CVE-2020-7980
📋 TL;DR
CVE-2020-7980 is a critical remote code execution vulnerability in Intellian Aptus Web 1.24 that allows attackers to execute arbitrary operating system commands via specially crafted JSON data. Attackers can potentially take full control of affected satellite communication systems. Organizations using Intellian Aptus Web 1.24 for satellite terminal management are affected.
💻 Affected Systems
- Intellian Aptus Web
📦 What is this software?
Aptus Web by Intelliantech
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary commands with root privileges, potentially taking over satellite terminals, intercepting communications, or using systems as footholds for further network attacks.
Likely Case
Remote attackers gain shell access to the satellite terminal management system, allowing them to modify configurations, disrupt satellite communications, or install persistent backdoors.
If Mitigated
With proper network segmentation and access controls, impact is limited to the satellite management network segment only.
🎯 Exploit Status
Multiple public exploit scripts available. Requires authentication but default credentials are commonly used. Exploitation is straightforward with available tools.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 1.24 (contact vendor for specific version)
Vendor Advisory: https://www.intelliantech.com/security-advisory
Restart Required: Yes
Instructions:
1. Contact Intellian support for patched firmware. 2. Backup current configuration. 3. Upload and install patched firmware via web interface. 4. Reboot the terminal. 5. Verify installation and restore configuration if needed.
🔧 Temporary Workarounds
Network Segmentation
allIsolate satellite terminal management network from other networks and restrict access to management interface.
Access Control Restrictions
linuxImplement strict firewall rules to limit access to the web management interface to authorized IP addresses only.
iptables -A INPUT -p tcp --dport 80 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Change default credentials and implement strong authentication
- Deploy network-based intrusion prevention system (IPS) with rules to block exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check web interface version at login page or via system information page. Version 1.24 is vulnerable.Check Version:
curl -s http://target-ip/ | grep -i 'version' or check web interface login pageVerify Fix Applied:
Verify firmware version is updated beyond 1.24 and test that JSON payloads to cgi-bin/libagent.cgi no longer execute commands.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /cgi-bin/libagent.cgi
- JSON payloads containing system commands in Q field
- Multiple failed authentication attempts followed by successful login
Network Indicators:
- HTTP POST requests to /cgi-bin/libagent.cgi with JSON containing shell commands
- Outbound connections from satellite terminal to unexpected destinations
SIEM Query:
source="web_logs" AND uri="/cgi-bin/libagent.cgi" AND method="POST" AND (body="*Q*" OR body="*cmd*" OR body="*bash*" OR body="*sh*")🔗 References
- http://packetstormsecurity.com/files/156143/Satellian-1.12-Remote-Code-Execution.html
- https://github.com/Xh4H/Satellian-CVE-2020-7980
- https://sku11army.blogspot.com/2020/01/intellian-aptus-web-rce-intellian.html
- http://packetstormsecurity.com/files/156143/Satellian-1.12-Remote-Code-Execution.html
- https://github.com/Xh4H/Satellian-CVE-2020-7980
- https://sku11army.blogspot.com/2020/01/intellian-aptus-web-rce-intellian.html
