CVE-2021-45418
📋 TL;DR
This directory traversal vulnerability in Starcharge Nova 360 Cabinet and Titan 180 Premium products allows attackers to access arbitrary files on the system via the main.cgi endpoint. It affects users running vulnerable firmware versions, potentially exposing sensitive configuration files, credentials, or system data.
💻 Affected Systems
- Starcharge Nova 360 Cabinet
- Starcharge Titan 180 Premium
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through reading sensitive files like configuration files containing credentials, followed by authentication bypass or remote code execution.
Likely Case
Unauthorized access to sensitive system files, configuration data, or logs leading to information disclosure and potential privilege escalation.
If Mitigated
Limited impact with proper network segmentation and access controls preventing external exploitation attempts.
🎯 Exploit Status
Directory traversal attacks are well-understood with simple path manipulation techniques. Public GitHub repository contains proof-of-concept details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Nova 360 Cabinet: 1.3.0.0.9, Titan 180 Premium: Beta1.3.0.1.0
Vendor Advisory: http://starcharge.com
Restart Required: Yes
Instructions:
1. Download latest firmware from Starcharge website. 2. Access device web interface. 3. Navigate to firmware update section. 4. Upload and apply new firmware. 5. Reboot device after update completes.
🔧 Temporary Workarounds
Network Access Restriction
linuxBlock external access to device web interface using firewall rules
iptables -A INPUT -p tcp --dport 80 -s ! 192.168.1.0/24 -j DROP
iptables -A INPUT -p tcp --dport 443 -s ! 192.168.1.0/24 -j DROP
Web Server Configuration
allAdd input validation to block directory traversal patterns if custom web server configuration is possible
🧯 If You Can't Patch
- Isolate affected devices in separate VLAN with strict network segmentation
- Implement web application firewall (WAF) rules to block directory traversal patterns like ../ and ..\
🔍 How to Verify
Check if Vulnerable:
Attempt to access /main.cgi?page=../../../etc/passwd or similar traversal patterns via web browser or curlCheck Version:
Check firmware version in device web interface under System > About or similar menuVerify Fix Applied:
After patching, retry directory traversal attempts - should return error or sanitized response📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing ../ or ..\ patterns
- Access to unusual file paths via main.cgi
- Multiple failed traversal attempts
Network Indicators:
- Unusual GET requests to main.cgi with path traversal sequences
- Traffic spikes to device web interface from external IPs
SIEM Query:
source="web_logs" AND uri="*main.cgi*" AND (uri="*../*" OR uri="*..\\*")