CVE-2021-45896
📋 TL;DR
This vulnerability in Nokia FastMile 3TG00118ABAD52 devices allows authenticated users to escalate privileges by manipulating the 'is_ctc_admin=1' parameter in login_web_app.cgi and using the Import Config File feature. This affects users with any level of authenticated access to the device's web interface.
💻 Affected Systems
- Nokia FastMile 3TG00118ABAD52
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An authenticated attacker gains full administrative control over the device, potentially modifying configurations, intercepting traffic, or using the device as a pivot point into the network.
Likely Case
An authenticated user (including low-privilege users) escalates to administrative privileges to modify device settings or access sensitive information.
If Mitigated
With proper network segmentation and access controls, impact is limited to the specific device without lateral movement.
🎯 Exploit Status
Exploit requires authenticated access but is simple to execute via web parameter manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not publicly available
Restart Required: No
Instructions:
Check Nokia security advisories for firmware updates. If available, download and apply the latest firmware through the device's web interface.
🔧 Temporary Workarounds
Restrict Web Interface Access
allLimit access to the device's web administration interface to trusted networks only.
Change Default Credentials
allEnsure all user accounts have strong, unique passwords to reduce risk of initial authentication.
🧯 If You Can't Patch
- Segment FastMile devices on isolated network segments
- Implement strict firewall rules limiting device management interface access
🔍 How to Verify
Check if Vulnerable:
Access the device web interface, attempt to append '?is_ctc_admin=1' to login_web_app.cgi URL and check if admin privileges are granted.Check Version:
Check firmware version in device web interface under System Information or similar section.Verify Fix Applied:
Test the same exploit method after applying any firmware updates to confirm it no longer works.📡 Detection & Monitoring
Log Indicators:
- Unusual admin privilege escalations
- Multiple login attempts with parameter manipulation
Network Indicators:
- HTTP requests containing 'is_ctc_admin=1' parameter to login_web_app.cgi
SIEM Query:
web.url:*login_web_app.cgi* AND web.querystring:*is_ctc_admin=1*