CVE-2019-13025
📋 TL;DR
CVE-2019-13025 is a critical remote code execution vulnerability in Compal CH7465LG cable modems. Attackers can send specially crafted HTTP POST requests to execute arbitrary shell commands on the device. This affects users of Compal CH7465LG devices with vulnerable firmware.
💻 Affected Systems
- Compal CH7465LG cable modem
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full device compromise allowing attacker to install persistent backdoors, intercept/modify network traffic, pivot to internal networks, or brick the device.
Likely Case
Attackers gain shell access to execute commands, potentially stealing credentials, modifying DNS settings, or launching attacks against internal network devices.
If Mitigated
With proper network segmentation and access controls, impact limited to the cable modem itself without lateral movement.
🎯 Exploit Status
Exploit requires sending a single HTTP POST request with shell commands in the payload. No authentication or special privileges needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware versions after CH7465LG-NCIP-6.12.18.24-5p8-NOSH
Vendor Advisory: No public vendor advisory found
Restart Required: Yes
Instructions:
1. Check current firmware version via modem web interface. 2. Contact ISP for firmware updates. 3. Apply firmware update through web interface. 4. Reboot modem after update.
🔧 Temporary Workarounds
Network segmentation
allIsolate cable modem from internal network using separate VLAN or firewall rules
Access control restrictions
linuxBlock external access to modem management interface using firewall rules
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Replace vulnerable modem with different model from ISP
- Implement strict network monitoring for suspicious HTTP requests to modem IP
🔍 How to Verify
Check if Vulnerable:
Check firmware version in modem web interface at http://192.168.0.1 or modem IP. If version is CH7465LG-NCIP-6.12.18.24-5p8-NOSH or earlier, device is vulnerable.Check Version:
curl -s http://192.168.0.1/version or check web interfaceVerify Fix Applied:
Verify firmware version has been updated to a newer version than CH7465LG-NCIP-6.12.18.24-5p8-NOSH.📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP POST requests to modem management interface
- Shell command execution in system logs
- Unexpected process creation
Network Indicators:
- HTTP POST requests containing shell metacharacters to modem IP
- Outbound connections from modem to suspicious IPs
SIEM Query:
source="modem.log" AND ("POST" AND (";" OR "|" OR "$" OR "`"))