CVE-2020-11967
📋 TL;DR
CVE-2020-11967 allows remote attackers to execute administrative actions (restart network, reboot, upgrade, reset) on IQrouter devices due to incorrect access control. This affects IQrouter users who have not completed initial configuration with a secure password. The vendor claims this only impacts brand-new, unconfigured networks.
💻 Affected Systems
- IQrouter
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover allowing attackers to reboot, reset to factory defaults, or install malicious firmware updates, potentially creating persistent backdoors.
Likely Case
Network disruption through forced reboots or configuration resets, causing service downtime for connected users.
If Mitigated
No impact if device has been properly configured with secure credentials during initial setup.
🎯 Exploit Status
Exploit details available in public pastebin. Simple HTTP requests can trigger administrative actions without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 3.3.1
Vendor Advisory: https://evenroute.zendesk.com/hc/en-us/articles/216107838-How-do-I-configure-an-IQrouter-
Restart Required: No
Instructions:
1. Complete initial configuration wizard. 2. Set secure administrator password. 3. Update to latest IQrouter firmware if available. 4. Ensure device is not exposed to untrusted networks during setup.
🔧 Temporary Workarounds
Complete Initial Configuration
allForce completion of initial setup wizard and set secure password
Follow configuration guide at https://evenroute.zendesk.com/hc/en-us/articles/216107838-How-do-I-configure-an-IQrouter-
Network Isolation During Setup
allConfigure device in isolated network environment before deployment
🧯 If You Can't Patch
- Ensure device completes initial configuration with strong password before network deployment
- Isolate device from untrusted networks during initial setup phase
🔍 How to Verify
Check if Vulnerable:
Check if device has completed initial configuration by attempting to access admin interface without credentials. If accessible, device is vulnerable.Check Version:
Check web interface or use SSH: cat /etc/version or uci get system.@system[0].hostnameVerify Fix Applied:
Verify secure password is set and required for administrative actions. Test that unauthenticated requests to administrative endpoints are rejected.📡 Detection & Monitoring
Log Indicators:
- Unauthenticated administrative requests in web server logs
- Unexpected device reboots or configuration changes
Network Indicators:
- HTTP POST requests to administrative endpoints without authentication headers
- Unusual traffic to device management interfaces
SIEM Query:
source="iqrouter" AND (url="*/cgi-bin/luci/admin/*" OR action="reboot" OR action="reset") AND NOT user!=""🔗 References
- https://evenroute.com/
- https://evenroute.zendesk.com/hc/en-us/articles/216107838-How-do-I-configure-an-IQrouter-
- https://openwrt.org/docs/guide-quick-start/walkthrough_login
- https://pastebin.com/grSCSBSu
- https://evenroute.com/
- https://evenroute.zendesk.com/hc/en-us/articles/216107838-How-do-I-configure-an-IQrouter-
- https://openwrt.org/docs/guide-quick-start/walkthrough_login
- https://pastebin.com/grSCSBSu
