CVE-2020-13860
📋 TL;DR
This vulnerability allows attackers to predict the one-time password for the undocumented 'mofidev' system account on affected Mofi routers. Attackers can gain unauthorized administrative access to the router's management interface. This affects MOFI4500-4GXeLTE routers running version 4.0.8-std firmware.
💻 Affected Systems
- Mofi Network MOFI4500-4GXeLTE
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of router with ability to intercept all network traffic, modify DNS settings, install malware, and pivot to internal network devices.
Likely Case
Unauthorized administrative access to router configuration, enabling traffic monitoring, network disruption, and credential theft.
If Mitigated
Limited impact if router management interface is not exposed to untrusted networks and strong perimeter controls exist.
🎯 Exploit Status
Exploitation requires network access to router management interface but no authentication. The predictable algorithm makes brute force trivial.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Later than 4.0.8-std
Vendor Advisory: https://mofinetwork.com/index.php?main_page=page&id=14
Restart Required: Yes
Instructions:
1. Log into router admin interface. 2. Navigate to System > Firmware Upgrade. 3. Download latest firmware from Mofi website. 4. Upload and install firmware. 5. Reboot router.
🔧 Temporary Workarounds
Disable remote management
allPrevent external access to router management interface
Firewall restrictions
allRestrict access to router management ports (typically 80/443) to trusted IPs only
🧯 If You Can't Patch
- Isolate router on separate VLAN with strict network segmentation
- Implement network monitoring for unauthorized access attempts to router management interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface under System > Status. If version is 4.0.8-std, device is vulnerable.Check Version:
Login to router web interface and navigate to System > Status pageVerify Fix Applied:
Verify firmware version is updated to version later than 4.0.8-std. Test that 'mofidev' account no longer accepts predictable OTPs.📡 Detection & Monitoring
Log Indicators:
- Failed login attempts for 'mofidev' account
- Successful logins from unexpected IP addresses
- Configuration changes from unauthorized sources
Network Indicators:
- Unusual traffic patterns to/from router management ports
- DNS configuration changes
- Unexpected outbound connections from router
SIEM Query:
source="router_logs" (user="mofidev" OR dest_port=80 OR dest_port=443) AND action="login"