CVE-2018-20384
📋 TL;DR
This vulnerability allows remote attackers to retrieve device credentials via specific SNMP OID requests on affected iNovo Broadband devices. Attackers can obtain authentication credentials without authentication, potentially leading to full device compromise. Organizations using iNovo Broadband IB-8120-W21 and IB-8120-W21E1 devices with vulnerable firmware are affected.
💻 Affected Systems
- iNovo Broadband IB-8120-W21
- iNovo Broadband IB-8120-W21E1
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover leading to network compromise, credential harvesting, and potential lateral movement within the network.
Likely Case
Attackers gain administrative access to affected devices, enabling configuration changes, traffic interception, and credential theft.
If Mitigated
Limited impact with proper network segmentation and SNMP access controls preventing unauthorized queries.
🎯 Exploit Status
Exploitation requires only SNMP access and knowledge of the specific OIDs. Public proof-of-concept exists in referenced GitHub repository.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No vendor advisory found
Restart Required: No
Instructions:
No official patch available. Check with iNovo Broadband for firmware updates. Consider replacing devices if no fix is provided.
🔧 Temporary Workarounds
Disable SNMP Access
allCompletely disable SNMP service on affected devices if not required for operations.
Restrict SNMP Access
allConfigure SNMP access controls to limit queries to trusted IP addresses only.
Change Default Credentials
allChange all default credentials on affected devices, though this may not fully mitigate the vulnerability.
🧯 If You Can't Patch
- Isolate affected devices in separate network segments with strict firewall rules
- Implement network monitoring for SNMP queries to the vulnerable OIDs
- Consider replacing devices with supported alternatives if vendor provides no fix
🔍 How to Verify
Check if Vulnerable:
Use snmpwalk or similar SNMP tool to query OIDs iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0. If they return credential information, the device is vulnerable.Check Version:
Check device web interface or console for firmware version information.Verify Fix Applied:
After applying workarounds, verify SNMP service is disabled or restricted, and the vulnerable OIDs no longer return credential data.📡 Detection & Monitoring
Log Indicators:
- SNMP queries to OIDs iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0
- Multiple failed authentication attempts following SNMP queries
Network Indicators:
- SNMP traffic (UDP 161) to affected devices from untrusted sources
- Unusual SNMP query patterns
SIEM Query:
source_port=161 AND (oid="iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0" OR oid="iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0")🔗 References
- https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv
- https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.html
- https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv
- https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.html
