CVE-2018-20400
📋 TL;DR
This vulnerability in Ubee DVW2108 and DVW2110 routers allows remote attackers to retrieve device credentials via specific SNMP OID requests. Attackers can obtain sensitive authentication information without authentication, potentially compromising the entire network. Affected users are those running vulnerable firmware versions on these specific Ubee router models.
💻 Affected Systems
- Ubee DVW2108
- Ubee DVW2110
📦 What is this software?
Dvw2108 Firmware by Ubeeinteractive
Dvw2110 Firmware by Ubeeinteractive
⚠️ Risk & Real-World Impact
Worst Case
Complete network compromise where attackers gain administrative access to routers, intercept all network traffic, deploy malware, and pivot to other connected devices.
Likely Case
Attackers obtain router credentials, change configuration settings, redirect DNS, intercept sensitive data, and potentially gain access to connected devices.
If Mitigated
Limited impact with proper network segmentation, SNMP disabled, and strong perimeter controls preventing external SNMP access.
🎯 Exploit Status
Exploitation requires only SNMP access and knowledge of the specific OIDs (iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0). Public scripts and tools exist for this vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No official vendor advisory found
Restart Required: No
Instructions:
1. Check Ubee support for firmware updates. 2. If update available, download from official source. 3. Backup current configuration. 4. Apply firmware update via web interface. 5. Restore configuration if needed. 6. Verify SNMP is disabled or properly secured.
🔧 Temporary Workarounds
Disable SNMP Service
allCompletely disable SNMP service on affected routers to prevent credential exposure.
Access router web interface -> Advanced Settings -> SNMP -> Disable SNMP
Restrict SNMP Access
allConfigure SNMP to only allow access from trusted IP addresses with proper community strings.
Access router web interface -> Advanced Settings -> SNMP -> Set read-only community string and restrict IP access
🧯 If You Can't Patch
- Replace affected routers with newer models that don't have this vulnerability
- Implement network segmentation to isolate routers from critical systems and restrict SNMP traffic at firewall
🔍 How to Verify
Check if Vulnerable:
Use snmpwalk or similar SNMP tool to query OIDs iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0. If they return credential data, the device is vulnerable.Check Version:
Check router web interface status page or use SNMP to query system description OID (1.3.6.1.2.1.1.1.0)Verify Fix Applied:
After applying workarounds, attempt the same SNMP queries. They should return no data or access denied errors.📡 Detection & Monitoring
Log Indicators:
- Multiple SNMP requests to specific OIDs from single source
- Failed login attempts following SNMP queries
- Configuration changes from unknown sources
Network Indicators:
- SNMP traffic to router from external IPs
- SNMP queries for OIDs containing '4491.2.4.1.1.6.1'
- Unusual outbound traffic patterns after SNMP access
SIEM Query:
source="router_logs" AND (oid="*4491.2.4.1.1.6.1*" OR protocol="SNMP") | stats count by src_ip🔗 References
- https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv
- https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.html
- https://github.com/ezelf/sensitivesOids/blob/master/oidpassswordleaks.csv
- https://misteralfa-hack.blogspot.com/2018/12/stringbleed-y-ahora-que-passwords-leaks.html
