CVE-2018-20442
📋 TL;DR
This vulnerability allows remote attackers to retrieve Wi-Fi credentials from Technicolor TC7110.B routers via SNMP requests. Attackers can obtain sensitive authentication information without authentication, affecting users of these specific devices with vulnerable firmware.
💻 Affected Systems
- Technicolor TC7110.B
📦 What is this software?
Tc7110.b Firmware by Technicolor
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain unauthorized access to the Wi-Fi network, enabling man-in-the-middle attacks, data interception, and further network compromise.
Likely Case
Local network attackers or internet scanners discover and steal Wi-Fi credentials, leading to unauthorized network access.
If Mitigated
With SNMP disabled or properly secured, the vulnerability cannot be exploited, though the underlying flaw remains.
🎯 Exploit Status
Exploitation requires only SNMP access and knowledge of the specific OIDs. Public blog posts demonstrate the attack.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not publicly available
Restart Required: No
Instructions:
Check vendor website for firmware updates. If unavailable, apply workarounds.
🔧 Temporary Workarounds
Disable SNMP
allTurn off SNMP service on the router to prevent credential exposure.
Restrict SNMP Access
allConfigure SNMP to only allow access from trusted IP addresses with strong community strings.
🧯 If You Can't Patch
- Isolate the router on a separate network segment with strict firewall rules.
- Change Wi-Fi credentials regularly and monitor for unauthorized access attempts.
🔍 How to Verify
Check if Vulnerable:
Use snmpwalk or similar tool to query OIDs iso.3.6.1.4.1.2863.205.10.1.30.4.1.14.1.3.32 and iso.3.6.1.4.1.2863.205.10.1.30.4.2.4.1.2.32. If they return Wi-Fi credentials, the device is vulnerable.Check Version:
Check router web interface or use SNMP to query system description OID 1.3.6.1.2.1.1.1.0 for firmware version.Verify Fix Applied:
After applying workarounds, repeat the SNMP query. It should fail or return no sensitive data.📡 Detection & Monitoring
Log Indicators:
- SNMP requests to the specific OIDs from unauthorized sources
- Failed authentication attempts on Wi-Fi with newly exposed credentials
Network Indicators:
- SNMP traffic to port 161/UDP from external IPs
- Unusual SNMP query patterns
SIEM Query:
source_port=161 AND (oid="iso.3.6.1.4.1.2863.205.10.1.30.4.1.14.1.3.32" OR oid="iso.3.6.1.4.1.2863.205.10.1.30.4.2.4.1.2.32")