CVE-2020-35757
📋 TL;DR
This vulnerability allows unauthenticated attackers to enable ADB over TCP on Libre Wireless LS9 devices, granting them root access. Any LS9 device with its web interface accessible is affected, enabling complete device compromise.
💻 Affected Systems
- Libre Wireless LS9
📦 What is this software?
Ls9 Firmware by Librewireless
⚠️ Risk & Real-World Impact
Worst Case
Full root compromise of the device, allowing installation of persistent malware, data theft, and use as a pivot point into internal networks.
Likely Case
Attackers gain root shell access to modify device configuration, intercept traffic, or disable security controls.
If Mitigated
With proper network segmentation and access controls, impact is limited to the isolated device only.
🎯 Exploit Status
Simple HTTP request to enable ADB over TCP, then standard ADB connection for root access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Apply workarounds and network controls.
🔧 Temporary Workarounds
Block web interface access
linuxRestrict access to the LS9 web management interface using firewall rules.
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
Disable ADB service
allPermanently disable ADB service on the device if not required.
adb shell setprop persist.service.adb.enable 0
adb shell stop adbd
🧯 If You Can't Patch
- Isolate LS9 devices in separate VLAN with strict access controls
- Implement network monitoring for ADB connection attempts (default port 5555)
🔍 How to Verify
Check if Vulnerable:
Attempt to access the web interface endpoint that enables ADB without authentication.Check Version:
Check device firmware version via web interface or serial consoleVerify Fix Applied:
Verify web interface is inaccessible and ADB service is not running on port 5555.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to ADB enable endpoint
- ADB service start events
Network Indicators:
- TCP connections to port 5555 (ADB)
- Unauthenticated web requests to management interface
SIEM Query:
source_port=5555 OR dest_port=5555 OR (http_uri CONTAINS "/adb_enable")