CVE-2019-13577
📋 TL;DR
CVE-2019-13577 is an unauthenticated remote buffer overflow vulnerability in MAPLE WBT SNMP Administrator's SnmpAdm.exe component. Attackers can exploit this by sending a specially crafted long string to the CE Remote feature on port 987, potentially allowing remote code execution. Organizations using MAPLE WBT SNMP Administrator v2.0.195.15 are affected.
💻 Affected Systems
- MAPLE WBT SNMP Administrator
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with remote code execution leading to attacker gaining full control over the affected system, data theft, and lateral movement within the network.
Likely Case
Remote code execution allowing attackers to install malware, create backdoors, or use the system as a pivot point for further attacks.
If Mitigated
Denial of service if exploit fails or is detected by security controls, with potential system instability.
🎯 Exploit Status
Public exploit code is available, making this easily weaponizable. The vulnerability requires no authentication and has low exploitation complexity.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No official vendor advisory found
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available, or implement workarounds and mitigation strategies.
🔧 Temporary Workarounds
Block Port 987 at Network Perimeter
allPrevent external access to the vulnerable service by blocking TCP port 987 at firewalls and network boundaries.
# Windows Firewall: netsh advfirewall firewall add rule name="Block MAPLE SNMP Port" dir=in action=block protocol=TCP localport=987
# Linux iptables: iptables -A INPUT -p tcp --dport 987 -j DROP
Disable CE Remote Feature
windowsDisable the vulnerable CE Remote feature in MAPLE WBT SNMP Administrator configuration if not required.
🧯 If You Can't Patch
- Isolate affected systems in a segmented network zone with strict access controls
- Implement network-based intrusion detection/prevention systems to monitor for exploitation attempts on port 987
🔍 How to Verify
Check if Vulnerable:
Check if MAPLE WBT SNMP Administrator version 2.0.195.15 is installed and if SnmpAdm.exe is running and listening on port 987.Check Version:
Check program version in Windows Add/Remove Programs or examine file properties of SnmpAdm.exeVerify Fix Applied:
Verify that port 987 is no longer accessible or that the service has been updated to a newer version.📡 Detection & Monitoring
Log Indicators:
- Unusual network connections to port 987
- Large string inputs to SnmpAdm.exe process
- Process crashes or abnormal termination of SnmpAdm.exe
Network Indicators:
- TCP connections to port 987 with large payloads
- Network traffic patterns matching known exploit signatures
SIEM Query:
source_port=987 OR dest_port=987 AND (payload_size>1000 OR contains(payload, 'AAAAAAAA'))🔗 References
- http://hyp3rlinx.altervista.org
- http://packetstormsecurity.com/files/153675/MAPLE-Computer-WBT-SNMP-Administrator-2.0.195.15-Buffer-Overflow.html
- http://seclists.org/fulldisclosure/2019/Jul/17
- https://seclists.org/bugtraq/2019/Jul/29
- http://hyp3rlinx.altervista.org
- http://packetstormsecurity.com/files/153675/MAPLE-Computer-WBT-SNMP-Administrator-2.0.195.15-Buffer-Overflow.html
- http://seclists.org/fulldisclosure/2019/Jul/17
- https://seclists.org/bugtraq/2019/Jul/29
