CVE-2018-6401
📋 TL;DR
Meross MSS110 smart plug devices contain a hidden TELNET service with an undocumented admin account that has a blank password. This allows attackers to gain full administrative access to the device. All users of affected Meross MSS110 devices are vulnerable.
💻 Affected Systems
- Meross MSS110 Smart Wi-Fi Plug Mini
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to install persistent malware, pivot to internal networks, or use devices as botnet nodes for DDoS attacks.
Likely Case
Attackers gain administrative access to smart plugs, enabling them to control power states, monitor network traffic, or use devices as entry points to home/office networks.
If Mitigated
Limited impact if devices are isolated on separate VLANs with strict firewall rules blocking TELNET access.
🎯 Exploit Status
Exploitation requires only TELNET client and knowledge of the undocumented admin account with blank password.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.24 and later
Vendor Advisory: https://www.meross.com/ (no specific advisory found)
Restart Required: Yes
Instructions:
1. Open Meross app 2. Check for firmware updates 3. Apply update to version 1.1.24 or later 4. Device will restart automatically
🔧 Temporary Workarounds
Block TELNET access
linuxConfigure firewall to block inbound TELNET connections to affected devices
iptables -A INPUT -p tcp --dport 23 -j DROP
Disable TELNET service
allIf device allows, disable TELNET service via configuration
🧯 If You Can't Patch
- Isolate devices on separate VLAN with strict firewall rules
- Implement network segmentation to prevent lateral movement from compromised devices
🔍 How to Verify
Check if Vulnerable:
Attempt TELNET connection to device port 23 and try logging in with admin account and blank passwordCheck Version:
Check firmware version in Meross mobile app under device settingsVerify Fix Applied:
After update, TELNET connection should be refused or require authentication📡 Detection & Monitoring
Log Indicators:
- Failed TELNET authentication attempts
- Successful TELNET logins from unexpected sources
Network Indicators:
- TELNET traffic to port 23 on IoT devices
- Unusual outbound connections from IoT devices
SIEM Query:
source_port=23 OR dest_port=23 AND (event_type="authentication" OR event_type="connection")