CVE-2020-13858
📋 TL;DR
This vulnerability involves two undocumented administrator accounts (sftp and mofidev) with hardcoded, non-unique passwords in Mofi Network MOFI4500-4GXeLTE routers. Attackers can gain full administrative access to affected devices, potentially compromising network security. All users of affected router models and firmware versions are at risk.
💻 Affected Systems
- Mofi Network MOFI4500-4GXeLTE
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of router with ability to intercept all network traffic, install persistent backdoors, pivot to internal networks, and disrupt connectivity.
Likely Case
Unauthorized administrative access leading to network monitoring, credential theft, and potential lateral movement to connected devices.
If Mitigated
Limited impact if accounts are disabled or passwords changed, though default configuration remains vulnerable.
🎯 Exploit Status
Exploitation requires only knowledge of the hardcoded credentials, which are not unique across devices.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor for latest firmware
Vendor Advisory: https://mofinetwork.com/index.php?main_page=page&id=14
Restart Required: Yes
Instructions:
1. Log into router admin interface. 2. Navigate to firmware update section. 3. Download latest firmware from vendor. 4. Upload and apply firmware update. 5. Reboot router.
🔧 Temporary Workarounds
Disable vulnerable accounts
linuxRemove or disable the sftp and mofidev accounts from /etc/passwd
sed -i '/^sftp:/d' /etc/passwd
sed -i '/^mofidev:/d' /etc/passwd
Change account passwords
linuxSet strong, unique passwords for sftp and mofidev accounts
passwd sftp
passwd mofidev
🧯 If You Can't Patch
- Implement network segmentation to isolate routers from critical systems
- Enable logging and monitoring for authentication attempts on these accounts
🔍 How to Verify
Check if Vulnerable:
Check /etc/passwd for sftp and mofidev accounts: grep -E '^(sftp|mofidev):' /etc/passwdCheck Version:
Check firmware version in router web interface or via ssh: cat /etc/versionVerify Fix Applied:
Verify accounts are removed or disabled: grep -E '^(sftp|mofidev):' /etc/passwd should return no results📡 Detection & Monitoring
Log Indicators:
- Failed or successful authentication attempts for sftp or mofidev accounts
- Unauthorized configuration changes
Network Indicators:
- Unexpected SSH/SFTP connections to router
- Unusual outbound traffic from router
SIEM Query:
source="router_logs" AND (user="sftp" OR user="mofidev")