CVE-2020-29669
📋 TL;DR
This vulnerability in Macally WIFISD2-2A82 routers allows guest users to exploit a password reset mechanism to escalate privileges to administrator, then gain shell access and dump password hashes including root. Attackers can then crack the root hash for complete system compromise. Only users of this specific router model and firmware version are affected.
💻 Affected Systems
- Macally WIFISD2-2A82 Media and Travel Router
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover with root access, allowing attackers to intercept all network traffic, install persistent malware, and pivot to other network devices.
Likely Case
Administrator account compromise leading to network configuration changes, traffic monitoring, and potential access to connected devices.
If Mitigated
Limited to guest network isolation if properly configured, but still risks privilege escalation within the router itself.
🎯 Exploit Status
Exploit requires guest user access but then provides straightforward privilege escalation path. Multiple public exploit scripts exist.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found
Restart Required: No
Instructions:
No official patch available. Consider replacing affected hardware or implementing workarounds.
🔧 Temporary Workarounds
Disable Guest Network
allCompletely disable guest network functionality to remove attack surface
Login to admin interface > Wireless Settings > Disable Guest Network
Isolate Guest Network
allConfigure guest network with strict isolation from admin interface
Login to admin interface > Advanced Settings > Enable Client Isolation for Guest Network
🧯 If You Can't Patch
- Replace affected routers with different models from vendors with better security track records
- Place router behind additional firewall with strict access controls
🔍 How to Verify
Check if Vulnerable:
Check router web interface for model WIFISD2-2A82 and firmware version 2.000.010Check Version:
Login to router admin interface and check System Status or About pageVerify Fix Applied:
Test if guest user can still access password reset functionality or escalate privileges📡 Detection & Monitoring
Log Indicators:
- Multiple failed admin login attempts followed by success from guest IP
- Guest user accessing password reset endpoints
- Unexpected shell access or configuration changes
Network Indicators:
- Guest network traffic accessing admin interface ports
- Unusual outbound connections from router
SIEM Query:
source="router_logs" AND (event="password_reset" OR event="privilege_escalation" OR user="guest" AND action="admin_access")🔗 References
- http://packetstormsecurity.com/files/160478/Macally-WIFISD2-2A82-2.000.010-Privilege-Escalation.html
- https://drive.google.com/file/d/1PpiRhhfph8U_0KAoIp0AnwY3mVtp-R-g/view
- https://github.com/S1lkys/CVE-2020-29669
- http://packetstormsecurity.com/files/160478/Macally-WIFISD2-2A82-2.000.010-Privilege-Escalation.html
- https://drive.google.com/file/d/1PpiRhhfph8U_0KAoIp0AnwY3mVtp-R-g/view
- https://github.com/S1lkys/CVE-2020-29669
