CVE-2018-8755
📋 TL;DR
CVE-2018-8755 allows unauthenticated attackers to download the configuration file from NuCom WR644GACV devices, exposing admin passwords, WPA keys, and all device configuration. This affects NuCom WR644GACV devices running firmware versions before STA006. Attackers can gain complete control of affected devices without any credentials.
💻 Affected Systems
- NuCom WR644GACV
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover, network compromise, credential theft, and persistent backdoor access to the network.
Likely Case
Unauthorized access to device configuration, password theft, and potential network infiltration.
If Mitigated
Limited impact if devices are behind firewalls with strict network segmentation and access controls.
🎯 Exploit Status
Simple HTTP request to download configuration file. No authentication or special tools required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: STA006 or later
Vendor Advisory: https://blog.nivel4.com/investigaciones/vulnerabilidad-en-los-dispositivos-nucom-wr644gacv/
Restart Required: Yes
Instructions:
1. Download firmware version STA006 or later from vendor. 2. Log into device admin interface. 3. Navigate to firmware update section. 4. Upload and apply new firmware. 5. Reboot device.
🔧 Temporary Workarounds
Network Access Control
allRestrict access to device management interface using firewall rules
Configuration File Protection
allManually change default credentials and WPA keys after initial setup
🧯 If You Can't Patch
- Isolate affected devices in separate VLAN with strict access controls
- Implement network monitoring for configuration file download attempts
🔍 How to Verify
Check if Vulnerable:
Attempt to access http://[device-ip]/config.bin without authentication. If file downloads, device is vulnerable.Check Version:
Check firmware version in device web interface under System Status or About sectionsVerify Fix Applied:
After patching, attempt same access. Should return 404 or authentication required.📡 Detection & Monitoring
Log Indicators:
- HTTP GET requests to /config.bin from unauthorized IPs
- Multiple failed authentication attempts followed by config.bin access
Network Indicators:
- Unusual HTTP traffic to device management interface
- Configuration file downloads from unexpected sources
SIEM Query:
source_ip=* AND dest_ip=[device_ip] AND url_path="/config.bin" AND http_method=GET