CVE-2019-13473
📋 TL;DR
Multiple internet radio devices from TELESTAR, Dabman, and Imperial brands contain an undocumented telnet service in their BusyBox subsystem that provides root access without authentication. This allows attackers to gain complete control over affected devices. All users of these specific internet radio models are affected.
💻 Affected Systems
- TELESTAR Bobs Rock Radio
- Dabman D10
- Dabman i30 Stereo
- Imperial i110
- Imperial i150
- Imperial i200
- Imperial i200-cd
- Imperial i400
- Imperial i450
- Imperial i500-bt
- Imperial i600 TN81HH96-g102h-g102
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to install malware, pivot to internal networks, intercept communications, or use devices as botnet nodes.
Likely Case
Remote attackers gain root shell access to modify device settings, install unauthorized software, or use devices for cryptocurrency mining or DDoS attacks.
If Mitigated
With proper network segmentation and access controls, impact is limited to the isolated device only.
🎯 Exploit Status
Exploitation is trivial - simply telnet to the device on port 23. Public exploit code and detailed analysis available in referenced advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No official vendor advisory found
Restart Required: No
Instructions:
No official patch available. Check manufacturer website for firmware updates, but none have been documented for this vulnerability.
🔧 Temporary Workarounds
Disable Telnet Service
linuxDisable the telnet service if device configuration allows it
telnetd -l /bin/sh -p 23 (check if this can be disabled via device settings)
Block Telnet Port
linuxBlock port 23 at network perimeter
iptables -A INPUT -p tcp --dport 23 -j DROP
🧯 If You Can't Patch
- Segment affected devices on isolated network VLAN with no internet access
- Implement strict firewall rules to block all inbound telnet connections to affected devices
🔍 How to Verify
Check if Vulnerable:
Run 'telnet [device_ip] 23' - if you get a root shell without authentication, device is vulnerableCheck Version:
Check device firmware version via web interface or telnet shell if accessibleVerify Fix Applied:
Attempt telnet connection to port 23 - should be blocked or require authentication📡 Detection & Monitoring
Log Indicators:
- Telnet connection attempts on port 23
- Unauthorized root login events
Network Indicators:
- Unexpected telnet traffic to/from internet radio devices
- Port 23 scans targeting internal devices
SIEM Query:
source_port=23 OR dest_port=23 AND (device_type="internet_radio" OR device_vendor IN ("TELESTAR", "Dabman", "Imperial"))🔗 References
- http://packetstormsecurity.com/files/154416/Dabman-And-Imperial-Web-Radio-Devices-Undocumented-Telnet-Backdoor.html
- http://packetstormsecurity.com/files/174503/Internet-Radio-auna-IR-160-SE-UIProto-DoS-XSS-Missing-Authentication.html
- http://seclists.org/fulldisclosure/2023/Sep/1
- https://www.vulnerability-lab.com/get_content.php?id=2183
- http://packetstormsecurity.com/files/154416/Dabman-And-Imperial-Web-Radio-Devices-Undocumented-Telnet-Backdoor.html
- http://packetstormsecurity.com/files/174503/Internet-Radio-auna-IR-160-SE-UIProto-DoS-XSS-Missing-Authentication.html
- http://seclists.org/fulldisclosure/2023/Sep/1
- https://www.vulnerability-lab.com/get_content.php?id=2183
