CVE-2019-13411
📋 TL;DR
This critical vulnerability in HiNet GPON firmware allows unauthenticated remote attackers to execute arbitrary commands through port 3097. It affects HiNet GPON devices running firmware versions before I040GWR190731. Attackers can gain complete control of affected devices from anywhere on the internet.
💻 Affected Systems
- HiNet GPON devices
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the device allowing attackers to install persistent backdoors, pivot to internal networks, intercept/modify traffic, or use the device for botnet activities.
Likely Case
Remote code execution leading to device takeover, credential theft, network reconnaissance, and potential lateral movement to other systems.
If Mitigated
If properly firewalled and network segmentation is in place, impact limited to the specific device with no lateral movement.
🎯 Exploit Status
The vulnerability is simple to exploit with publicly available proof-of-concept code. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: I040GWR190731 or later
Vendor Advisory: https://www.twcert.org.tw/en/cp-128-3013-92adb-2.html
Restart Required: Yes
Instructions:
1. Download firmware version I040GWR190731 or later from vendor. 2. Backup current configuration. 3. Apply firmware update through device management interface. 4. Reboot device. 5. Verify firmware version.
🔧 Temporary Workarounds
Block port 3097 at firewall
linuxBlock external access to port 3097 on affected devices
iptables -A INPUT -p tcp --dport 3097 -j DROP
iptables -A INPUT -p udp --dport 3097 -j DROP
Network segmentation
allIsolate GPON devices in separate VLAN with restricted access
🧯 If You Can't Patch
- Implement strict firewall rules blocking all external access to port 3097
- Monitor network traffic to port 3097 for suspicious activity and implement IDS/IPS rules
🔍 How to Verify
Check if Vulnerable:
Check firmware version via device management interface or CLI. If version is earlier than I040GWR190731, device is vulnerable.Check Version:
Check via device web interface or vendor-specific CLI commands (varies by device model)Verify Fix Applied:
Verify firmware version shows I040GWR190731 or later in device management interface.📡 Detection & Monitoring
Log Indicators:
- Unusual connections to port 3097
- Unexpected command execution logs
- Failed authentication attempts to device management
Network Indicators:
- Traffic to port 3097 from unexpected sources
- Unusual outbound connections from GPON devices
- Command injection patterns in network traffic
SIEM Query:
source_port:3097 OR dest_port:3097 AND (event_type:connection OR event_type:firewall)