CVE-2018-20394
📋 TL;DR
This vulnerability allows remote attackers to retrieve device credentials via SNMP requests to specific OIDs. Affected are Thomson DWG849, DWG850-4, DWG855, and TWG870 devices running vulnerable firmware versions, potentially exposing administrative passwords to unauthorized parties.
💻 Affected Systems
- Thomson DWG849
- Thomson DWG850-4
- Thomson DWG855
- Thomson TWG870
📦 What is this software?
Dwg849 Firmware by Technicolor
Dwg850 4 Firmware by Technicolor
Dwg855 Firmware by Technicolor
Twg870 Firmware by Technicolor
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain administrative access to the device, enabling complete compromise including configuration changes, traffic interception, and use as a pivot point into internal networks.
Likely Case
Attackers harvest credentials to gain unauthorized access to device management interfaces, potentially leading to network disruption or data exfiltration.
If Mitigated
With proper network segmentation and SNMP access controls, impact is limited to credential exposure without subsequent exploitation.
🎯 Exploit Status
Exploitation requires only SNMP read access to specific OIDs using standard SNMP tools like snmpwalk or snmpget.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No official vendor advisory found
Restart Required: No
Instructions:
Check with device vendor for firmware updates. If unavailable, implement workarounds below.
🔧 Temporary Workarounds
Disable SNMP or restrict access
allDisable SNMP service entirely or configure access control lists to restrict SNMP access to trusted hosts only.
Configuration varies by device - consult device administration interface
Change default credentials
allChange all default administrative passwords immediately to prevent credential reuse if exposed.
Use device web interface or CLI to change admin passwords
🧯 If You Can't Patch
- Segment affected devices into isolated network zones with strict firewall rules
- Implement network monitoring for SNMP requests to sensitive OIDs and alert on suspicious activity
🔍 How to Verify
Check if Vulnerable:
Run snmpwalk command: snmpwalk -v2c -c public [device_ip] .1.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and .1.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 - if they return values, device is vulnerable.Check Version:
Check device web interface or use snmpwalk to query system description OID: .1.3.6.1.2.1.1.1.0Verify Fix Applied:
After applying workarounds, repeat the snmpwalk command - it should return noSuchInstance or access denied errors.📡 Detection & Monitoring
Log Indicators:
- Multiple SNMP GET requests to OIDs .1.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and .1.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 from untrusted sources
Network Indicators:
- SNMP traffic (UDP port 161) from external IPs to affected devices
- Pattern of SNMP queries to sensitive OIDs
SIEM Query:
source_ip NOT IN trusted_networks AND dest_port=161 AND (oid="1.3.6.1.4.1.4491.2.4.1.1.6.1.1.0" OR oid="1.3.6.1.4.1.4491.2.4.1.1.6.1.2.0")🔗 References
- https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv
- https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.html
- https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv
- https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.html
