CVE-2021-31538
📋 TL;DR
CVE-2021-31538 is a path traversal vulnerability in LANCOM R&S Unified Firewall devices that allows attackers to access files outside the intended directory. This affects organizations using these firewall devices with vulnerable firmware versions. Attackers could potentially read sensitive configuration files or system information.
💻 Affected Systems
- LANCOM R&S Unified Firewall (UF) devices
📦 What is this software?
Lcos Fx by Lancom Systems
Lcos Fx by Lancom Systems
Lcos Fx by Lancom Systems
Lcos Fx by Lancom Systems
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through reading sensitive configuration files, credentials, or system files leading to further attacks on the network.
Likely Case
Information disclosure of firewall configuration, network topology, or system files that could aid in subsequent attacks.
If Mitigated
Limited impact with proper network segmentation and access controls preventing external exploitation.
🎯 Exploit Status
The advisory includes technical details that could be used to create exploits. Path traversal vulnerabilities are typically easy to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: LCOS FX 10.5 with security patch or later version
Vendor Advisory: https://www.lancom-systems.com/service-support/instant-help/security-advisories/
Restart Required: Yes
Instructions:
1. Check current firmware version. 2. Download latest firmware from LANCOM support portal. 3. Backup configuration. 4. Apply firmware update via web interface or CLI. 5. Reboot device. 6. Verify update successful.
🔧 Temporary Workarounds
Restrict Management Access
allLimit access to firewall management interface to trusted IP addresses only
Configure firewall rules to restrict management interface access
Network Segmentation
allPlace firewall management interface on separate VLAN with strict access controls
Configure VLAN segmentation and access control lists
🧯 If You Can't Patch
- Implement strict network access controls to firewall management interfaces
- Monitor for unusual file access patterns or directory traversal attempts
🔍 How to Verify
Check if Vulnerable:
Check firmware version in web interface or via CLI command 'show version'Check Version:
show versionVerify Fix Applied:
Verify firmware version is updated beyond vulnerable version and test path traversal attempts📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns
- Directory traversal strings in web logs
- Multiple failed access attempts to sensitive paths
Network Indicators:
- HTTP requests containing '../' sequences to firewall management interface
- Unusual traffic patterns to firewall management ports
SIEM Query:
source="firewall_logs" AND ("../" OR "..\" OR "%2e%2e%2f") AND dest_port=443