CVE-2018-19392
📋 TL;DR
CVE-2018-19392 is an unauthenticated password reset vulnerability in Cobham Satcom Sailor satellite communication devices. Attackers can reset any user's password (including admin) without authentication by sending specially crafted requests to the web interface. This affects organizations using vulnerable Sailor 250 and 500 devices for maritime communications.
💻 Affected Systems
- Cobham Satcom Sailor 250
- Cobham Satcom Sailor 500
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of satellite communication systems, allowing attackers to intercept/modify communications, disable critical maritime communications, or use devices as entry points to connected networks.
Likely Case
Unauthorized administrative access to satellite terminals, enabling configuration changes, service disruption, or credential harvesting from connected systems.
If Mitigated
Limited impact if devices are behind firewalls with strict network segmentation and access controls, though the vulnerability remains exploitable by anyone with network access.
🎯 Exploit Status
Exploitation requires only HTTP requests to specific endpoints with crafted parameters. Public proof-of-concept code demonstrates the attack.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 1.25 and later
Vendor Advisory: https://www.cobham.com/satcom/
Restart Required: Yes
Instructions:
1. Download firmware version 1.25 or later from Cobham Satcom support portal. 2. Access device web interface. 3. Navigate to Administration > Software Update. 4. Upload and apply the new firmware. 5. Reboot device after update completes.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict network access to device management interfaces using firewall rules
Disable Remote Management
allDisable web interface access from external networks if not required
🧯 If You Can't Patch
- Isolate devices in dedicated network segments with strict firewall rules allowing only necessary traffic
- Implement network monitoring for suspicious HTTP requests to /index.lua with password reset parameters
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface: Login > Administration > System Information. If version is below 1.25, device is vulnerable.Check Version:
No CLI command - check via web interface at /index.lua?pageID=SystemInformationVerify Fix Applied:
After updating, verify firmware version shows 1.25 or higher in System Information. Test that password reset requires current password.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /index.lua with pageID=Administration and passwordAdmChange parameters
- Multiple failed login attempts followed by successful password reset
Network Indicators:
- HTTP POST requests to device IP with password reset parameters without authentication
- Unusual administrative activity from non-standard IP addresses
SIEM Query:
sourceIP="device_IP" AND (url="*index.lua*pageID=Administration*" OR url="*passwordAdmChange*")