CVE-2018-20162
📋 TL;DR
CVE-2018-20162 is an improper input validation vulnerability in Digi TransPort LR54 devices that allows users with 'super' CLI access privileges to escape the restricted shell and execute arbitrary commands as root. This affects devices running firmware version 4.4.0.26 and likely earlier versions. The vulnerability enables privilege escalation from limited administrative access to full root control.
💻 Affected Systems
- Digi TransPort LR54
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker with 'super' CLI access gains full root privileges, enabling complete device compromise, configuration modification, data exfiltration, and use as a pivot point into the network.
Likely Case
Malicious insiders or compromised 'super' user accounts escalate privileges to root, allowing them to install backdoors, modify network settings, or disrupt operations.
If Mitigated
With proper access controls and monitoring, exploitation would be detected and contained, limiting impact to isolated device compromise.
🎯 Exploit Status
Exploitation requires authenticated 'super' CLI access; public proof-of-concept demonstrates shell escape techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.4.0.27 or later
Vendor Advisory: https://www.digi.com/resources/security
Restart Required: Yes
Instructions:
1. Download latest firmware from Digi support portal. 2. Backup current configuration. 3. Upload and install firmware update via web interface or CLI. 4. Reboot device. 5. Verify firmware version.
🔧 Temporary Workarounds
Restrict CLI Access
allLimit 'super' CLI access to only necessary personnel and implement strong authentication.
Network Segmentation
allIsolate Digi devices in separate network segments to limit lateral movement if compromised.
🧯 If You Can't Patch
- Implement strict access controls for 'super' CLI accounts with multi-factor authentication.
- Monitor CLI sessions and command execution for suspicious activity.
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface (System > About) or CLI 'show version' command; versions 4.4.0.26 or earlier are vulnerable.Check Version:
show versionVerify Fix Applied:
Verify firmware version is 4.4.0.27 or later; test restricted shell escape attempts should fail.📡 Detection & Monitoring
Log Indicators:
- Unusual CLI session activity from 'super' users
- Execution of commands outside restricted shell
- Failed authentication attempts followed by successful 'super' login
Network Indicators:
- Unexpected outbound connections from Digi device
- Anomalous network configuration changes
SIEM Query:
source="digi-logs" AND (event="cli_session" AND user="super") AND command="*"🔗 References
- http://packetstormsecurity.com/files/151719/Digi-TransPort-LR54-Restricted-Shell-Escape.html
- https://blog.hackeriet.no/cve-2018-20162-digi-lr54-restricted-shell-escape/
- https://seclists.org/bugtraq/2019/Feb/34
- http://packetstormsecurity.com/files/151719/Digi-TransPort-LR54-Restricted-Shell-Escape.html
- https://blog.hackeriet.no/cve-2018-20162-digi-lr54-restricted-shell-escape/
- https://seclists.org/bugtraq/2019/Feb/34
