CVE-2020-8958
📋 TL;DR
This CVE allows remote attackers to execute arbitrary operating system commands on affected GPON ONU devices by injecting shell metacharacters into the ping destination IP address field in the web interface. This affects Guangzhou 1GE ONU V2801RW and V2804RGW devices running vulnerable firmware versions. Attackers can gain full control of affected devices without authentication.
💻 Affected Systems
- Guangzhou 1GE ONU V2801RW
- Guangzhou 1GE ONU V2804RGW
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to install persistent backdoors, pivot to internal networks, intercept/modify traffic, or brick devices.
Likely Case
Attackers gain shell access to modify device configuration, steal credentials, or use device as part of botnet.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound rules and network segmentation.
🎯 Exploit Status
Simple HTTP POST request with command injection in Dest IP parameter. Public exploit code available on GitHub.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No vendor advisory found
Restart Required: No
Instructions:
No official patch available. Check vendor website for firmware updates beyond version 2.9.0-181024.
🔧 Temporary Workarounds
Disable web management interface
allDisable the vulnerable boaform web interface if not required for management.
Check device documentation for CLI commands to disable web interface
Network access controls
linuxRestrict access to device management interface using firewall rules.
iptables -A INPUT -p tcp --dport 80 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Isolate affected devices in separate VLAN with strict firewall rules blocking all inbound access to management interfaces
- Implement network monitoring for unusual outbound connections from these devices
🔍 How to Verify
Check if Vulnerable:
Send HTTP POST to /boaform/admin/formPing with Dest IP parameter containing shell metacharacters like ';id;' and check responseCheck Version:
Check web interface login page or device label for firmware versionVerify Fix Applied:
Test if command injection no longer works after applying workarounds or firmware update📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /boaform/admin/formPing with shell metacharacters in parameters
- Multiple failed login attempts followed by formPing requests
Network Indicators:
- HTTP requests to device IP on port 80 with suspicious parameters containing ;, |, &, $, or backticks
- Unexpected outbound connections from device
SIEM Query:
source="device_logs" AND url="/boaform/admin/formPing" AND (param="Dest IP" AND value MATCHES "[;|&$`]+")🔗 References
- https://github.com/qurbat/gpon
- https://www.gpononu.com/dual-mode-onu/1GE-Router-WiFi-ONU.html
- https://www.gpononu.com/gpon-ont/4ge-epon-onu-v2804ew.html
- https://www.karansaini.com/os-command-injection-v-sol/
- https://github.com/qurbat/gpon
- https://www.gpononu.com/dual-mode-onu/1GE-Router-WiFi-ONU.html
- https://www.gpononu.com/gpon-ont/4ge-epon-onu-v2804ew.html
- https://www.karansaini.com/os-command-injection-v-sol/
