CVE-2020-5635
📋 TL;DR
CVE-2020-5635 is an OS command injection vulnerability in Aterm SA3500G routers that allows attackers on the same network to execute arbitrary commands by sending specially crafted requests to a specific URL. This affects organizations using Aterm SA3500G routers with firmware versions before 3.5.9.
💻 Affected Systems
- NEC Platforms Aterm SA3500G router
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the router allowing attackers to intercept all network traffic, modify router configuration, pivot to internal networks, or install persistent backdoors.
Likely Case
Router takeover leading to network disruption, credential theft, or deployment of malware to connected devices.
If Mitigated
Limited impact if network segmentation prevents adjacent network access or if the router is not internet-facing.
🎯 Exploit Status
The vulnerability requires no authentication and has publicly available proof-of-concept code, making exploitation straightforward for attackers with network access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Ver. 3.5.9
Vendor Advisory: https://www.necplatforms.co.jp/product/security_ap/info_20201211.html
Restart Required: Yes
Instructions:
1. Download firmware version 3.5.9 from NEC Platforms website. 2. Log into router web interface. 3. Navigate to firmware update section. 4. Upload and apply the new firmware. 5. Reboot the router after update completes.
🔧 Temporary Workarounds
Disable web management interface
allTemporarily disable the router's web management interface to prevent exploitation while planning patching.
Login via SSH/Telnet and disable web interface using vendor-specific commands
Network segmentation
allIsolate the router management interface to a dedicated VLAN with strict access controls.
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach the router's management interface
- Monitor network traffic for suspicious requests to the vulnerable URL endpoint
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router web interface under System Information or via SSH/Telnet using vendor-specific version commands.Check Version:
Login to router and check version via web interface or use vendor CLI commandsVerify Fix Applied:
Confirm firmware version shows 3.5.9 or higher in the router management interface.📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP requests to router management URLs
- Multiple failed login attempts followed by command execution patterns
Network Indicators:
- Suspicious HTTP POST requests containing shell metacharacters to router IP
- Unexpected outbound connections from router
SIEM Query:
source_ip=router_ip AND (http_uri CONTAINS "/cgi-bin/" AND http_method="POST" AND http_user_agent UNUSUAL)🔗 References
- https://jvn.jp/en/jp/JVN55917325/index.html
- https://jvn.jp/jp/JVN55917325/index.html
- https://www.necplatforms.co.jp/product/security_ap/info_20201211.html
- https://jvn.jp/en/jp/JVN55917325/index.html
- https://jvn.jp/jp/JVN55917325/index.html
- https://www.necplatforms.co.jp/product/security_ap/info_20201211.html
