CVE-2021-34690
📋 TL;DR
CVE-2021-34690 allows unauthenticated remote attackers to bypass cloud authentication in iDrive RemotePC for Windows, enabling them to connect to and control vulnerable systems via TCP ports 5970 and 5980. This affects Windows users running RemotePC versions before 7.6.48.
💻 Affected Systems
- iDrive RemotePC
📦 What is this software?
Remotepc by Idrive
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing remote attackers to execute arbitrary commands, steal data, install malware, or use the system as a pivot point for further attacks.
Likely Case
Unauthorized remote access leading to data theft, surveillance, or ransomware deployment on vulnerable systems.
If Mitigated
Limited impact if systems are isolated from the internet and proper network segmentation is in place.
🎯 Exploit Status
The vulnerability is simple to exploit with publicly available proof-of-concept code, requiring only network access to the vulnerable ports.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.6.48 and later
Vendor Advisory: https://www.remotepc.com/release-info
Restart Required: Yes
Instructions:
1. Download and install RemotePC version 7.6.48 or later from the official iDrive website. 2. Restart the system to ensure the update is fully applied.
🔧 Temporary Workarounds
Block vulnerable ports at firewall
windowsBlock inbound connections to TCP ports 5970 and 5980 at network firewalls to prevent remote exploitation.
netsh advfirewall firewall add rule name="Block_RemotePC_Ports" dir=in action=block protocol=TCP localport=5970,5980
Disable RemotePC service
windowsTemporarily disable the RemotePC service until patching can be completed.
sc stop RemotePC
sc config RemotePC start= disabled
🧯 If You Can't Patch
- Isolate affected systems from the internet and restrict network access to only trusted IP addresses.
- Implement strict network monitoring for connections to TCP ports 5970 and 5980 and investigate any unauthorized access attempts.
🔍 How to Verify
Check if Vulnerable:
Check RemotePC version in the application interface or via Windows Programs and Features. If version is earlier than 7.6.48, the system is vulnerable.Check Version:
wmic product where name="RemotePC" get versionVerify Fix Applied:
Confirm RemotePC version is 7.6.48 or later and test that authentication is required for remote connections.📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts followed by successful connections
- Unexpected remote connections from unfamiliar IP addresses
Network Indicators:
- Inbound connections to TCP ports 5970/5980 without preceding authentication traffic
- Unusual outbound traffic patterns from systems running RemotePC
SIEM Query:
source_port=5970 OR source_port=5980 OR dest_port=5970 OR dest_port=5980 | stats count by src_ip, dest_ip