CVE-2018-6387
📋 TL;DR
CVE-2018-6387 is a critical authentication bypass vulnerability affecting iBall iB-WRA150N routers. The devices have hardcoded credentials for admin, support, and user accounts that cannot be changed, allowing attackers to gain administrative access. Anyone using iBall iB-WRA150N routers with firmware version 1.2.6 build 110401 Rel.47776n is affected.
💻 Affected Systems
- iBall iB-WRA150N
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete network compromise - attacker gains administrative router access, can intercept all traffic, redirect DNS, install malware on connected devices, and use the router as a pivot point into the internal network.
Likely Case
Unauthorized administrative access to router configuration, allowing network traffic monitoring, DNS hijacking, and credential theft from connected devices.
If Mitigated
Limited impact if router is isolated in a separate VLAN with strict firewall rules and network segmentation.
🎯 Exploit Status
Exploitation requires only knowledge of the hardcoded credentials (admin:admin, support:support, user:user) and access to the router's web interface or SSH/Telnet services.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None available
Vendor Advisory: No vendor advisory found
Restart Required: No
Instructions:
No official patch exists. The only complete remediation is to replace affected devices with different models or brands that don't have this vulnerability.
🔧 Temporary Workarounds
Network isolation and access control
allIsolate the router in a separate VLAN with strict firewall rules to limit exposure and prevent lateral movement.
Disable remote management
allDisable WAN-side administration and restrict management access to specific internal IP addresses only.
🧯 If You Can't Patch
- Replace affected iBall routers with different models from vendors that don't have hardcoded credentials
- Implement network segmentation to isolate the router and limit potential damage from compromise
🔍 How to Verify
Check if Vulnerable:
Attempt to log into the router web interface using admin:admin, support:support, or user:user credentials. If successful, the device is vulnerable.Check Version:
Check router web interface status page or use SSH/Telnet to view firmware version information.Verify Fix Applied:
Since no patch exists, verification involves confirming the device has been replaced or isolated. Test that the hardcoded credentials no longer work on the replacement device.📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts followed by successful login with admin/support/user accounts
- Configuration changes from unexpected IP addresses
Network Indicators:
- Unusual outbound connections from router
- DNS queries to suspicious domains
- Traffic redirection patterns
SIEM Query:
source="router_logs" AND (event="login_success" AND (user="admin" OR user="support" OR user="user"))