After applying workarounds, verify the endpoint no longer returns APN data or is inaccessible📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /goform/getProfileList with rand parameter
- Unusual access to router management interface
Network Indicators:
- HTTP GET requests to router IP on port 80/443 with specific parameter patterns
- Outbound connections using extracted APN credentials
SIEM Query:
source="router_logs" AND uri="/goform/getProfileList" AND query_string="*rand=*"