CVE-2019-9531
📋 TL;DR
CVE-2019-9531 allows unauthenticated remote attackers to connect via Telnet to port 5454 on Cobham EXPLORER 710 satellite terminals and execute AT commands, potentially gaining shell-like access. This affects organizations using these devices for remote connectivity, particularly in maritime, aviation, and mobile operations.
💻 Affected Systems
- Cobham EXPLORER 710
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to intercept communications, modify device configuration, install persistent backdoors, or use the device as a pivot point into connected networks.
Likely Case
Unauthorized access to device configuration, potential data interception, and disruption of satellite communications services.
If Mitigated
Limited impact if devices are behind firewalls with strict network segmentation and access controls.
🎯 Exploit Status
Simple telnet connection to port 5454 with no authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware version 1.08 or later
Vendor Advisory: https://www.cobham.com/satcom/explorer-710/
Restart Required: Yes
Instructions:
1. Download latest firmware from Cobham support portal. 2. Upload firmware via web interface. 3. Apply update. 4. Reboot device.
🔧 Temporary Workarounds
Block port 5454
linuxUse firewall rules to block external access to port 5454
iptables -A INPUT -p tcp --dport 5454 -j DROP
Disable web portal
allDisable the web application portal if not required
🧯 If You Can't Patch
- Place devices behind firewalls with strict inbound rules blocking port 5454
- Implement network segmentation to isolate EXPLORER 710 devices from critical networks
🔍 How to Verify
Check if Vulnerable:
Attempt telnet connection to device IP on port 5454. If connection succeeds without authentication, device is vulnerable.Check Version:
Check firmware version in web interface under System > AboutVerify Fix Applied:
After patching, attempt telnet connection to port 5454. Connection should be refused or require authentication.📡 Detection & Monitoring
Log Indicators:
- Telnet connections to port 5454
- Unauthorized AT command execution
Network Indicators:
- Outbound connections from port 5454
- Unusual AT command traffic
SIEM Query:
source_port=5454 OR dest_port=5454