CVE-2018-20380
📋 TL;DR
This vulnerability allows remote attackers to retrieve device credentials via specific SNMP OID requests without authentication. It affects multiple Ambit router models including DDW2600, DDW2602, T60C926, and U10C019 devices. Attackers can exploit this to gain administrative access to vulnerable routers.
💻 Affected Systems
- Ambit DDW2600
- Ambit DDW2602
- Ambit T60C926
- Ambit U10C019
📦 What is this software?
Ambit Ddw2600 Firmware by Ubeeinteractive
Ambit Ddw2602 Firmware by Ubeeinteractive
Ambit T60c926 Firmware by Ubeeinteractive
Ambit U10c019 Firmware by Ubeeinteractive
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of router with credential theft leading to network takeover, traffic interception, and lateral movement to connected devices.
Likely Case
Unauthorized access to router administration interface allowing configuration changes, network disruption, and credential harvesting.
If Mitigated
Limited impact if SNMP is disabled or access restricted, though default configurations are vulnerable.
🎯 Exploit Status
Simple SNMP GET requests to specific OIDs (iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0) return credentials.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No vendor advisory found
Restart Required: No
Instructions:
No official patch available. Check with vendor for firmware updates or replace affected devices.
🔧 Temporary Workarounds
Disable SNMP Service
allCompletely disable SNMP service on affected routers to prevent credential exposure.
Access router admin interface → Advanced Settings → SNMP → Disable SNMP
Restrict SNMP Access
allConfigure SNMP access control lists to limit which IP addresses can query SNMP.
Access router admin interface → Advanced Settings → SNMP → Configure ACLs
🧯 If You Can't Patch
- Isolate affected routers in separate VLAN with strict firewall rules
- Implement network monitoring for SNMP requests to vulnerable OIDs
🔍 How to Verify
Check if Vulnerable:
Run SNMP GET requests to OIDs iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0. If credentials are returned, device is vulnerable.Check Version:
Check router admin interface or use SNMP to query system version OID (1.3.6.1.2.1.1.1.0)Verify Fix Applied:
After disabling SNMP or applying workarounds, repeat SNMP GET requests to verify no credentials are returned.📡 Detection & Monitoring
Log Indicators:
- SNMP GET requests to OIDs containing .4491.2.4.1.1.6.1.1 or .4491.2.4.1.1.6.1.2
Network Indicators:
- UDP port 161 traffic to affected devices with specific OID patterns
SIEM Query:
source_port=161 AND (oid:"*4491.2.4.1.1.6.1.1*" OR oid:"*4491.2.4.1.1.6.1.2*")🔗 References
- https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv
- https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.html
- https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv
- https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.html
