CVE-2021-20072
📋 TL;DR
This vulnerability in Racom's MIDGE Firmware allows authenticated attackers to perform directory traversal attacks, enabling arbitrary file access and deletion. It affects systems running the vulnerable firmware version. Attackers with valid credentials can exploit this to compromise system integrity.
💻 Affected Systems
- Racom MIDGE Firmware
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through deletion of critical system files or exfiltration of sensitive configuration data, potentially leading to device bricking or unauthorized access to network infrastructure.
Likely Case
Unauthorized access to sensitive files, configuration tampering, or deletion of operational files causing service disruption.
If Mitigated
Limited impact with proper access controls, network segmentation, and monitoring in place to detect traversal attempts.
🎯 Exploit Status
Exploitation requires valid credentials but directory traversal techniques are well-documented and easy to implement.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Later than 4.4.40.105
Vendor Advisory: https://www.tenable.com/security/research/tra-2021-04
Restart Required: Yes
Instructions:
1. Check current firmware version. 2. Contact Racom for patched firmware. 3. Backup configuration. 4. Apply firmware update. 5. Verify update success. 6. Restart device.
🔧 Temporary Workarounds
Restrict Access Controls
allImplement strict access controls and limit authenticated user privileges to minimize attack surface.
Network Segmentation
allIsolate affected devices in separate network segments with strict firewall rules.
🧯 If You Can't Patch
- Implement strict network access controls to limit device exposure
- Enable detailed logging and monitoring for directory traversal attempts
🔍 How to Verify
Check if Vulnerable:
Check firmware version via device web interface or CLI. If version is 4.4.40.105, device is vulnerable.Check Version:
Check via device web interface or manufacturer-specific CLI commandsVerify Fix Applied:
Verify firmware version is updated to a version later than 4.4.40.105 and test directory traversal attempts fail.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns
- Directory traversal strings in logs
- Multiple failed access attempts
Network Indicators:
- HTTP requests containing '../' patterns
- Unusual file access to system directories
SIEM Query:
http.uri contains "../" AND device.vendor="Racom" AND device.model="MIDGE"