CVE-2021-4105
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on BG-TEK COSLAT Firewall devices by exploiting improper parameter handling. It affects all COSLAT Firewall installations running versions from 5.24.0.R.20180630 up to but not including 5.24.0.R.20210727.
💻 Affected Systems
- BG-TEK COSLAT Firewall
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to gain full control of the firewall, pivot to internal networks, intercept/modify traffic, and establish persistent access.
Likely Case
Remote code execution leading to firewall configuration changes, data exfiltration, and use as a foothold for lateral movement within the network.
If Mitigated
Limited impact if firewall is isolated with strict network segmentation and access controls, though RCE still poses significant risk.
🎯 Exploit Status
CVSS 9.8 indicates critical severity with low attack complexity. Remote exploitation without authentication is possible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.24.0.R.20210727 and later
Vendor Advisory: http://blog.coslat.com/2021/07/onemli-kritik-guncelleme-2021-07-27.html
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Download latest firmware from BG-TEK support portal. 3. Apply firmware update via web interface or CLI. 4. Reboot firewall. 5. Verify update successful.
🔧 Temporary Workarounds
Network Segmentation
allRestrict access to firewall management interface to trusted IP addresses only
iptables -A INPUT -p tcp --dport 443 -s trusted_ip_range -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Isolate firewall management interface to dedicated VLAN with strict access controls
- Implement network monitoring and IDS/IPS rules to detect exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check firmware version in web interface (System > Status) or via CLI command 'show version'Check Version:
show versionVerify Fix Applied:
Confirm version is 5.24.0.R.20210727 or later and test management interface functionality📡 Detection & Monitoring
Log Indicators:
- Unusual process execution in system logs
- Unexpected configuration changes
- Failed authentication attempts followed by successful access
Network Indicators:
- Unusual outbound connections from firewall
- Traffic patterns inconsistent with normal operations
- Unexpected ports open on firewall
SIEM Query:
source="coslat-firewall" AND (event_type="process_execution" OR event_type="config_change")