CVE-2018-20396
📋 TL;DR
This vulnerability allows remote attackers to retrieve device credentials via specific SNMP OID requests. It affects NET&SYS MNG2120J and MNG6300 devices running vulnerable firmware versions, exposing authentication information without requiring authentication.
💻 Affected Systems
- NET&SYS MNG2120J
- NET&SYS MNG6300
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain administrative access to network devices, enabling complete network compromise, data exfiltration, and lateral movement to other systems.
Likely Case
Unauthorized users obtain device credentials, leading to unauthorized access, configuration changes, and potential network disruption.
If Mitigated
With proper network segmentation and SNMP access controls, impact is limited to isolated network segments.
🎯 Exploit Status
Exploitation requires only SNMP access and knowledge of the specific OIDs (iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No vendor advisory found
Restart Required: No
Instructions:
Check with NET&SYS for firmware updates. If unavailable, implement workarounds.
🔧 Temporary Workarounds
Disable SNMP or restrict access
allDisable SNMP service entirely or configure access control lists to restrict SNMP access to trusted hosts only.
# Disable SNMP service via device configuration interface
# Configure SNMP ACL: snmp-server community [community-string] ro [acl-name]
Change SNMP community strings
allChange default SNMP community strings to strong, unique values.
# Change via device configuration: snmp-server community [new-strong-community-string] ro
🧯 If You Can't Patch
- Segment affected devices in isolated VLANs with strict firewall rules
- Monitor SNMP traffic for requests to the vulnerable OIDs and alert on suspicious activity
🔍 How to Verify
Check if Vulnerable:
Use snmpwalk or similar tool to query iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 OIDs. If they return credential data, device is vulnerable.Check Version:
Check device firmware version via web interface or SNMP system description OID (1.3.6.1.2.1.1.1.0)Verify Fix Applied:
After implementing workarounds, verify the OIDs no longer return credential data or are inaccessible.📡 Detection & Monitoring
Log Indicators:
- SNMP authentication failures
- Unusual SNMP query patterns from unauthorized sources
Network Indicators:
- SNMP queries to iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 or iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 OIDs
SIEM Query:
source_port:161 AND (destination_oid:"iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0" OR destination_oid:"iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0")🔗 References
- https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv
- https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.html
- https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv
- https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.html
