CVE-2020-13857
📋 TL;DR
This vulnerability allows unauthenticated attackers to reboot Mofi Network MOFI4500-4GXeLTE routers by sending a simple HTTP GET request to poof.cgi. This affects users of specific firmware versions, potentially causing service disruption and denial of service.
💻 Affected Systems
- Mofi Network MOFI4500-4GXeLTE
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Persistent denial of service attacks could render the router unusable, disrupting all network connectivity for extended periods and potentially causing data loss during reboots.
Likely Case
Attackers cause temporary service disruption by repeatedly rebooting the router, interrupting internet connectivity and network services.
If Mitigated
With proper network segmentation and access controls, impact is limited to isolated network segments with minimal business disruption.
🎯 Exploit Status
Exploitation requires only HTTP GET request to vulnerable endpoint. No authentication or special tools needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor for latest firmware
Vendor Advisory: https://mofinetwork.com/index.php?main_page=page&id=14
Restart Required: Yes
Instructions:
1. Log into router admin interface. 2. Navigate to firmware update section. 3. Download latest firmware from vendor. 4. Upload and apply update. 5. Reboot router after update completes.
🔧 Temporary Workarounds
Block External Access to Web Interface
linuxConfigure firewall rules to block external access to router web management interface (typically port 80/443).
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
Disable Web Interface if Not Needed
allTurn off web management interface if router configuration is stable and no longer needs frequent changes.
Check router admin interface for web interface disable option
🧯 If You Can't Patch
- Implement strict network segmentation to isolate router management interface from untrusted networks
- Deploy network-based intrusion prevention system (IPS) to detect and block poof.cgi requests
🔍 How to Verify
Check if Vulnerable:
Send HTTP GET request to http://[router-ip]/poof.cgi and check if router reboots without authentication.Check Version:
Log into router web interface and check firmware version in system status or about page.Verify Fix Applied:
After patching, attempt same request and verify router does not reboot and returns proper authentication error.📡 Detection & Monitoring
Log Indicators:
- HTTP GET requests to /poof.cgi in router logs
- Unexpected router reboot events in system logs
Network Indicators:
- HTTP traffic to router IP on port 80/443 with /poof.cgi in URL
- Increased reboot frequency patterns
SIEM Query:
source="router_logs" AND (url="/poof.cgi" OR event="reboot")