CVE-2020-11965
📋 TL;DR
CVE-2020-11965 allows attackers to gain full remote root access via SSH on IQrouter devices that have not completed initial configuration. This affects IQrouter systems through version 3.3.1 that remain in their factory default state. The vendor claims this only impacts brand-new networks before secure password configuration.
💻 Affected Systems
- IQrouter
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with root access, allowing attackers to install malware, steal data, pivot to other network devices, or disrupt network operations.
Likely Case
Unauthorized root access on newly deployed IQrouter devices before initial configuration, potentially leading to network reconnaissance and lateral movement.
If Mitigated
No impact on properly configured systems with secure passwords set during initial setup.
🎯 Exploit Status
Simple SSH connection attempt with root user and no password. Exploit trivial for unconfigured devices.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: https://evenroute.zendesk.com/hc/en-us/articles/216107838-How-do-I-configure-an-IQrouter-
Restart Required: No
Instructions:
Complete initial configuration wizard and set secure password for root user during setup as required by vendor.
🔧 Temporary Workarounds
Disable SSH or restrict access
linuxDisable SSH service or configure firewall to restrict SSH access to trusted IPs only
uci set firewall.ssh=rule
uci set firewall.ssh.name='SSH'
uci set firewall.ssh.src='wan'
uci set firewall.ssh.dest_port='22'
uci set firewall.ssh.target='DROP'
uci commit firewall
/etc/init.d/firewall restart
Set root password immediately
linuxManually set root password via command line before completing full configuration
passwd root
🧯 If You Can't Patch
- Complete initial configuration immediately with secure password
- Disable SSH access until configuration is complete
🔍 How to Verify
Check if Vulnerable:
Attempt SSH connection: 'ssh root@[iqrouter-ip]' without password. If login succeeds, device is vulnerable.Check Version:
cat /etc/iqrouter-version or check web interfaceVerify Fix Applied:
Attempt SSH connection with same command. Should prompt for password or deny access.📡 Detection & Monitoring
Log Indicators:
- Failed SSH authentication attempts for root user
- Successful SSH logins for root without password authentication
Network Indicators:
- SSH connections to port 22 from unexpected sources
- Multiple SSH connection attempts to root account
SIEM Query:
source="auth.log" AND "sshd" AND "root" AND "Accepted password for none" OR "Accepted publickey for none"🔗 References
- https://evenroute.com/
- https://evenroute.zendesk.com/hc/en-us/articles/216107838-How-do-I-configure-an-IQrouter-
- https://openwrt.org/docs/guide-quick-start/walkthrough_login
- https://pastebin.com/grSCSBSu
- https://evenroute.com/
- https://evenroute.zendesk.com/hc/en-us/articles/216107838-How-do-I-configure-an-IQrouter-
- https://openwrt.org/docs/guide-quick-start/walkthrough_login
- https://pastebin.com/grSCSBSu
