CVE-2018-20392
📋 TL;DR
This vulnerability allows remote attackers to retrieve administrative credentials from S-A WebSTAR DPC2100 devices via specific SNMP OID requests. The credentials are exposed without authentication, enabling complete device compromise. Affected systems are S-A WebSTAR DPC2100 v2.0.2r1256-060303 devices with SNMP enabled.
💻 Affected Systems
- S-A WebSTAR DPC2100
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full device takeover leading to network compromise, credential theft, and potential lateral movement within the network.
Likely Case
Administrative credential disclosure allowing unauthorized access to device configuration and management interfaces.
If Mitigated
Limited impact if SNMP is disabled or access is restricted to trusted networks only.
🎯 Exploit Status
Simple SNMP GET requests to the specified OIDs return credentials. Public proof-of-concept scripts and references exist.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No known vendor advisory
Restart Required: No
Instructions:
No official patch available. Apply workarounds instead.
🔧 Temporary Workarounds
Disable SNMP Service
allCompletely disable SNMP service on affected devices to prevent credential exposure.
Access device web interface > Administration > SNMP > Disable SNMP
Restrict SNMP Access
allConfigure SNMP to only respond to requests from trusted IP addresses.
Access device web interface > Administration > SNMP > Configure Access Control Lists
🧯 If You Can't Patch
- Isolate affected devices in separate network segments with strict firewall rules
- Monitor SNMP traffic for requests to the vulnerable OIDs and implement network-based blocking
🔍 How to Verify
Check if Vulnerable:
Use snmpwalk or snmpget to query OIDs: snmpwalk -v2c -c public <device_ip> iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0Check Version:
Check device web interface or use SNMP: snmpwalk -v2c -c public <device_ip> sysDescr.0Verify Fix Applied:
Verify SNMP is disabled or the OIDs no longer return credential data using the same snmpget commands.📡 Detection & Monitoring
Log Indicators:
- SNMP authentication failures
- Unusual SNMP query patterns
- Access to management interfaces from unexpected sources
Network Indicators:
- SNMP GET requests to iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 or iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 OIDs
SIEM Query:
source_port=161 AND (oid="iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0" OR oid="iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0")🔗 References
- https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv
- https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.html
- https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv
- https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.html
